Format
Location
Audience Level
Themes & Topics
Building Secure Technology
Hacking, Red Teaming
Law, Policy and Global Power
Leadership, Governance and Accountability
People, Culture and Workforce
Running Secure Operations
Breakout

What SOC leaves behind: The evidence DFIR needs

Ryan Betts
Thu
 
15 Oct
10:55 am
 - 
11:35 am
Room 211
Running Secure Operations
Incident Response, Crisis Coordination and Recovery

Triage decisions made during SOC escalation can destroy the forensic evidence DFIR investigators need, and this session closes that handover gap.

26101510552211
Intermediate

Secure your place at CyberCon 2026

Join thousands of cyber security professionals in Melbourne this October.

Speaker in a grey suit presenting at a lectern on stage
Woman being interviewed with a Ticker microphone on the expo floor
Audience members smiling and taking photos on their phones during a session
Speaker presenting on stage against a blue and pink backdrop
Attendees wearing CyberCon headphones listening during a session
Panellists seated in white armchairs on stage during a conference discussion
Keynote speaker presenting on stage with a title slide behind him
Speaker addressing the audience with a microphone as a colleague looks on