Breaking the Kill Chain: A Gamified Cyber Incident Recovery Masterclass
By Mikael Nyström, Hasain Alshakart, Viktor Hedberg, Truesec
08:30 Doors Open
09:00 - 16:00 Masterclass sessions
Location: Oslo Spektrum, Sonia Henies plass 2, 0185 Oslo
Due to construction work around Oslo Spektrum, use entrance 6 via Stenersgata.
Please remember to bring your own laptop.
Experience a real cyberattack, and learn how to stop the next one.
Practical Incident Recovery is a full‑day, gamified experience built on real attack timelines from real enterprise incidents. Attendees don’t just hear about breaches - they experience how an attack unfolds, how decisions are made under pressure, and how architecture choices either save or destroy an organization.
It’s practical, interactive, and highly relevant to today’s threat landscape - exactly the kind of content attendees talk about after the event.
In Practical Incident Recovery, you’ll step through a realistic attack timeline inspired by real cases, making decisions as the incident unfolds:
- Phishing and social engineering
- Abuse of legitimate tools like RMM
- Privilege escalation and lateral movement
- Data exfiltration and ransomware
- Recovery under pressure
- Preventing the same attack from succeeding again
- This isn’t a lecture.
- It’s an interactive experience where your choices matter.
What You’ll Learn
By the end of the day, you will:
- Understand how modern attacks really progress inside enterprises
- Know which logs and signals actually matter during an incident
- See why many response plans fail under real conditions
- Learn how tiering, isolation, PAWs, and hardening break attack chains
- Walk away with concrete, practical prevention strategies
Who should attend
- Security architect or engineer,
- Part of an incident response or SOC team,
- Responsible for identity, endpoint, or infrastructure security,
- Tired of theory and want practical, realworld insight.
Why This Is Different
- Based on real attack timelines
- Gamified and interactive - not slidedriven
- Focused on prevention, not just cleanup
- Designed for people who actually run enterprise environments
About Hasain Alshakarti
Also known as "The Wolf", is an industry-leading cyber security expert with more than 30 years of experience.
Hasain Alshakarti has extensive and deep expertise from numerous design projects, security audits, advanced implementation projects, incident response, digital forensic, threat hunting and penetration testing. He helps customers understand and build solutions to protect, detect and respond to cyber threats for enterprises, government agencies, banks, military organizations among others.
Due to his expertise, he is a sought-after advisor, speaker and a popular instructor. For his many achievements over the years, Hasain has been awarded recognition as “Sweden’s leading IT security expert” and Microsoft MVP in Enterprise Security and Cloud & Datacenter.
About Mikael Nyström
Mikael Nystrom , also known as the “Deployment Bunny” is a Microsoft MVP and Principal Technical Architect at Truesec, with an extremely broad field of competence. He has worked with all kinds of infrastructure tasks, in all kinds of environments, enterprise to small business. He is currently working in the CSIRT where he is Rebuilding, Recovering, Deploying, Configuring and Restoring organizations hit by cyberattacks or other incidents. Mikael is a very popular instructor and speaker at major conferences such as Security Summit, MMS and NIC.
About Viktor Hedberg
Security consultant with a focus on Microsoft Security either on-prem or in the cloud, and a blueteamer at heart. Viktor has worked within IT for the past 10 years always within Cyber Security. Possessing in-depth knowledge in securing Microsoft-based environments and forensicating Microsoft cloud services makes him a valuable asset in infrastructure, incident response, and blue teams. Additionally, Viktor is passionate about cutting-edge technologies, defensive and attack tools, and contributing to communities worldwide.