Sessions / LevelBlue: Inside 1,500+ Incidents: Closing the Blind Spots In Your Trusted Tools & Processes
LevelBlue: Inside 1,500+ Incidents: Closing the Blind Spots In Your Trusted Tools & Processes
Monday, June 01, 2026 / 03:15 PM - 03:45 PM EDT
Share
About the Session
With 300+ IR experts responding to 1000s of engagements every year, LevelBlue sees how modern attackers really operate. Devon Ackerman, Global Services Leader of DFIR and former FBI Supervisory Special Agent, shares three frontline stories: Microsoft Graph API abuse for stealth data exfiltration, SEO poisoning that creates accidental insider threats, and help desk social engineering tied to MFA resets. Real cases, real lessons.