From Zero to Prepared: Implementing a Weekly Incident Response Drill Program @FIRSTdotorg
From Zero to Prepared: Implementing a Weekly Incident Response Drill Program  @FIRSTdotorg
Uploaded August 2025 | Updated September 2026, 8 hours ago
Jeffrey Carpenter (Accuray, Inc., US)

Jeffrey Carpenter has dedicated more than 35 years to improving the state of information security in roles such as incident responder, product security officer, information security officer and leader. He currently is the deputy CISO at Accuray, a medical device manufacturer. Jeffrey spent two decades at the CERT® Coordination Center, based at Carnegie Mellon University's Software Engineering Institute and he also was Senior Director of Incident Response Consulting and Threat Intelligence at Dell Secureworks. Jeffrey has been inducted into the Incident Response Hall of Fame by the Forum of Incident Response and Security Teams (FIRST).
--
Many incident response teams lack the real-world incident experience needed to confidently respond to attacks. This presentation demonstrates how to implement a weekly cyber drill program to build muscle memory and enhance incident response skills within your team. We will showcase how realistic scenarios, injected challenges, and post-drill analysis can cultivate practical expertise and improve incident response playbooks. A key focus will be how to leverage Large Language Models (LLMs) like Google Gemini and ChatGPT to accelerate and streamline the drill creation process. Attendees will learn how to design a weekly drill program, use AI to generate content, and drive improvements in their incident response process. Leave with ready to use drills, prompts and actionable knowledge that will help improve your teams capability and confidence. Targeted at incident response leaders and managers, but valuable for all team members.

Materials for this session will be located here: bit.ly/cyber-drills
From Zero to Prepared: Implementing a Weekly Incident Response Drill ProgramIndicator Message eXchange (IMX): Enabling Structured Cyber Threat Intelligence SharingEpisode 57: Vijay Sarvepalli and Christopher Cullen, FIRSTCON26 SpeakersImproving Security Across Nations with FIRST: Éireann Leverett, FIRST LiaisonTechnical Recovery Plan (TRP) Exercise in a Cloud-Native Environment: Practical Lessons ...CVE Decaf: Brewing Better and More Actionable Data QualityLeveraging AI to Review and Strengthen Your Incident Response Plan: A Proof of ConceptWho Did It? Getting Started with Threat Actor ProfilingFIRSTCON26 Event RecapEpisode 59: Julie Agnes Sparks and Greg Foss, Datadog, FIRSTCON26 SpeakersHow Attackers Reconstruct You: Measuring Identity Exposure Across Four Attack SurfacesDealing With Uncertainty: Scenario Planning for Cybersecurity Decision-Making
FIRST |

From Zero to Prepared: Implementing a Weekly Incident Response Drill Program

SHARE TO X SHARE TO REDDIT SHARE TO FACEBOOK WALLPAPER