The Vijilan webinar series
The debrief, on the record.
One realistic incident per episode, walked from the first alert to the last decision. Then the part most webinars skip: the debrief, held live, with people who would have made different calls.
Hot Wash is Vijilan Security’s free webinar series for security leaders, IT directors and MSPs: each episode walks one realistic incident from first alert to final decision, then holds the debrief live. Episodes are free, vendor-neutral and recorded.
Why the name
A hot wash is the debrief held straight after an exercise or a real incident, while the people involved still remember what they did and why. The term comes from military after-action practice, and US emergency management’s exercise doctrine (HSEEP) uses it for the facilitated discussion held right after an exercise ends. It is the first, unpolished pass at lessons learned, before anyone writes the formal after-action report.
Incident response is supposed to end with a debrief, and in a well-run team it always does. Hot Wash takes that conversation out of the war room and holds it where other teams can learn from it.
A keynote tells you what went right. A hot wash spends most of its time on what did not: the decision made too late, the alert read too quickly, the owner nobody had named. That is the part worth an hour of your time.
A debrief a year later is history. Each episode takes on a problem teams are dealing with now, before it settles into a best practice nobody questions.
How an episode runs
The same four questions every after-action review asks. The scenario plays out, the panel makes its calls at each decision point, and the last part of the hour answers these.
Season one
Dates and guests are announced as each episode is booked. Tell us which ones you want first and we will book those sooner.
An automated action fires faster than any person could approve it. It was the right call this time. The debrief is about the next time, when it is not, and who answers for it.
A vendor emails new bank details on Friday afternoon. The thread looks right, the invoice is real, and the payment goes out. By Monday the vendor is asking where their money is.
The help desk takes three calls in ten minutes about files that will not open. Nobody has said the word ransomware yet. What happens in the next hour decides how long recovery takes.
Every sign-in in the logs passed multifactor authentication. That is the problem. Somewhere between a push prompt approved at midnight and a password reset over the phone, someone else became the user.
The intrusion arrives through software everyone trusts: signed, approved and running with admin rights on every machine. For an MSP, that software might be your own remote-management tool.
An internal AI agent reads a document with instructions hidden in it, then does exactly what they say with the access it was given. Nothing was hacked in the usual sense. The agent simply obeyed the wrong text.
The detection fired. It was correct. It sat in a queue overnight with two hundred others, and by the time anyone opened it the attacker had moved on. The tooling worked. The process did not.
A full tabletop exercise run in front of the audience, with injects you vote on. The second half is the hot wash itself: what the room decided, what it missed, and what a real team would change on Monday.
Next episode
One email when an episode you picked gets a date. No newsletter. If there is an incident you would rather we debriefed, suggest it.
Questions
Hot Wash scenarios are composites written for discussion. They do not describe any client’s incident and use no client data. Guests speak for themselves, not for their employers.