Talks and podcasts, 2002–2026
Keynotes, conference sessions, panels, webinars, the occasional class, and other people’s podcasts. The topics drift in a predictable way: logs, then PCI DSS, then SIEM (still not dead), then the SOC, and lately AI agents in the SOC. Some slides aged better than I expected. Some did not.
The Gartner years are rebuilt from old summit agendas and archived blog posts, so some regional summits and client events are surely missing. My own shows (LogChat and the Cloud Security Podcast by Google) are not listed. The 2002–2011 entries come from my original list, cross-checked against the blog.
Jump to: 2026 2025 2024 2023 2022 2021 2020 2019 2018 2017 2016 2015 2014 2013 2012 2011 2010 2009 2008 2007 2006 2005 2004 2003 2002 undated
2020–2026 Chronicle and Google CloudOffice of the CISO; Cisco from September 2026
2026 7 talks, 5 podcasts
SANS summit online
Presentation: “Never Trust an Algorithm: Applying Zero Trust Principles to Secure AI and Agent Infrastructures (with Dave Shackleford)”
SANS 2026 Cloud Security Exchange online
Panel: “Cloud security exchange with AWS, Google and Microsoft (with Wesley Kuzma and Frank Kim)”
Down the Security Rabbithole (DtSR) online
Podcast: “Episodes 713 and 714: Limitations and Expectations for AI SOC”
The Segment online
Podcast: “Same Problems, Different Decade (with Erik Bloch)”
Google Cloud Next ’26, Las Vegas, NV
Presentation: “AI SOC vs. AI in Your SOC: What Is Real Today and What Is Coming (BRK1-087, with Allie Mellen)”
RSAC 2026 Conference, San Francisco, CA
Peer-led discussion: “AI in SecOps: Sharing Lessons Learned for Adoption Maturity (CXN-R05)”
RSAC 2026 Conference, San Francisco, CA
Presentation: “Shadow Agents: A Pragmatist’s Guide to Governing Unsanctioned AI (STR-W08)”
RSAC 2026 Conference, San Francisco, CA
Presentation: “This Is How We Do It: Building AI Agents for Cybersecurity and Defense (PART3-M07)”
Cyber Risk Management Podcast online
Podcast: “EP 202: Why Fortune 500s Still Run on Windows 2003”
2025 13 talks, 8 podcasts
ClearTech Loop online
Podcast: “AI Only Works If Your Foundations Do”
The Cybersecurity Defenders Podcast online
Podcast: “#262: What Does “AI-ready SOC” Actually Mean?”
Down the Security Rabbithole (DtSR) online
Podcast: “Episode 669: ADR Enters the SOC Chat (with Jeff Williams)”
SANS 2025 Cloud Security Exchange online
Keynote: “Google Cloud Keynote: Cloud Security Groundhog Day: Avoiding Recurring Mistakes in a Dynamic Landscape (plus expert panel with AWS and Microsoft)”
SuperSOC online
Podcast: “Making AI Useful in the SOC: Data, Metrics & Human Skills”
Gartner Security & Risk Management Summit 2025, National Harbor, MD
Presentation: “Securing AI: Practical Steps Beyond the Hype”
Crying Out Cloud (Wiz) online
Podcast: “AI-powered Security, Shared Fate, and an Archery Lesson”
RSA Conference 2025, San Francisco, CA
Presentation: “Data-as-Code: Securing the Future of AI Model Development”
RSA Conference 2025, San Francisco, CA
Presentation: “Clouds Are Secure: Are You Using Them Securely?” OK, But How Do I Do It?
RSA Conference 2025, San Francisco, CA
Presentation: “Shadow AI: Shining the Governance Light on AI”
ISMG webinar online
Webinar: “How Google Does It: Making Threat Detection Scalable and Securing Our Own Cloud (with Tim Nguyen and Seth Vargo)”
SecureWorld Financial Services Virtual Conference 2025 online
Keynote: “Demystifying AI Security & Defending the Future (fireside chat with Marina Kaganovich)”
ISMG AI Virtual Summit 2025: Americas online
Presentation: “Secure AI 2025: Lessons We’ve Learned”
CISO Platform “Best of the World Talks” online
Fireside chat: “Practical AI in Cybersecurity (with David Randleman, FireCompass)”
PwC Global Cybersecurity Summit 2025
Presentation: “Rethinking the SOC: Transforming with Google SecOps”
Google Cloud Security webcast (BrightTALK) online
Webinar: “The Agentic SOC: Humans, Agents, and the Future of Defense (with Allie Mellen, Forrester)”
2024 10 talks, 6 podcasts
Down the Security Rabbithole (DtSR) online
Podcast: “Episode 632: The Politics of Detection Response and Security Operations”
SANS webcast series online
Webinar: “Cloud Security: First Principles and Future Opportunities, Part 4 of 5 (with Frank Kim and Brandon Evans)”
mWISE Conference 2024, Denver, CO
Presentation: “The Cloud Security Paradox: Secure Cloud, Insecure Use”
SANS Cloud Security Exchange 2024 online
Presentation: “Evolving Cloud Security with a Modern Approach”
CTRL+F (with Jamil Jaffer) online
Podcast: “Unleashing the Power of Cloud and Edge Computing (with Jeremy Hitchcock)”
Techstrong DevOps Connect: DevSecOps at RSAC 2024, San Francisco, CA
Presentation: “Securing AI with SAIF”
Google Cloud Next ’24, Las Vegas, NV
Presentation: “How AI Can Transform Your Approach to Security (SEC102, with Bashar Abouseido and Steph Hay)”
Google Cloud Next ’24, Las Vegas, NV
Presentation: “A Cybersecurity Expert’s Guide to Securing AI Products with Google SAIF (SEC207, with Shan Rao)”
CISO Talk online
Podcast: “Exploring AI and Cloud Security: Software Supply Chain and Workload Security”
Black Hat webcast (with CardinalOps) online
Webinar: “SIEM Migration: Breaking Up is Hard to Do (with Jay Lillie)”
Google Cloud Security webcast (BrightTALK) online
Webinar: “Smooth SIEM Surgery: Practical Tips for SIEM Migration Success in 2024 (with Dave Herrald)”
2023 11 talks, 11 podcasts
SANS webcast (with CardinalOps) online
Webinar: “Heroes (and Anti-Heroes) of the SOC (with Jay Lillie)”
Detection at Scale (Panther) online
Podcast: “Decoupled SIEMs and the Future of Data Platforms and Security”
Down the Security Rabbithole (DtSR) online
Podcast: “Episode 578: Maybe A Modern Day SOC Discussion”
Risk and Reels online
Podcast: “S2 Ep. 5: Security Operations: Learning What Works”
theCUBE at mWISE 2023 online
Podcast: “Interview with Rebecca Knight and John Furrier on threat detection, adaptation and training”
SANS Cloud Security Exchange 2023 online
Presentation: “Cloud Security: Shared Fate, Identity, Secure Data and the Coming AI (with Dave Shackleford)”
Google Cloud Next ’23, San Francisco, CA
Presentation: “Detecting, Investigating, and Responding to Threats in Your Google Cloud Environment (SEC210, with John Stoner)”
Detection at Scale (Panther) online
Podcast: “How to Take Your D&R Efforts from 0 to 1, or 5, or 100 (with Timothy Peacock)”
Building Cyber Resilience online
Podcast: “Threat Hunting in the Cloud for Fun and Profit (with Anuj Malkapuram)”
The Cybersecurity Defenders Podcast online
Podcast: “#30: A Conversation on the History of Security Tooling”
DEATH Labs (Netenrich) online
Podcast: “25 Years of SIEM: The Rocky Journey to Autonomic Security Operations”
Black Hat webcast (with CardinalOps) online
Webinar: “Insights From the 2023 State of Cloud Threat Detection and Response Report (with Phil Neray)”
The Digital Society (Atos) online
Podcast: “Episode 4: Modernizing Security Operations: How the Cloud Is Changing the Game”
SANS webcast (with CardinalOps) online
Webinar: “SOC, Meet Cloud. Cloud, Meet SOC. What Changes, and What Stays the Same? (with Phil Neray)”
Down the Security Rabbithole (DtSR) online
Podcast: “Episode 535: Let’s Ask AI Security Questions”
2022 9 talks, 10 podcasts
Humans of InfoSec (Cobalt) online
Podcast: “Episode 76: Exploring Security in the Past, Present, and Future”
Down the Security Rabbithole (DtSR) online
Podcast: “Episode 528: So Many Vendors, So Few Solutions”
Black Hat webcast (with CardinalOps) online
Webinar: “SOC Modernization: Where Do We Go From Here?”
Down the Security Rabbithole (DtSR) online
Podcast: “Episode 521: The Peanut Gallery Takes on XDR”
Cloud Ace (SANS) online
Podcast: “Remapping Mental Models in IT, Security, and Compliance for the Cloud (with Brandon Evans)”
Google Cloud Next ’22 online
Presentation: “How to Prepare for Detection & Response in the Cloud (with Marshall Heilman)”
SANS 2022 Cloud Security Exchange online
Presentation: “Building an Operational Security Strategy in Google Cloud”
Google Cloud Security Summit 2022 online
Presentation: “Taking an Autonomic Approach to Security Operations (with Iman Ghanizada)”
Down the Security Rabbithole (DtSR) online
Podcast: “Episode 500: Looking Back to Look Forward (Parts 1 and 2)”
Down the Security Rabbithole (DtSR) online
Podcast: “Episode 492: Operationally Useful Blocklists”
Siemplify webinar online
Webinar: “Embracing the Journey of Security Operations Modernization (with Jovan Scott)”
Google Cloud Security Talks online
Panel: “Autonomic Security Operations (with Robert Herjavec, Eric Foster and Iman Ghanizada)”
Cloud and Clear (SADA) online
Podcast: “EP 117: Running More Securely with SADA and Google Cloud Security”
2021 8 talks, 6 podcasts
Down the Security Rabbithole (DtSR) online
Podcast: “Episode 475: Community Sourced Threat Instructions”
Black Hat USA 2021, Las Vegas, NV Details unconfirmed
Presentation: Title not recorded
SANS webcast (with SOC Prime) online
Webinar: “How to Level Up Your Threat Detection Practice (with Andrii Bezverkhyi)”
RSAC 365 webcast online
Webinar: “Remember When We Used to Call It “Information Security”? Let’s Go Back to That”
The Monica Talks Cyber Show online
Podcast: “Solving security the cloudy way”
Tech For Work (TABGEEKS) online
Podcast: “E009 special guest”
2020 3 talks, 6 podcasts
Down the Security Rabbithole (DtSR) online
Podcast: “Episode 424: SOC Fight 2020 (with Richard Stiennon)”
Cloud Infrastructure meetup online
Fireside chat: “Cloud Native SOC (with Dmitriy Dunavetsky)”
SANS webcast online
Webinar: “Detecting Malicious Activity in Large Enterprises (with Matt Bromiley)”
Enterprise Security Weekly #195 online
Podcast: “Security Weekly Virtual Hacker Summer Camp interview”
Security Architecture Podcast online
Podcast: “Kickoff Episode: SASE (Secure Access Service Edge)”
Google Cloud Platform Podcast online
Podcast: “Episode 218: Chronicle Security (with Ansh Patniak)”
Down the Security Rabbithole (DtSR) online
Podcast: “Episode 388: The SIEM is Dead, Long May It Live”
2012–2019 GartnerResearch VP and Distinguished Analyst
2019 3 talks, 1 podcast
Gartner Security & Risk Management Summit 2019, National Harbor, MD Details unconfirmed
Presentation: “Outlook for Security Operations”
Gartner Security & Risk Management Summit 2019, National Harbor, MD Details unconfirmed
Presentation: “Further Evolution of Modern SOC: Automation, Delegation, Analytics”
2018 6 talks, 1 podcast
Gartner Security & Risk Management Summit Brazil 2018, São Paulo, Brazil
Presentation: “Security operations (with Augusto Barros)”
Gartner Security & Risk Management Summit 2018, National Harbor, MD
Presentation: “How to Hunt for Security Threats”
Gartner Security & Risk Management Summit 2018, National Harbor, MD
Presentation: “How to Use the New Threat Simulation Tools (with Augusto Barros)”
Gartner Security & Risk Management Summit 2018, National Harbor, MD
Presentation: “The State of Security Operations, Monitoring and Analytics, 2018 (with Toby Bussa)”
RSA Conference 2018, San Francisco, CA
Presentation: “Threat Hunting Strategy: How to Catch Bears and Pandas”
Gartner webinar online
Webinar: “Prepare Your Security Operations for Orchestration and Automation Tools”
2017 7 talks, 2 podcasts
Gartner webinar online
Webinar: “How to Test, Deploy and Operationalize User and Entity Behavior Analytics (UEBA) Tools”
Gartner Security & Risk Management Summit 2017, National Harbor, MD
Presentation: “How to Deploy and Operationalize User and Entity Behavior Analytics (UEBA) Tools”
Gartner Security & Risk Management Summit 2017, National Harbor, MD
Presentation: “How to Build and Operate a Modern SOC”
Gartner Security & Risk Management Summit 2017, National Harbor, MD
Presentation: “How to Build Your Own Security Analytics Capability”
Gartner Security & Risk Management Summit 2017, National Harbor, MD
Workshop: “Developing, Implementing and Optimizing Security Monitoring Use Cases (with Augusto Barros)”
Gartner Security & Risk Management Summit 2017, National Harbor, MD
Roundtable: “Lessons Learned From Security Analytics Adventures”
RSA Conference 2017, San Francisco, CA
Presentation: “Sizzle or Fizzle: Is Threat Intelligence Really Worth My Time?”
Security Current online
Podcast: “SC 117: New CISOs at RSA, New Technologies and Box Fatigue (with David Cass)”
Security Current online
Podcast: “SC 115: Security Monitoring, SIEM and UBA (with David Cass)”
2016 3 talks
RSA Conference 2016, San Francisco, CA
Panel: “Endpoint detection, prevention and response strategy”
2015 8 talks, 5 podcasts
Gartner Security & Risk Management Summit 2015, Sydney, Australia
Presentation: “Incident response: the dos and don’ts”
Gartner Catalyst Conference 2015, San Diego, CA
Presentation: “Tooling Up for Incident Response With Network Forensics and Endpoint Visibility”
Gartner Catalyst Conference 2015, San Diego, CA
Presentation: “Demystifying Security Analytics: Data, Methods, Use Cases”
Security Current online
Podcast: “SC 69: On the Operational Effectiveness of Security Analytics”
Gartner Security & Risk Management Summit 2015, National Harbor, MD
Presentation: “SIEM Architecture and Operational Processes”
Gartner Security & Risk Management Summit 2015, National Harbor, MD
Panel: “Insider Threat: NOT an IT Problem? (with Erik Heidt; moderator Patrick Hevesi)”
Gartner Security & Risk Management Summit 2015, National Harbor, MD
Presentation: “How to Use Attack Chain Model to Plan Security Monitoring (with Ramon Krikken)”
Gartner Security & Risk Management Summit 2015, National Harbor, MD
Presentation: “Security Incident Response in the Age of the APT”
Gartner Security & Risk Management Summit 2015, National Harbor, MD
Presentation: “How to Collect, Refine and Use Threat Intelligence”
Security Current online
Podcast: “SC 47: Cloud Security Monitoring, Cloud Access Security Brokers and MSSPs”
2014 9 talks, 5 podcasts
Security Current online
Podcast: “SC 24: Do Honeypots Still Have Value in Network Security?”
Gartner Catalyst Conference 2014, San Diego, CA
Roundtable: “Whiteboarding Roundtable: Building DDoS Defense Architecture”
Gartner Catalyst Conference 2014, San Diego, CA
Presentation: “Tooling Up for Incident Response With Network Forensics and Endpoint Visibility”
Gartner Catalyst Conference 2014, San Diego, CA
Roundtable: “How to Design Security Monitoring”
Gartner Catalyst Conference 2014, San Diego, CA
Presentation: “Threat Assessment in the Age of APT”
Gartner Security & Risk Management Summit 2014, National Harbor, MD
Presentation: “Security Incident Response in the Age of the APT”
Gartner Security & Risk Management Summit 2014, National Harbor, MD
Presentation: “SIEM Architecture and Operational Processes”
Gartner Security & Risk Management Summit 2014, National Harbor, MD
Presentation: “Network and Endpoint Visibility for Incident Response”
Gartner Security & Risk Management Summit 2014, National Harbor, MD
Roundtable: “Security Threat Intelligence Services: the What, the Who, the Why and the How”
ISMG (BankInfoSecurity) webinar online
Webinar: “Payment Card Fraud, EMV Adoption & the Merchant Challenge”
2013 12 talks
Gartner Catalyst Conference 2013, San Diego, CA
Presentation: “Stop That Leak! Finding, Watching and Controlling Where Your Data Goes”
Gartner Catalyst Conference 2013, San Diego, CA
Roundtable: “How to Monitor the Security of Your Cloud Assets”
Gartner Catalyst Conference 2013, San Diego, CA
Presentation: “Top 7 Most Effective Incident Detection and Response Practices and Tools”
Gartner Catalyst Conference 2013, San Diego, CA
Presentation: “To the Point: Deception-Based Security is Baaaaack!”
Gartner Security & Risk Management Summit 2013, National Harbor, MD
Presentation: “DLP Architecture and Operational Processes”
Gartner Security & Risk Management Summit 2013, National Harbor, MD
Panel: “Information Security: Process or Technology — Which Way Do We Go? (with Jeffrey Wheatman, Jay Heiser, Neil MacDonald and Tom Scholtz)”
Gartner Security & Risk Management Summit 2013, National Harbor, MD
Presentation: “To the Point: Playing Chess With APTs (with Ramon Krikken)”
Gartner Security & Risk Management Summit 2013, National Harbor, MD
Presentation: “Security Monitoring of Public Cloud”
Gartner Security & Risk Management Summit 2013, National Harbor, MD
Tutorial: “SIEM Architecture and Operational Processes”
2012 2 talks
Metricon 7 (with USENIX Security 2012), Bellevue, WA
Workshop chair: “Workshop introduction and closing; security metrics panels”
2010–2011 Security Warrior ConsultingGartner from August 2011
2011 9 talks
Cloud Security Alliance class (beta), Sunnyvale, CA
Training: “PCI DSS in Cloud Computing Environments”
Secure360 2011, Minneapolis, MN
Presentation: “On Using SIEM”
PCI DSS in Education Workshop, Indianapolis, IN
Presentation: “PCI and Logging: What You Need To Know”
BrightTALK webcast online
Webinar: “Using Logs for Breach Investigations and Incident Response”
BankInfoSecurity webcast online
Webinar: “PCI Compliance: Tips, Tricks & Emerging Technologies”
2010 22 talks, 6 podcasts
Focus.com webcast (with Tripwire) online
Webinar: “Achieve PCI Compliance and Ensure Security in a Data Deluge”
Intel and NRF webcast online
Webinar: “Address Network Security & Dramatically Reduce PCI DSS Scope with Gateway Tokenization”
SANS SEC434 (beta), Los Angeles 2010, Los Angeles, CA
Training: “SANS SEC434: Log Management In-Depth (1.5 days)”
SANS@Night, SANS San Francisco 2010, San Francisco, CA
Presentation: “Got SIEM? Now What? Making SIEM Work for You!”
DEF CON 18, Las Vegas, NV
Panel: “PCI, Compromising Controls and Compromising Security (with Josh Corman, Jack Daniel, Dave Shackleford, Martin McKeay, Alex Hutton and James Arlen)”
Honeynet Project Annual Workshop, Mexico City, Mexico
Training: “Something about Logs”
SOURCE Boston 2010, Boston, MA
Presentation: “PCI DSS Done Right and Wrong (with Branden Williams)”
Focus.com webcast online
Webinar: “Zero Day Response: Strategies for the Newest Innovation in Corporate Defense”
IANS Interactive Phone Conference online
Panel (moderator): “Navigating the Data Stream without Boiling the Ocean: Case Studies in Effective Log Management”
RSA Conference 2010 bookstore, San Francisco, CA
Book signing: “PCI Compliance book signing with Branden Williams”
SC Magazine webcast online
Panel: “Content-Aware SIEM Defined”
CSO Security Insights podcast online
Podcast: “The Great PCI Security Debate of 2010 (with Martin McKeay, Bill Brenner, Josh Corman, Jack Daniel, Ben Rothke and others)”
2009 Qualys, then Security Warrior Consulting
2009 14 talks, 3 podcasts
SANS Cyber Defense Initiative 2009, Washington, DC
Training: “SANS SEC434: Log Management In-Depth”
State of California (private class), Sacramento, CA
Training: “SANS SEC434: Log Management In-Depth”
ISC2 / BrightTALK “PCI 360: Multiple Perspectives” online
Webinar: “PCI DSS Myths 2009: Fiction and Reality”
BrightTALK PCI Summit online
Webinar: “PCI DSS as Framework for Your Security Program: Good or Bad?”
5th Annual IT Security Automation Conference (NIST), Baltimore, MD
Presentation: “LogChaos: Challenges and Opportunities of Security Log Standardization”
CSI 2009 Annual Conference, Baltimore, MD Cancelled
Presentation: “PCI DSS in Cold Numbers”
CSI 2009 Annual Conference, Baltimore, MD
Presentation: “PCI DSS as a Security Framework: Good, Bad or Maybe Ugly?”
SeaCure.IT, Milan, Italy Cancelled
Presentation: “TBA”
IT Knowledge Exchange (TechTarget) online
Podcast: “Anton Chuvakin on PCI DSS compliance, security and nonprofits”
WITS Symposium, Napa, CA
Presentation: “Consumer Compliance: The Next Generation of Issues”
Qualys Technology Briefing webinar online
Webinar: “How to Prioritize PCI DSS Compliance (with Terry Ramos)”
RSA Conference 2009, San Francisco, CA
Panel: “Common Event and Log Standards: Leveling IT’s Tower of Babel (HOST-304)”
Imperva podcast online
Podcast: “Interview on PCI DSS, vulnerability management and application security”
“PCI Dinner” panel, Chicago, IL
Panel: “PCI DSS, with Branden Williams, Davi Ottenheimer and William Cook”
2008 LogLogicChief Logging Evangelist; Qualys from October 2008
2008 34 talks, 4 podcasts
DeepSec 2008, Vienna, Austria
Presentation: “Making Logs Sexy Again: Can We Finally Lose The Regexes?”
SANS Network Security 2008 (Lunch & Learn), Las Vegas, NV
Presentation: “Worst Practices” of Log Management
GOVCERT.NL Symposium 2008, Rotterdam, The Netherlands
Presentation: “Logging for Incident Response and Forensics: Key Issues”
SecureWorld Bay Area, Santa Clara, CA
Panel: “PCI Compliance Panel”
SANS webcast online
Webinar: “Security Is Not Virtual: Auditing and Logging Considerations to Ensure Compliance and Protect Virtual Server Environments”
ISC2 e-Symposium: Logging and Reporting online
Webinar: “Logs As a Vehicle for Accountability in IT and Beyond”
Burton Group Catalyst Conference, San Diego, CA
Working group: “Log and Event Standard working group”
FIRST 2008 Conference, Vancouver, Canada
Tutorial: “System, Network and Security Log Analysis for Incident Response”
SearchSecurity / Bitpipe podcast online
Podcast: “Eliminating the Headaches of Log Management (Parts 1 and 2)”
SANS webcast online
Webinar: “Fourth Annual SANS Log Management Survey”
4th Annual GFIRST National Conference, Orlando, FL
Presentation: “Using Logs for Incident Response and Forensics”
WhiteHatWorld webcast online
Webinar: “Worst Practices” of Log Management
Secure360 Conference, Minneapolis, MN
Presentation: “Application Logging “Worst Practices””
OWASP Connecticut Chapter, Hartford, CT
Presentation: “Application Logging “Worst Practices””
Idaho ISSA Chapter, Idaho Falls, ID
Presentation: “Log Forensics”
Idaho ISSA Chapter, Idaho Falls, ID
Presentation: “Seven Mistakes of Security Log Management”
Next Generation Security, Logging and Incident Response workshop, Singapore
Workshop: “Next Generation Security, Logging and Incident Response”
MISTI Log Management Summit, Orlando, FL
Presentation: “Logs for Incident Response”
MISTI Log Management Summit, Orlando, FL
Presentation: “Emerging Log Standards”
MISTI InfoSec World 2008, Orlando, FL
Presentation: “The Five Mistakes of Security and Compliance Log Analysis”
WhiteHatWorld webcast online
Panel: “Log Management Thought Leadership Roundtable”
Honeynet workshop for a UK intelligence agency, Cheltenham, UK
Presentation: “Honeynets vs Insiders”
Computer Forensics Show, Washington, DC
Presentation: “Log Forensics”
Technosium 2008 Conference, Santa Clara, CA
Presentation: “Log Data: The Weapon Of Choice to Thwart Insider Threats”
OpenGroup Enterprise IT Architecture Conference 2008, San Francisco, CA
Presentation: “CEE Logging Standard: Present and Future”
DoD Cyber Crime Conference 2008, St Louis, MO
Presentation: “Seven Mistakes of Security Log Analysis”
SANS Security 2008 (Lunch & Learn), New Orleans, LA
Presentation: “Worst Practices” of Log Management
2006–2007 LogLogicChief Logging Evangelist
2007 24 talks
SANS Cyber Defense Initiative 2007, Washington, DC
Presentation: “Log Management “Worst Practices””
DeVenCI CIT Workshop on Network Survivability, Institute for Defense Analyses
Presentation: “LogLogic for Log Management”
SANS Network Security 2007, Las Vegas, NV
Presentation: “Log Management “Worst Practices””
MISTI IT Security World 2007, San Francisco, CA
Tutorial: “Log Management From A to Z”
SecureWorld, San Francisco, CA
Panel: “SOX and Security Panel”
LogLogic webcast online
Webinar: “From FISMA to NIST: Compliance and Log Management”
LogLogic webcast online
Webinar: “Web Proxy Log Analysis and Log Management”
ISSA Orange County Chapter, Los Angeles area, CA
Presentation: “Six Mistakes of Log Management”
SANSFire 2007, Washington, DC
Presentation: “Choosing Your Log Management Approach”
2007 G-FIRST National Conference, Orlando, FL
Tutorial: “Six Mistakes of Log Management”
FIRST 2007 Annual Conference, Seville, Spain
Tutorial: “Logs for Incident Response”
CSI NetSec, Scottsdale, AZ
Presentation: “Six Mistakes of Log Management”
Online webinar roundtable online
Panel: “Log Management Trends and Best Practices”
Interop Moscow 2007, Moscow, Russia
Presentation: “Trends in IT Security: 2007 and Beyond”
CONFidence 2007 Security Conference, Krakow, Poland
Presentation: “System, Network and Security Log Forensics”
CONFidence 2007 Security Conference, Krakow, Poland
Tutorial: “Logs for Incident Response”
Computer and Enterprise Investigations Conference (CEIC) 2007, Las Vegas, NV
Presentation: “Integrating Log Analysis into Your Incident Response Practice”
SANS Log Management Summit 2007, San Jose, CA
Presentation: “Selecting A Log Management Approach”
SANS Log Management Summit 2007, San Jose, CA
Panel: “Implementing Log Management”
SANS 2007 Security Conference, San Diego, CA
Presentation: “Selecting A Log Management Approach”
SANS 2007 Security Conference, San Diego, CA
Presentation: “NIST Log Management Guide 800-92 in the Real World”
IT Underground 2007, Prague, Czech Republic
Presentation: “Log Mining and Analysis”
DoD Cyber Crime Conference 2007, St Louis, MO
Presentation: “Five Mistakes of Log Analysis”
ISACA Silicon Valley 2007 Winter Conference, Santa Clara, CA
Panel: “Cyber Crime: Security, Strategy & Solutions”
2006 16 talks
SearchSecurity Webcast online
Webinar: “Steps for Continuous Compliance - Automating Your PCI Compliance”
SANS New Orleans 2006, New Orleans, LA
Presentation: “Selecting A Log Management Approach”
SC Magazine Webcast online
Webinar: “Integrating Log Analysis and Forensics to Deliver Superior Incident Response: Answering Compliance & Information Protection Mandates In 2007”
CSI 33rd Annual Conference, Orlando, FL
Presentation: “Log Mining for Security”
Group 451 IT Innovation Summit, Boston, MA
Panel: “Security Sector”
SANS Network Security 2006, Washington, DC
Presentation: “Choosing a Log Management Approach”
Log Management Insights online
Webinar: “New Thinking on Compliance”
SANS Log Management Summit, Washington, DC
Panel: “Log management panel”
SANS Log Management Summit, Washington, DC
Presentation: “Choosing a Log Management Approach”
CSI NetSec 2006, Scottsdale, AZ
Presentation: “Log Mining for Security”
United States Military Academy at West Point, West Point, NY
Lecture: “Logs for Information Assurance”
United States Military Academy at West Point, West Point, NY
Lecture: “Log Forensics”
NSI Partner Seminar, Simi Valley, CA
Presentation: “Log Management and Intelligence”
netForensics Federal User Group 2006, Ft Meade, MD
Presentation: “Advanced SIM Use”
SANS 2006, Orlando, FL
Presentation: “Baselining Logs and Alerts”
Security team of a major bank, Texas
Presentation: “Log Mining and Baselining Analytics”
2002–2005 netForensicsSecurity Strategist; SIM, correlation, honeypots and the Honeynet Project
2005 8 talks
Vigilar security metrics webcast online
Webinar: “Optimizing Security Operations Performance: You Can’t Manage What You Don’t Measure”
USDA IT Summit
Presentation: “Using SIM for Getting Security Organized (Finally!)”
MISTI Security and Audit 2005, Orlando, FL
Presentation: “What Every Organization Should Monitor and Log”
ISSA New York chapter, New York, NY
Presentation: “Vulnerability Management Challenges: SIM to the Rescue”
netForensics FUG III, Washington, DC
Presentation: “netForensics nFX OSP Advanced Use Best Practices”
SANS Network Security 2005
Training: “TCP/IP for Intrusion Detection, Day 1”
LinuxWorld 2005 NY, New York, NY
Presentation: “Intrusion Discovery with Linux”
netForensics FUG II, Orlando, FL
Presentation: “nFX OSP Advanced Use Best Practices”
2004 9 talks
Infosecurity 2004, New York, NY
Presentation: “Log Analysis for Security”
ISSA New York chapter, New York, NY
Presentation: “netForensics SIM: Five Years and Beyond - Evolution of Security Information Management”
SANS Network Security 2004
Presentation: “Simple Log Mining”
InfoSecurity Canada
Presentation: “Intrusion Prevention via Log Analysis”
ISSA Annual Conference, New York, NY
Presentation: “Threat Intelligence”
InfraGard, New York chapter, New York, NY
Presentation: “Security Warrior: Linux Security”
SearchEnterpriseLinux webcast online
Webinar: “Linux Security”
InfraGard, New Jersey chapter, Edison, NJ
Presentation: “Security Warrior: How to tell your Linux System is Hacked”
2003 5 talks
Securing Government IT in the Age of Homeland Security, Washington, DC
Presentation: “Honeypots: Implementing, Deploying and Maintaining a Honeypot”
ISSA New York chapter, New York, NY
Presentation: “Incident Response with netForensics”
“Prevent Intrusions” with Stephen Northcutt (SANS), Las Vegas, NV
Presentation: “Centralizing Centralization”
SANS Fire 2003, Washington, DC
Presentation: “UNIX Rootkits: Detailed Analysis”
InfraGard, New Jersey chapter, Princeton, NJ
Presentation: “Event Correlation in Security Information Management”
2002 4 talks
ITRA Honeypots Conference, Las Vegas, NV
Presentation: “Implementing the Honeypot”
InfraGard, New Jersey chapter, Edison, NJ
Presentation: “FTP Attack Case Study”
???? Undated
Things I know happened, but not exactly when.
Google Cloud Security webcast (BrightTALK) online
Webinar: “Agentic AI in Security Operations: What New Data Shows About Adoption, Use Cases & the Future of the SOC (with Dave Gruber, Omdia)”
Gartner webinar online
Webinar: “The Future of Security Monitoring and SIEM”
2021–2026 Also
From 2021 until I left Google in 2026 I co-hosted the Cloud Security Podcast by Google. Those episodes are not listed here; the full archive is on the podcast site.