This article looks back at recent editions of the region’s gathering of incident response teams and invites you to join us for the 2026 edition.
When there is a security incident, few things matter more than knowing who to call. That network of trust can’t be built mid-crisis; it takes shape long before, in forums where teams get to know each other, share lessons learned, and realize they are facing remarkably similar challenges.
That is the spirit behind the FIRST Regional Symposium Latin America & Caribbean, an initiative led by LACNIC’s CSIRT with the continued support of CERT.br/NIC.br. Held alongside LACNIC and LACNOG each year, the symposium brings together the region’s incident response community.
(Free access, no subscription required)
What Is It and Why Does It Matter?
FIRST (Forum of Incident Response and Security Teams) is a global forum that brings together incident response and security teams from around the world. Its symposia provide a space for sharing information on vulnerabilities, incidents, tools, and other issues affecting the operation of incident response and security teams.
The regional event is open not only to FIRST members, but also to emerging CSIRTs across the region, SOC staff, Internet security professionals, law enforcement agencies, and decision-makers.
Bringing Communities Together Around a Common Goal
Holding the FIRST Symposium for Latin America and the Caribbean alongside the LACNIC event makes a great deal of sense: it brings together those who operate networks and those who respond when those networks are under threat or have been compromised. It combines the knowledge and experience of a diverse audience around a common goal: making the Internet a safer place for everyone.
What Is It and Why Does It Matter?
FIRST (Forum of Incident Response and Security Teams) is a global forum that brings together incident response and security teams from around the world. Its symposia provide a space for sharing information on vulnerabilities, incidents, tools, and other issues affecting the operation of incident response and security teams.
The regional event is open not only to FIRST members, but also to emerging CSIRTs across the region, SOC staff, Internet security professionals, law enforcement agencies, and decision-makers.
Bringing Communities Together Around a Common Goal
Holding the FIRST Symposium for Latin America and the Caribbean alongside the LACNIC event makes a great deal of sense: it brings together those who operate networks and those who respond when those networks are under threat or have been compromised. It combines the knowledge and experience of a diverse audience around a common goal: making the Internet a safer place for everyone.
A Look Back at Previous Editions
Fortaleza, Brazil (2023). During LACNIC 40, Einar Lanfranco (OAS) presented how the CSIRTAmericas network uses IntelMQ, an open-source tool, to automate the processing of threat data from multiple sources. Graciela Martínez and Guillermo Pereyra from LACNIC’s CSIRT provided an update on our HoneyNet and explained how the data it collects is turned into security reports for members. The second day featured hands-on training on container security and a ransomware simulation led by Giovanni Cruz Forero.
Asunción, Paraguay (2024). At LACNIC 42, one of the presentations highlighted the value of cross-sector collaboration. Marcos Centurión and Ruslan Osorio described how cooperation between a private-sector team and CERT-PY enabled the analysis of a Mozi botnet campaign targeting residential GPON routers in Paraguay. Tiago Reis Barbosa (CAIS/RNP) examined the AllaSenha threat, while Luciano Righetti (CIRCL) delivered a full-day training session on MISP, the open-source platform for sharing threat intelligence.
San Salvador, El Salvador (2025). During LACNIC 44, Badí Quinteros (CEDIA) presented findings from the monitoring of 47 universities in Ecuador. As institutions remediated publicly exposed vulnerabilities, the proportion with a critical rating dropped from 23.4% to 11.1%. Lucimara Desiderá (CERT.br) reviewed key controls for ransomware prevention and detection, while Guillermo Pereyra (LACNIC CSIRT) demonstrated how RIPE Atlas can be used to analyze phishing sites from multiple geographic vantage points.
The common thread? Real-world cases from across the region, open-source tools, and a shared understanding that no incident response team operates in isolation.
This is cybersecurity community building at its best.
Next Stop: Mendoza
The 2026 edition will be held in Mendoza, Argentina, on October 21–22, alongside LACNIC 46 and LACNOG 2026, with both in-person and remote participation available.
October 21: Plenary Sessions
October 22: Training led by members of the Argentine Federal Police on security incidents involving malicious content and cryptocurrencies, focusing on information preservation and collaboration between CSIRTs and investigators.
How to Participate
Whether you are part of a CSIRT or SOC, or involved in launching an incident response team, this event is for you. Bring your questions and experiences to connect with peers from across the region. See you in Mendoza.
Participation is included with registration for the LACNIC event.
Registration is free but involves two steps: sign up for the symposium via the FIRST portal and register separately for LACNIC 46 / LACNOG 2026.
