Go Back

What SOC leaves behind: The evidence DFIR needs

Ryan Betts
2026-10-14 9:00 am
Breakout
Running Secure Operations
Incident Response, Crisis Coordination and Recovery

Triage decisions made during SOC escalation can destroy the forensic evidence DFIR investigators need, and this session closes that handover gap.

Get Your Ticket
Ryan Betts is senior responder at Thales Cyber Services Australia, presenting on the evidence a SOC leaves behind for DFIR investigators.
Ryan Betts
Senior Responder
Thales
Ryan Betts is senior responder at Thales Cyber Services Australia, presenting on the evidence a SOC leaves behind for DFIR investigators.

There's More Where This Came From

Browse hundreds of sessions and build an agenda around the topics that matter to you.

Full Speaker Lineup
Get Your Ticket
Speaker in a grey suit presenting at a lectern on stage
Woman being interviewed with a Ticker microphone on the expo floor
Audience members smiling and taking photos on their phones during a session
Speaker presenting on stage against a blue and pink backdrop
Attendees wearing CyberCon headphones listening during a session
Panellists seated in white armchairs on stage during a conference discussion
Keynote speaker presenting on stage with a title slide behind him
Speaker addressing the audience with a microphone as a colleague looks on