The Practitioner Forum.

Who it's for

People doing incident response as a meaningful part of their working week. Not the people who manage them, not the vendors selling to them, not the analysts writing about them. The responders themselves.

• Internal IR leads and SOC managers
• Consulting IR practitioners at IR firms, Big 4, and boutiques
• Forensic and threat intel practitioners working incident cases
• Detection engineers and threat hunters with active incident workload
• Government and CNI responders with appropriate clearance to participate

If your job description says incident response but you have not personally worked an incident in the last twelve months, this is probably not the right Forum for you. The community calibrates on what people are actually doing, not what their title says.

How vetting works

Membership is application-based. The form takes about five minutes. We ask what you do, where, and what kind of incidents you've worked on. We do not ask for references on the form, but we may follow up if your context is unusual.

Decisions come back inside two weeks. Approval gives you access to the Practitioner tier: peer-only WhatsApp, community calls, the Resources contribution flow, and the option to author Practitioner Runbooks.

What you get

Monthly community calls. Sixty minutes. One practitioner leads with a short case study or open question; the rest of the call is peer discussion. Recorded for members who couldn't attend. Chatham House by default.

Regional breakfasts. Twelve practitioners, no slides, two hours, agenda set by attendees the week before. London first. Other UK cities and international locations to follow as the membership grows.

Peer-only WhatsApp. A members-only group for between-event conversations. Used for what peer communities are actually useful for: asking the question you can't put in a ticket and don't want to put on a thread.

Editorial Committee path. Active practitioner members are eligible to join the Editorial Committee that curates the Resources library. The committee is paid an honorarium per cycle of work.

What you contribute

Nothing mandatory. The Forum works best when members contribute, but the floor is just showing up.

Things members are encouraged to do over a year of membership:

• Lead at least one community call
• Author or co-author one Practitioner Runbook for the library
• Attend at least one breakfast in person
• Vouch for one other practitioner whose application would benefit from it

Cost

No fee. Funded by IRC's operating budget and founding partners.

Joining

Applications open now. Use the link below, or email practitioner@incidentresponse.com if your situation needs context.