DISC 2026

WHAT TO EXPECT

You'll get the real OT threat landscape, not a highlight reel. The opening keynote covers newly-named threat groups, major campaign updates, and the trends that actually matter for defenders in 2026 — with a hard rule that if there's nothing genuinely new to report on a group, it doesn't get airtime.
Every session is built on real incident data. From 16 IR engagements in the first four months of 2026 alone, to active adversary C2 channels still under Dragos monitoring, the talks pull from actual casework across electric, oil and gas, water, manufacturing, and rail environments — not hypotheticals.
You'll leave with transferable skills, not just findings. Sessions like the authentication detection methodology and OT artifact collection talk are deliberately structured so defenders can apply the frameworks to any environment, not just ones running Dragos technology.
AI in ICS gets an evidence-based treatment. Rather than hype or dismissal, the AI-generated malware session delivers a calibrated assessment of AI's actual role in ICS attacks — with a focus on which detection windows are shrinking and what that means for defenders operationally.
The hard questions get real answers. OT insider threat, the myth of the air gap, and the gap between compliance and actual security are all on the agenda — addressed with original case research and data-driven findings rather than the surface-level coverage these topics usually receive at industry events.