The Hackers Left. Now What?

The attackers are gone. Systems are down. Everyone wants to know what happened. In this fast-paced look inside a cyber incident, we’ll take a pile of incomplete and sometimes misleading evidence and try to reconstruct what actually happened. As new clues emerge, the story changes, assumptions get challenged, and the obvious answer may turn out not to be the right one. Along the way, we’ll see how incident responders turn scattered technical evidence into answers that founders, executives, attorneys, IT teams, and security professionals can actually use. No security background is required. If you enjoy solving puzzles, understanding how systems fail, or seeing how investigators make decisions when the evidence is incomplete, this talk is for you.