The Programming for the CSIRTs Forum and MISP 2026 Workshop has been released.

The 14th Brazilian CSIRTs Forum and 7th MISP Workshop constitute a three-day technical summit in São Paulo focused on cybersecurity incident response and threat intelligence. Scheduled for late July 2026, the event brings together a diverse array of public and private sector entities—ranging from federal police and electoral courts to financial institutions and healthcare providers—to share operational experiences and technical methodologies.
The agenda emphasizes a shift from traditional vulnerability patching toward risk-based management, the integration of Artificial Intelligence in security operations, and the combatting of sophisticated threats like ransomware and "BadBox 2.0" malware. A significant portion of the programming is dedicated to the practical application of the MISP platform for intelligence sharing and the use of open-source tools for attack surface visibility. While the event is free to attend, it requires pre-registration through the NIC.br portal. The proceedings incorporate TLP (Traffic Light Protocol) markings to manage the sensitivity of shared information.

* The 14th Brazilian CSIRTs Forum and 7th MISP Workshop take place from July 28 to July 30, 2026.
* The events are located at the Amcham Business Center, Rua da Paz, 1431, Chácara Santo Antônio, São Paulo/SP.
* Registration is free and required through the NIC.br Courses and Events Portal.
* Registration closed on July 20th.
* On-site parking is available at a single day rate of R$40.00.
* The 14th Brazilian CSIRTs Forum occurs on July 28 and 29, 2026.
* The 7th MISP Workshop occurs on July 30, 2026.
* Speakers represent organizations including the Federal Police, Apura Cybersecurity Intelligence, FEBRABAN, Amazon Bank, Opice Blum, Einstein Hospital Israelita, TCU, Globo, Bitcoin Market, CERT.br/NIC.br, Anatel, CTIR Gov, TRE-TO, RNP, CEPESC, Telefônica Brasil S.A., Soow Sigma, PCDF, and CSIRT Núclea.
* Presentations cover topics including malware analysis, data leak reuse, ransomware post-mortems, NetFlow telemetry, privileged account management, CTI lifecycles, AI adoption in security, and vulnerability management.
* The MISP Workshop includes a practical tutorial by the MISP Development Team/CIRCL.

This program functions as a collaborative knowledge-sharing ecosystem for the Brazilian cybersecurity community. By integrating academic, governmental, and corporate perspectives, it treats cybersecurity not as a static set of tools, but as a continuous "arms race" requiring adaptive defense. The strengths lie in the high degree of operational transparency, where practitioners share specific failures (post-mortems) to harden the collective defense.
The underlying paradigm is one of "Collective Resilience." There is an unstated assumption that the volume of threats—specifically the industrialization of cybercrime via Initial Access Brokers and AI—has surpassed the capacity of any single organization to defend itself in isolation. Consequently, the focus shifts toward interoperability (MISP) and telemetry (NetFlow) to create a shared situational awareness.
The second-order consequence of this trend is the increasing professionalization of the "Blue Team." As adversaries pivot from hacking systems to exploiting valid credentials and administrative processes, the boundary between technical security and organizational governance blurs. Human agency is challenged here; the "patient zero" is increasingly a personal device or a legitimate administrative flow, moving the battlefield into the private lives and routine habits of employees.
Bridge Questions:
1. How does the reliance on shared intelligence (MISP) impact the privacy and sovereignty of the participating institutions?
2. If attackers are increasingly exploiting "legitimate processes" rather than technical bugs, can technical tools alone ever provide sufficient security?
Counterstrike Scan: A coordinated influence campaign would use this narrative to create a state of "perpetual crisis" to justify invasive monitoring or the procurement of specific expensive security suites. This content does not match that pattern; it emphasizes open-source tools, free registration, and a diverse, multi-sectoral exchange of actual operational data.
Patterns detected: none