Every preserved presentation from IR19 lives in the Past Presentations library alongside material from the other conferences.
Reconstructed from the original agenda and speaker glossary, preserved from the legacy site. Where the two sources disagree, both are noted.
Breakfast
Keynote: Mike Rogers, former Chair of the House Intelligence Committee
Analyst Taking Back the SOC: Eliminating Alert Fatigue
Khoi Ngo, Fidelis Cybersecurity
Manager Malign Influence Incident Response
Joseph H. Schafer, National Defense University
C-Level Gaining the Decisive Advantage: Outmaneuver, Outperform and Outfight Adversaries
Craig Harber, Fidelis Cybersecurity
Cyber ranges Wargaming sessions, both ranges, all day
SimSpace
Analyst Incident Response in the Cloud
Aaron Sherman, Braintrace
Manager Purple Team Tactics: Detecting LOLBin Attacks
Alissa Torres, SimSpace
C-Level Harnessing the Power of Behavioral Analytics
Mel Shakir, Securonix
Lunch
Main hall discussion panel
Analyst Log Analysis with AWK
Brad Isbell, SimSpace
Manager The First 72 Hours: How to Approach the Initial Hours of a Security Incident
Bryan Geraldo, Fidelis Cybersecurity
C-Level Is Your Cyber Incident Response Plan Battle-Ready? A Cyber Table Top Exercise
Braintrace: Aaron Sherman, Greg Spicer and Diane Burt
Product demonstrations and booth meetings
Main hall, ending of day one
Breakfast
Keynote: Ryan Corey (CEO, Cybrary, IRC board member) and Joseph Loomis (Founder and CTO, CyberSponse)
Analyst Attivo Networks session
Chris Roberts (agenda) / Vincent Jones and Sean McCallister (speaker glossary)
Manager Deception technology
Tony Cole, Attivo Networks
C-Level The Cost of a Breach
Sam Elkholy, CyberSponse
Analyst Incident Response Planning Framework
Bruce Diamond, SimSpace
Manager Unknown Cyber Range (AUCR): A Standardized Open Source Web Framework
Wyatt Roersma, SimSpace
C-Level Modernizing Your SOC
David Swift, Securonix
Lunch
Main hall discussion panel
Analyst Security Automation: A Love Story
Ethan Packard, CyberSponse
Manager SOC fundamentals
Christopher Crowley (per speaker glossary)
C-Level Closing C-Level session
Larry Johnson (per speaker glossary)
Main hall, ending of day two and the War Gaming Awards Ceremony
Titles and companies as of the event.
Andy Bonillo
CISO, Ciena; co-host, Task Force 7 Radio (listed keynote)
Diane Burt
Director, Governance, Risk and Compliance, Braintrace
Matt Chevraux
Assistant Special Agent in Charge, U.S. Secret Service
Hugh Clapp
Senior Director, Defensive Cyber Operations, Symantec
Tony Cole
CTO, Attivo Networks
Ryan Corey
CEO and Co-Founder, Cybrary; IRC board member
Philippe Courtot
CEO, Qualys
Christopher Crowley
SOC trainer and consultant
Bruce Diamond
Sr. Cybersecurity Instructor, SimSpace
Sam Elkholy
Director of Systems Engineering, CyberSponse
Bryan Geraldo
VP, Services Consulting, Fidelis Cybersecurity
Craig Harber
CTO, Fidelis Cybersecurity
Brad Isbell
Senior Range Engineer, SimSpace
Larry Johnson
CEO, CyberSponse
Joseph Loomis
Founder and CTO, CyberSponse
Khoi Ngo
Fidelis Cybersecurity
Ethan Packard
Systems Engineer, CyberSponse
James Phillips
Network Threat Hunter, MI613
Chris Roberts
Chief Security Strategist, Attivo Networks
Wyatt Roersma
Senior Cyber Defense Operator, SimSpace
Mike Rogers
Former Chair, House Intelligence Committee (keynote)
Boyden Rohner
Director of Cybersecurity Operations, DHS
Joseph H. Schafer
IT and Cyber Strategy Professor, National Defense University
Mel Shakir
VP, Product Development, Securonix
Aaron Sherman
Sr. Director of Cyber Threat Intelligence, Braintrace
Gregory Spicer
Chief Revenue Officer, Braintrace
David Swift
Principal Architect, Security Analytics, Securonix
Alissa Torres
DFIR Consultant and Trainer, SimSpace
IR19 ran on 4 and 5 September 2019 in Arlington, Virginia. It brought together IR practitioners across vendors, IR firms, government and industry for two days of sessions on the working reality of incident response.
The session list preserved here represents the breadth of what was discussed: the day-to-day grind of alert fatigue, the strategic question of cost of a breach, the early days of SOAR adoption, and the operational discipline of shrinking dwell time. Several of the contributors went on to be longtime members of the IRC community.
The conference was followed by the quiet period that the November 2024 relaunch announcement broke. IR19 is the last IRC-branded conference of that era. The 2026 relaunch returns to the community-of-practice model, but events going forward are smaller-format breakfasts, community calls and offsites rather than full conferences.
Community calls coming up, new resources published, and what we're seeing across the membership.
One email a month. Unsubscribe any time. Read our privacy notice.