[NA] Inside the First 60 Minutes of an Attack

The first hour of an attack can determine whether suspicious activity becomes a contained event or a major incident. Detection is only the beginning. Security teams must quickly understand what is happening, which assets and identities are at risk, how the attacker could progress and what action must be taken.

In this technical session, Rapid7 experts will reconstruct the first 60 minutes of a realistic attack - from the initial signal through investigation, containment and customer communication. We’ll examine how an exposure-aware MDR team validates attacker behavior, enriches it with asset, identity and vulnerability context, maps the potential blast radius and determines when to act.