Event owner lens
Use this record to benchmark whether a comparable event makes the work after the room visible. The score is 39/100, so the next move is to benchmark the weakest pillars before repeating the format.
broadcast-heavy conference agenda analysis
10 Sep Blue Team Con 2026 Conference
This broadcast-heavy conference in Technology / AI / Startup shows 57 visible agenda rows from blueteamcon.com and scores 39/100: a thin but inspectable design signal. The clearest public signals sit in Learning Transfer and Participation Architecture; the main limits are Follow Through and Network Design. Visible mechanisms include Participant work, Network design, and Learning transfer. The public record does not show follow-up or tracking, so the score should be read as design intent rather than durable impact. A practical reading: For a reader, this is a comparison record more than a model to copy: it reads as a broadcast-heavy conference, with the strongest visible signal in learning transfer and participation architecture and the biggest open question around follow through and network design. The practical test is whether the published agenda connects the room to post-event continuation and evidence. This page is an original public-evidence analysis, not a copy of the source agenda or an endorsement of the event. The score places the visible agenda in the thin outcome architecture band. The strongest visible pillars are Learning Transfer, Participation Architecture, and Future-of-Work Fit; the thinnest visible pillars are Follow Through, Network Design, and Personalization. Visible mechanisms include Participant work, Network design, and Learning transfer. The extracted agenda preview includes 113 visible rows. The most common formats are Presentation, Unknown, and Training; the most common inferred purposes are Knowledge Transfer, Unknown, and Skill Building.
Eight-pillar fingerprint
Hover any pillar to see what it measures and, where it scored low, what the agenda is missing.
Participation Architecture?54
Participation Architecture - 54/100. Participant work, contribution, interaction, and alternatives to passive broadcast.
Follow Through?5
Follow Through - 5/100. Owners, dates, commitments, progress checks, and accountability after the room.Missing: Add named owners, dates, implementation checkpoints, and a visible post-event continuation path.
Problem Specificity?34
Problem Specificity - 34/100. A clear costly problem, objective, decision, or performance target.
Personalization?31
Personalization - 31/100. Role, path, goal, preparation, or connection tailoring for participants.Missing: Create role-based paths, prepared questions, tailored breakouts, or participant-specific next steps.
Network Design?30
Network Design - 30/100. Structured weak ties, bridge-building, mixers, and relationship persistence.Missing: Replace generic networking blocks with designed introductions, ask-offer exchanges, peer groups, or bridge-building rituals.
Learning Transfer?63
Learning Transfer - 63/100. Applied practice, feedback, workplace use, refreshers, and 30-90 day transfer.
Evidence Maturity?45
Evidence Maturity - 45/100. Baseline, comparison, follow-up, isolation, and attribution confidence.
Future-of-Work Fit?52
Future-of-Work Fit - 52/100. Value against time, hybrid reality, accessibility, AI, and meeting load.
Fix the gaps
Exercises matched to this agenda's weakest pillars, from the exercise library. Check each run sheet for its source and intended setting.
Follow Through (5/100)
Exercises that strengthen it: The Comfort Confession · 15% Solutions · Network Patches
Network Design (30/100)
Exercises that strengthen it: Izzat You? · Levitation · Sticks
Personalization (31/100)
Exercises that strengthen it: Journey Mapping · Paradigm Shift Clock · Photo Storytelling
Agenda Preview
The actual agenda we captured. Every block is classified by format and purpose. Open any block to see how we read it; the colored edge shows whether it is participant work, broadcast, logistics, or a showcase.
Room vs wrapper
19 percent of the 113 classified blocks put participants to work; the rest broadcast, show, or handle logistics. That mix is what drives the participation score.
Participant workBroadcastShowcaseLogistics
all event2026 Talks &Trainings are now LIVE! Tickets are on sale now!TrainingSkill building+
Format · Participant workTrainingGuided skill building where participants practice. Counts as participant work and learning transfer.
Evidence basisParticipant work is implied by the formatInferred from format
all eventTrainingsTrainingSkill building+
Format · Participant workTrainingGuided skill building where participants practice. Counts as participant work and learning transfer.
Evidence basisParticipant work is implied by the formatInferred from format
all event2026 Training SessionsTrainingSkill building+
Format · Participant workTrainingGuided skill building where participants practice. Counts as participant work and learning transfer.
Evidence basisParticipant work is implied by the formatInferred from format
all eventKeynote By Jake WilliamsKeynoteExpert framing+
Format · BroadcastKeynoteA featured talk from the stage. Builds awareness and energy, produces no participant output on its own.
Evidence basisNo participant output visible from this rowRead from source, no work signal
all eventTrainingTrainingSkill building+
Format · Participant workTrainingGuided skill building where participants practice. Counts as participant work and learning transfer.
Evidence basisParticipant work is implied by the formatInferred from format
all event2025 Training SessionsTrainingSkill building+
Format · Participant workTrainingGuided skill building where participants practice. Counts as participant work and learning transfer.
Evidence basisParticipant work is implied by the formatInferred from format
all eventKeynote by Aeva BlackKeynoteExpert framing+
Format · BroadcastKeynoteA featured talk from the stage. Builds awareness and energy, produces no participant output on its own.
Evidence basisNo participant output visible from this rowRead from source, no work signal
all event2024 Training SessionsTrainingSkill building+
Format · Participant workTrainingGuided skill building where participants practice. Counts as participant work and learning transfer.
Evidence basisParticipant work is implied by the formatInferred from format
all event2023 Training SessionsTrainingSkill building+
Format · Participant workTrainingGuided skill building where participants practice. Counts as participant work and learning transfer.
Evidence basisParticipant work is implied by the formatInferred from format
all eventKeynote by Lesley CarhartKeynoteExpert framing+
Format · BroadcastKeynoteA featured talk from the stage. Builds awareness and energy, produces no participant output on its own.
Evidence basisNo participant output visible from this rowRead from source, no work signal
all eventKeynote by Tazin KhanKeynoteExpert framing+
Format · BroadcastKeynoteA featured talk from the stage. Builds awareness and energy, produces no participant output on its own.
Evidence basisNo participant output visible from this rowRead from source, no work signal
10:30am to 5:00pmSaturday from , Sunday fromPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
all eventResume & Interview WorkshopWorkshopParticipant work+
Format · Participant workWorkshopParticipants work on a problem and produce something. The strongest signal of participation architecture.
Evidence basisParticipant work is implied by the formatInferred from format
11:00am to 5:30pmSaturday fromPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
11:00amSaturday at to Sunday at (Yes, all night)PresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
10:00am to 12:00pmSunday from .PresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
10:30amSaturday at toPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
1:00pmSunday at (Yes, all night).PresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
6:00pm to 9:00pmRegistrationRegistrationLogistics+
Format · LogisticsRegistrationCheck-in and logistics, not agenda content.
Evidence basisOutcome inferred from formatInferred from format
11:00am to 3:00pmTalk Track 1PresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
9:00am to 9:30amOpening Ceremonies with Blue Team Con Advisory BoardPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
9:35am to 10:30amKeynote: “Into The Blue” with Sean MetcalfKeynoteExpert framing+
Format · BroadcastKeynoteA featured talk from the stage. Builds awareness and energy, produces no participant output on its own.
Evidence basisNo participant output visible from this rowRead from source, no work signal
11:00am to 11:50am“Betting Before the Breach: Applying Poker Theory to Cybersecurity Spending” with Karen WalshPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
12:00pm to 12:50pm“Panel Discussion - Security Strategy for Small-Medium Business” with Russell Mosley, Amanda Berlin, Jim Nitterauer, and Heather SmithPanelDiscussion+
Format · BroadcastPanelExperts discuss while the audience watches. Surfaces perspective but rarely creates participant work.
Evidence basisNo participant output visible from this rowRead from source, no work signal
1:00pm to 1:50pm“Incident Communications 101 - Breaking the Bad News” with Dr. Catherine J. UllmanPresentationPacing+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
2:00pm to 2:50pm“Shining a Light on Overprivileged Modern Applications - What are they, how to find them, what to do about it” with Mark Morowczynski and Bailey BercikPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
4:00pm to 4:50pm“Compliance and Regulation: The Next Great Security Threat?” with John OrleansPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
5:00pm to 5:50pm“Stop talking nerdy to me: translating the value proposition of the blue team to the C-Suite” with Jake WilliamsPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
10:40am to 11:10am“Realigning From Chaotic Evil” with Joseph SchottmanPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
11:20am to 11:50am[“Shifting Security PEOPLE Left: A successful experiment embedding a security engineer in Sales to build empathy, trust, and [more] scalable RFI and incident response processes” with Jennifer...WorkshopParticipant work+
Format · Participant workWorkshopParticipants work on a problem and produce something. The strongest signal of participation architecture.
Evidence basisParticipant work is implied by the formatInferred from format
12:10pm to 12:40pm“Eliminating Alert Fatigue: Reducing False Positives Through Better Engineering” with Dana BarilPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
1:00pm to 1:30pm“Office365 Logging - Turning Attacker TTP’s into High-Fidelity Alerts” with Ryan ClarkPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
1:40pm to 2:10pm“Analyzing Application Risk” with Chelsea TroyPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
2:20pm to 2:50pm“When Dinosaurs Ruled the Blue Team: Quickly Retrieving Triage Images Via EDR” with Dan BankerPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
3:40pm to 4:10pm“Building an AWS Onramp: Maintaining Guardrails for Self-Service AWS” with Margaret ValtierraPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
4:20pm to 4:50pm“Your Tax Dollars hard at work: how 800-53 and STIGS help in non-government space” with Gary RimarPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
5:00pm to 5:30pm“DFIR with Dinosaurs: Unearthing Artifacts and Host Hunting with Velociraptor” with Wes LambertPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
7:00pm to 9:00pmTalk Track 2 (Gold Room)PresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
9:00pm to 1:00amTalk Track 1 (International Ballroom)PresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
8:00am to 1:00pmRegistration and SwagRegistrationLogistics+
Format · LogisticsRegistrationCheck-in and logistics, not agenda content.
Evidence basisOutcome inferred from formatInferred from format
10:00am to 10:50am“How to successfully implement a Global Threat Hunting Program” with Alberto GarciaPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
11:00am to 11:50am“Star Wars: How an ineffective Data Governance Program destroyed the Galactic Empire” with Micah BrownPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
12:00pm to 12:50pm“The TIP of the Stinger: Efficiently Using Threat Intelligence With TheHive” with Matthew GraciePresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
1:00pm to 1:50pm“Oh FFS! : Practical Password Auditing for Windows Networks” with AJ Van BeestPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
2:00pm to 2:50pm“Automating Vulnerability Management from Scratch” with Adam SchaalPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
3:30pm to 4:30pmClosing Ceremonies with Blue Team Con Advisory BoardClosingOrientation+
Format · BroadcastClosingFormat not classified from the source; treated as a broadcast block by default.
Evidence basisNo participant output visible from this rowRead from source, no work signal
10:00am to 10:30am“Real World advice to stay sane while building a Security program” with Lauren RogersPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
10:40am to 11:10am“In the event of my demise, digital estate planning for the whole family” with Carla Raisler and Matt SpeerPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
11:20am to 11:50am“PhishCatch: Detecting Password Reuse from the Inside Out” with Tyler Butler and Eason GoodalePresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
12:10pm to 12:40am“Infosectual disfunction- how soft skills are helping bridge the gap between advocacy and infosec” with Katelyn BowdenPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
1:00pm to 1:30pm“How to Persuade, Change, and Influence to deliver the Blue Team mission” with Blake ReganPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
1:40pm to 2:10pm“Writing Cybersecurity Policies: You Don’t Have to be Michael Jordan” with Frank McGovernPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
2:20pm to 2:50pm“Lessons learned from building your own Vulnerability Management Platform” with Lee BergPresentationKnowledge transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisNo participant output visible from this rowRead from source, no work signal
all eventBlue Team Con 2026 Talks and Trainings Are Now Listed June 15, 2026TrainingSkill building+
Format · Participant workTrainingGuided skill building where participants practice. Counts as participant work and learning transfer.
Evidence basisParticipant work is implied by the formatInferred from format
all eventBlue Team Con 2026 Call for Trainings March 9, 2026TrainingSkill building+
Format · Participant workTrainingGuided skill building where participants practice. Counts as participant work and learning transfer.
Evidence basisParticipant work is implied by the formatInferred from format
all eventBlue Team Con Announces Keynote, Talks and Training Sessions for 2025 Conference July 29, 2025KeynoteExpert framing+
Format · BroadcastKeynoteA featured talk from the stage. Builds awareness and energy, produces no participant output on its own.
Evidence basisNo participant output visible from this rowRead from source, no work signal
all event2026 Talks &Trainings are now LIVE! Tickets are on sale now!TrainingSkill Building+
Format · Participant workTrainingGuided skill building where participants practice. Counts as participant work and learning transfer.
Evidence basisMediumRead from source
all eventTrainingsTrainingSkill Building+
Format · Participant workTrainingGuided skill building where participants practice. Counts as participant work and learning transfer.
Evidence basisMediumRead from source
all event2026 Training SessionsTrainingSkill Building+
Format · Participant workTrainingGuided skill building where participants practice. Counts as participant work and learning transfer.
Evidence basisMediumRead from source
all eventKeynote By Jake WilliamsKeynoteThought Leadership+
Format · BroadcastKeynoteA featured talk from the stage. Builds awareness and energy, produces no participant output on its own.
Evidence basisMediumRead from source
all eventTrainingTrainingSkill Building+
Format · Participant workTrainingGuided skill building where participants practice. Counts as participant work and learning transfer.
Evidence basisMediumRead from source
all event2025 Training SessionsTrainingSkill Building+
Format · Participant workTrainingGuided skill building where participants practice. Counts as participant work and learning transfer.
Evidence basisMediumRead from source
all eventTrainersUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisLowRead from source
all eventKeynote by Aeva BlackKeynoteThought Leadership+
Format · BroadcastKeynoteA featured talk from the stage. Builds awareness and energy, produces no participant output on its own.
Evidence basisMediumRead from source
all event2024 Training SessionsTrainingSkill Building+
Format · Participant workTrainingGuided skill building where participants practice. Counts as participant work and learning transfer.
Evidence basisMediumRead from source
all event2023 Training SessionsTrainingSkill Building+
Format · Participant workTrainingGuided skill building where participants practice. Counts as participant work and learning transfer.
Evidence basisMediumRead from source
all eventKeynote by Lesley CarhartKeynoteThought Leadership+
Format · BroadcastKeynoteA featured talk from the stage. Builds awareness and energy, produces no participant output on its own.
Evidence basisMediumRead from source
all eventKeynote by Tazin KhanKeynoteThought Leadership+
Format · BroadcastKeynoteA featured talk from the stage. Builds awareness and energy, produces no participant output on its own.
Evidence basisMediumRead from source
10:30am to 5:00pmSaturday from , Sunday fromUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
all eventResume & Interview WorkshopWorkshopCo Creation+
Format · Participant workWorkshopParticipants work on a problem and produce something. The strongest signal of participation architecture.
Evidence basisMediumRead from source
11:00am to 5:30pmSaturday fromUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
11:00amSaturday at to Sunday at (Yes, all night)UnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
10:00am to 12:00pmSunday from .UnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
10:30amSaturday at toUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
1:00pmSunday at (Yes, all night).UnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
6:00pm to 9:00pmRegistrationRegistrationLogistics+
Format · LogisticsRegistrationCheck-in and logistics, not agenda content.
Evidence basisMediumRead from source
11:00am to 3:00pmTalk Track 1PresentationKnowledge Transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisMediumRead from source
9:00am to 9:30amOpening Ceremonies with Blue Team Con Advisory BoardUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
9:35am to 10:30amKeynote: “Into The Blue” with Sean MetcalfKeynoteThought Leadership+
Format · BroadcastKeynoteA featured talk from the stage. Builds awareness and energy, produces no participant output on its own.
Evidence basisMediumRead from source
11:00am to 11:50am“Betting Before the Breach: Applying Poker Theory to Cybersecurity Spending” with Karen WalshUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
12:00pm to 12:50pm“Panel Discussion - Security Strategy for Small-Medium Business” with Russell Mosley, Amanda Berlin, Jim Nitterauer, and Heather SmithPanelDeliberation+
Format · BroadcastPanelExperts discuss while the audience watches. Surfaces perspective but rarely creates participant work.
Evidence basisMediumRead from source
1:00pm to 1:50pm“Incident Communications 101 - Breaking the Bad News” with Dr. Catherine J. UllmanBreakWellbeing+
Format · LogisticsBreakA pacing or recovery block between sessions.
Evidence basisMediumRead from source
2:00pm to 2:50pm“Shining a Light on Overprivileged Modern Applications - What are they, how to find them, what to do about it” with Mark Morowczynski and Bailey BercikUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
4:00pm to 4:50pm“Compliance and Regulation: The Next Great Security Threat?” with John OrleansUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
5:00pm to 5:50pm“Stop talking nerdy to me: translating the value proposition of the blue team to the C-Suite” with Jake WilliamsPresentationKnowledge Transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisMediumRead from source
10:40am to 11:10am“Realigning From Chaotic Evil” with Joseph SchottmanUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
11:20am to 11:50am[“Shifting Security PEOPLE Left: A successful experiment embedding a security engineer in Sales to build empathy, trust, and [more] scalable RFI and incident response processes” with Jennifer Chermoshnyuk](https://blueteamcon.com/directory/a-successful-experiment-embedding-a-security-engineer-in-sales/)UnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
12:10pm to 12:40pm“Eliminating Alert Fatigue: Reducing False Positives Through Better Engineering” with Dana BarilUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
1:00pm to 1:30pm“Office365 Logging - Turning Attacker TTP’s into High-Fidelity Alerts” with Ryan ClarkUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
1:40pm to 2:10pm“Analyzing Application Risk” with Chelsea TroyUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
2:20pm to 2:50pm“When Dinosaurs Ruled the Blue Team: Quickly Retrieving Triage Images Via EDR” with Dan BankerUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
3:40pm to 4:10pm“Building an AWS Onramp: Maintaining Guardrails for Self-Service AWS” with Margaret ValtierraUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
4:20pm to 4:50pm“Your Tax Dollars hard at work: how 800-53 and STIGS help in non-government space” with Gary RimarUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
5:00pm to 5:30pm“DFIR with Dinosaurs: Unearthing Artifacts and Host Hunting with Velociraptor” with Wes LambertUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
7:00pm to 9:00pmTalk Track 2 (Gold Room)PresentationKnowledge Transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisMediumRead from source
9:00pm to 1:00amTalk Track 1 (International Ballroom)PresentationKnowledge Transfer+
Format · BroadcastPresentationSpeakers present, the audience receives. Awareness only unless paired with practice or follow-up.
Evidence basisMediumRead from source
8:00am to 1:00pmRegistration and SwagRegistrationLogistics+
Format · LogisticsRegistrationCheck-in and logistics, not agenda content.
Evidence basisMediumRead from source
10:00am to 10:50am“How to successfully implement a Global Threat Hunting Program” with Alberto GarciaUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
11:00am to 11:50am“Star Wars: How an ineffective Data Governance Program destroyed the Galactic Empire” with Micah BrownUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
12:00pm to 12:50pm“The TIP of the Stinger: Efficiently Using Threat Intelligence With TheHive” with Matthew GracieUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
1:00pm to 1:50pm“Oh FFS! : Practical Password Auditing for Windows Networks” with AJ Van BeestUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
2:00pm to 2:50pm“Automating Vulnerability Management from Scratch” with Adam SchaalUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
3:30pm to 4:30pmClosing Ceremonies with Blue Team Con Advisory BoardUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
10:00am to 10:30am“Real World advice to stay sane while building a Security program” with Lauren RogersUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
10:40am to 11:10am“In the event of my demise, digital estate planning for the whole family” with Carla Raisler and Matt SpeerUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
11:20am to 11:50am“PhishCatch: Detecting Password Reuse from the Inside Out” with Tyler Butler and Eason GoodaleUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
12:10pm to 12:40am“Infosectual disfunction- how soft skills are helping bridge the gap between advocacy and infosec” with Katelyn BowdenUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
1:00pm to 1:30pm“How to Persuade, Change, and Influence to deliver the Blue Team mission” with Blake ReganUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
1:40pm to 2:10pm“Writing Cybersecurity Policies: You Don’t Have to be Michael Jordan” with Frank McGovernUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
2:20pm to 2:50pm“Lessons learned from building your own Vulnerability Management Platform” with Lee BergUnknownUnknown+
Format · BroadcastUnknownFormat not classified from the source; treated as a broadcast block by default.
Evidence basisMediumRead from source
all eventBlue Team Con 2026 Talks and Trainings Are Now Listed June 15, 2026TrainingSkill Building+
Format · Participant workTrainingGuided skill building where participants practice. Counts as participant work and learning transfer.
Evidence basisMediumRead from source
all eventBlue Team Con 2026 Call for Trainings March 9, 2026TrainingSkill Building+
Format · Participant workTrainingGuided skill building where participants practice. Counts as participant work and learning transfer.
Evidence basisMediumRead from source
all eventBlue Team Con Announces Keynote, Talks and Training Sessions for 2025 Conference July 29, 2025KeynoteThought Leadership+
Format · BroadcastKeynoteA featured talk from the stage. Builds awareness and energy, produces no participant output on its own.
Evidence basisMediumRead from source
The Full Reading
Why It Ranks This Way +
Calibrated from GES design 39/100 and verified 39/100, then capped for agenda is mostly passive without visible outcome mechanics.
Reader Takeaway. For a reader, this is a comparison record more than a model to copy: it reads as a broadcast-heavy conference, with the strongest visible signal in learning transfer and participation architecture and the biggest open question around follow through and network design. The practical test is whether the published agenda connects the room to post-event continuation and evidence.
Strongest signals: Learning Transfer, Participation Architecture, and Future-of-Work Fit. Weakest signals: Follow Through, Network Design, and Personalization.
How This Agenda Could Improve +
- Add named owners, dates, implementation checkpoints, and a visible post-event continuation path.
- Replace generic networking blocks with designed introductions, ask-offer exchanges, peer groups, or bridge-building rituals.
- Create role-based paths, prepared questions, tailored breakouts, or participant-specific next steps.
Fastest next move: Add named owners, dated next steps, and a visible continuation path before treating the event as outcome-ready.
Role-Specific Reading +
Sponsor lens
Look beyond exposure. Strong sponsor value would show qualified interaction, problem work, buyer learning, customer evidence, or follow-up. The practical sponsor move is to look for structured introductions, buyer-seller fit, and relationship persistence.
Designer lens
The agenda is useful as a pattern sample from blueteamcon.com. Redesign attention should go first to the lowest-scoring pillars; in practice, turn the thinnest agenda blocks into participant work.
Executive lens
Treat the visible agenda as an operating plan. The executive move is to require owners, dates, and evidence before treating the event as strategic. If owners, proof, and follow-through are not visible, the public record does not yet prove strategic movement.
Aggregator lens
Treat the source URL as evidence, not decoration. The data-product move is to label the source boundary clearly before ranking the record before ranking or syndicating the record.
What GES Means Here +
The Gathering Effectiveness Score is a strict 0-100 public-evidence reading of the agenda across eight pillars. It rewards visible participant work, follow-through, transfer, network design, and proof mechanisms more than polish, speaker fame, attendance, or satisfaction.
Visible mechanisms: Participant work, Network design, Learning transfer.
Evidence boundary: Scores reflect visible agenda/source evidence and should not be read as proof of causal event impact.
Limitations, Score Caps, and Review Flags +
Limitations
- No visible follow-up, progress monitoring, or longitudinal tracking.
- Passive stage formats dominate the visible agenda.
- No baseline measurement is visible.
Score caps
- 34: Agenda is mostly passive without visible outcome mechanics.
Review flags
- Fourth-loop score cap: Agenda is mostly passive without visible outcome mechanics.
- No source-backed follow-up, validation, baseline, tracking, or impact evidence.
- No tracking, validation, feedback, or impact measurement found in the visible source text.
- Original category was unknown; publication category is inferred.
Is this proof the event worked? +
No. This is a strict public-evidence reading of the agenda. Proof would require baseline, comparison, follow-up, attribution, and impact evidence beyond the listing.
What should a reader inspect first? +
Start with the source URL, then compare the eight pillar scores against the agenda rows. The biggest opportunities usually sit in follow-through, evidence maturity, and participant work.
Why publish weak records? +
Weak records are part of the map. They show where public agendas still describe sessions and speakers more often than outcomes, commitments, transfer, or proof.
How should I use the rows? +
Read the agenda rows as the visible design trace: formats, purposes, and evidence labels show what the public source made inspectable, not everything that happened in the room. This is a source-grounded interpretation of the public agenda record, not a copy of the source, and not an endorsement of the event.
Embed the verified badge +
This record is in the hand-verified gold set. Copy the snippet below to embed the verified badge on your own site.
<a href="https://unitedwetransform.com/events/evt_2026_10_sep_blue_team_con_2026_conference_september_10_12_2026_10_blueteamcon202_914d65"><img src="https://unitedwetransform.com/badge/ges-verified.svg" alt="GES verified by United We Transform" height="40"></a>Where To Go Next
Compare this agenda against other Technology / AI / Startup events scored on the same eight pillars.