Laura de Vesine, Reddit, and Alec Randazzo, Datadog
In most ways, security incidents are extremely similar to the incidents that we regularly manage as SREs: they are emergencies that involve coordinating many responders, have specific expectations for stopping the bleeding, then resolving the issue, and teams are expected to engage in long-term follow ups for preventing recurrences. However, in some key ways they are meaningfully different. This is especially true around requirements to document and not document particular things, primarily because of legal concerns; it’s also often the case that investigation for a security incident requires a much more detailed lens than many reliability incidents. This talk will explore what experts on both sides of security & SRE/reliability incidents can learn from each other, and help SREs build a mental model of how and why the security space is different (and the same).
Laura de Vesine is a 25+ year software industry veteran. She has spent the last 10 years in SRE working in incident analysis and prevention, systems understanding, chaos engineering, and the intersection of technology and organizational culture. Laura is currently a staff engineer at Datadog, Inc. She also has a PhD in computer science, but mostly her kittens nap on her diploma.
Alec Randazzo has been in the security detection and response space for 13+ years. He's split this time between incident response consulting, detection and response engineering, and internal detection and response. He's responded to dozens of high severity security incidents at organizations ranging from SMBs to Fortune 500s. Alec is passionate about real world practical detection and response. He is currently a staff security incident response engineer at Datadog.
author = {Laura de Vesine and Alec Randazzo},
title = {How Security Incidents Are Different ... and How They{\textquoteright}re Exactly the Same},
year = {2026},
address = {Seattle, WA},
publisher = {USENIX Association},
month = mar
}
