BSides Vancouver 2026

AI is making attacks faster. Autonomous tooling compresses kill chains that used to take days into hours. Your incident response needs to keep pace, but most organizations have an IRP that covers escalation paths and notification timelines, and nothing that tells you how to actually run the incident at speed.

How do you brief a room of 30 people at 2 AM? How do you structure teams so nothing falls through the cracks over a 10-day response? How do you make consequential decisions every few minutes under incomplete information without losing accountability? How do you document as you go, rather than reconstructing after the fact? Going faster without answering these questions just leads to confusion faster than ever before.

RCMP Major Case Management was built after investigations failed due to coordination breakdowns under pressure. It provides principles for command structure, information management, team coordination, and accountability that scale from a two-person response to an 80-person operation without the overhead of a full Incident Command System.

This talk introduces CMIM (Cyber Major Incident Management), an adaptation of those principles for cybersecurity incident response in an era where machine-speed threats demand machine-speed decisions from human teams. It covers what the framework looks like, where it came from, and what happened when it was used to coordinate an 80-person cross-organizational response to a live attack. Bring your IR war stories.