{"id":34511,"date":"2026-09-29T13:09:33","date_gmt":"2026-09-29T13:09:33","guid":{"rendered":"https:\/\/blog.lacnic.net\/?p=34511"},"modified":"2026-09-29T15:02:32","modified_gmt":"2026-09-29T15:02:32","slug":"first-symposium-in-lac","status":"publish","type":"post","link":"https:\/\/blog.lacnic.net\/en\/first-symposium-in-lac\/","title":{"rendered":"The FIRST Symposium in LAC: Building Community for Better Incident Response"},"content":{"rendered":"\n

Authors: Graciela Mart\u00ednez <\/a>& Guillermo Pereyra<\/a><\/em><\/p>\n\n\n\n

This article looks back at recent editions of the region’s gathering of incident response teams and invites you to join us for the 2026 edition.<\/p>\n\n\n\n

When there is a security incident, few things matter more than knowing who to call. That network of trust can’t be built mid-crisis; it takes shape long before, in forums where teams get to know each other, share lessons learned, and realize they are facing remarkably similar challenges.<\/p>\n\n\n\n

That is the spirit behind the FIRST Regional Symposium Latin America & Caribbean, an initiative led by LACNIC\u2019s CSIRT with the continued support of CERT.br\/NIC.br. Held alongside LACNIC and LACNOG each year, the symposium brings together the region\u2019s incident response community.<\/p>\n\n\n\n

What Is It and Why Does It Matter?<\/strong><\/h2>\n\n\n\n

FIRST (Forum of Incident Response and Security Teams) is a global forum that brings together incident response and security teams from around the world. Its symposia provide a space for sharing information on vulnerabilities, incidents, tools, and other issues affecting the operation of incident response and security teams.<\/p>\n\n\n\n

The regional event is open not only to FIRST members, but also to emerging CSIRTs across the region, SOC staff, Internet security professionals, law enforcement agencies, and decision-makers.<\/p>\n\n\n\n

Bringing Communities Together Around a Common Goal<\/strong><\/h2>\n\n\n\n

Holding the FIRST Symposium for Latin America and the Caribbean alongside the LACNIC event makes a great deal of sense: it brings together those who operate networks and those who respond when those networks are under threat or have been compromised. It combines the knowledge and experience of a diverse audience around a common goal: making the Internet a safer place for everyone.<\/p>\n\n\n\n

A Look Back at Previous Editions<\/strong><\/h2>\n\n\n\n

Fortaleza, Brazil (2023).<\/strong> During LACNIC 40, Einar Lanfranco (OAS) presented how the CSIRTAmericas network uses IntelMQ, an open-source tool, to automate the processing of threat data from multiple sources. Graciela Mart\u00ednez and Guillermo Pereyra from LACNIC\u2019s CSIRT provided an update on our HoneyNet and explained how the data it collects is turned into security reports for members. The second day featured hands-on training on container security and a ransomware simulation led by Giovanni Cruz Forero.<\/p>\n\n\n\n

Asunci\u00f3n, Paraguay (2024).<\/strong> At LACNIC 42, one of the presentations highlighted the value of cross-sector collaboration. Marcos Centuri\u00f3n and Ruslan Osorio described how cooperation between a private-sector team and CERT-PY enabled the analysis of a Mozi botnet campaign targeting residential GPON routers in Paraguay. Tiago Reis Barbosa (CAIS\/RNP) examined the AllaSenha threat, while Luciano Righetti (CIRCL) delivered a full-day training session on MISP, the open-source platform for sharing threat intelligence.<\/p>\n\n\n\n

San Salvador, El Salvador (2025).<\/strong> During LACNIC 44, Bad\u00ed Quinteros (CEDIA) presented findings from the monitoring of 47 universities in Ecuador. As institutions remediated publicly exposed vulnerabilities, the proportion with a critical rating dropped from 23.4% to 11.1%. Lucimara Desider\u00e1 (CERT.br) reviewed key controls for ransomware prevention and detection, while Guillermo Pereyra (LACNIC CSIRT) demonstrated how RIPE Atlas can be used to analyze phishing sites from multiple geographic vantage points.<\/p>\n\n\n\n

The common thread?<\/strong> Real-world cases from across the region, open-source tools, and a shared understanding that no incident response team operates in isolation.<\/p>\n\n\n\n


This is cybersecurity community building at its best.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Next Stop: Mendoza<\/strong><\/h2>\n\n\n\n


The 2026 edition will be held in Mendoza, Argentina, on October 21\u201322<\/strong>, alongside LACNIC 46 and LACNOG 2026, with both in-person and remote participation available.<\/p>\n\n\n\n