Sh!t hit the fan: True tales of incident response you wont find in a textbook

Let’s be honest - cybersecurity isn’t always firewalls and frameworks. Sometimes, it’s waking up to an alert at 3am, realizing someone’s been quietly rummaging through your network like a bin chicken on ice. In this session, I plan on sharing the greatest hits (and facepalms) from over 400 real-world incident investigations led by Sophos’ MDR and Incident Response teams.

You’ll get a behind-the-scenes look at a handful of true breach stories: what the attackers did once inside, how they got in, and, most importantly, what simple forehead-slappingly obvious things could’ve stopped them.

Spoiler Alert, it’s never a nation-state with a quantum computer. It’s almost always an unpatched box, weak credentials, or someone clicking the digital equivalent of “Download Malware Now!”

This isn’t a technical deep dive into obscure exploits. It’s a practical reminder that the basics matter. Do 20% of the simple stuff right, and you’ll prevent 80% of the bad stuff from happening. It’s the 80/20 rule, but with more ransomware and less theory.

Expect war stories, real talk, and the kind of lessons you’ll wish your board understood. No buzzwords, no BS. Just actual incidents, actual fixes, and maybe a few laughs along the way (because if we don’t laugh, we’ll cry).