2023 Survey Event | Incident Response

2023-09-WB-SANS Incident Response Survey


Incident response (IR) capabilities play a major role in an organization’s security posture. IR teams’ capabilities determine how well organizations respond to an event when a threat actor strikes. The SANS 2023 Incident Response survey examined the tools, processes, and people involved in IR.

This webcast will explore rising technologies, response and recovery times, and employment trends in the industry. In addition, gathered data will be compared to results from previous years’ surveys to identify trends and changes in the industry.

Specific topics covered include:

  • How long are organizations taking to identify, respond to, and remediate incidents?
  • What technologies are most useful in supporting incident response teams?
  • How are organizations supporting their IR staff?

Watch the recorded webinar

John Gamble - image


John Gamble

Director of Product Marketing, Corelight

John Gamble is Director of Product Marketing at Corelight and has spent more than a decade in the data protection industry representing cybersecurity, privacy and identity verification solutions, including his most recent role as Director of Product Marketing at Lookout, a mobile endpoint security company.

Jon Garside - image


Jon Garside

Senior Director Product Marketing, Devo

Jon Garside is a veteran of cybersecurity and Devo's vCISO ambassador. With 25 years of experience as a military intelligence lead hacker, CISO, and security practice evangelist, Jon is passionate about security as the #1 topic in the boardroom.

Megan Roddie - image


Megan Roddie

Senior Security Engineer, IBM

Along with her work at IBM, Megan works with the SANS Institute as a co-author of FOR509, presents regularly at security conferences, and serves as CFO of Mental Health Hackers. She has two Master's degrees, one in Digital Forensics and the other in Information Security Engineering, along with many industry certifications in a wide range of specialties.

Terrence Williams - image


Terrence Williams

Security Engineer, AWS

Currently Terrence Williams works in a Defensive Cyber Operations billet that requires him to conduct various duties in the DFIR realm. His young career has led him to operating on multiple enterprise networks supporting military operations that expand across the world.


Corelight provides security teams with network evidence so they can protect the world's most critical organizations and companies.