My Way is Not Very Sportsman-Like

The talk opens by challenging the "Defender's Dilemma," the common belief that defenders must get everything right while attackers need only one success. The speaker argues this premise is outdated and leads teams to poor spending decisions and demoralized staff. Intrusions unfold across a lifecycle with many points where activity can be detected and interrupted, not a single event, so defenders have chances to act at several stages.

The middle of the talk turns to the defender's first-move advantage. Defenders can prepare the environment before an adversary acts, and basic hygiene such as multifactor authentication, patching, asset inventory and software bill of materials is framed as setting the board. The speaker then walks through the Pyramid of Pain, showing that detecting hashes, IP addresses and domains is cheap for adversaries to dodge, while detecting tools and behaviors imposes real cost. Resilience, proactive threat hunting and deception, such as canary tokens, decoy accounts and honeypots, are presented as further ways to waste attacker time and slow their progress.

The closing argument is for an "attacker's dilemma" mindset, in which adversaries must avoid errors across their entire lifecycle. The speaker encourages practitioners to look for opportunities in their own daily work to shape attacker choices, and to build defenses that are inexpensive yet force mistakes.