Forum of Incident Response and Security Teams (FIRST)

Vision

FIRST aspires to bring together incident response and security teams from every country across the world to ensure a safe internet for all.

Effective response is a global task, mirroring the global nature of the internet. Based on a peer to peer network governance model, Computer Security Incident Response Teams (CSIRTs), Product Security Incident Response Teams (PSIRTs) and independent security researchers work together to limit the damage of security incidents. This requires a high level of trust; the fuel our members run on. FIRST fosters trust building among members through a variety of activities. Incidents are not confined to one cultural or political corner of the internet, nor do they respect borders or boundaries. FIRST thus promotes inclusiveness, inviting membership from all geographic and cultural regions.

Missions

Global Coordination - You can always find the team and information you need.

FIRST provides platforms, means and tools for incident responders to always find the right partner and to collaborate efficiently. This implies that FIRST’s reach is global. We aspire to have members from every country and culture.

Global Language - Incident responders around the world speak the same language and understand each other’s intents and methods.

During an incident it is important that people have a common understanding and enough maturity to react in a fast and efficient manner. FIRST supports teams through training opportunities to grow and mature. FIRST also supports initiatives to develop common means of data transfer to enable machine to machine communication.

Policy and Governance - Make sure others understand what we do, and enable us rather than limit us.

FIRST members do not work in isolation, but are part of a larger system. FIRST engages with relevant stakeholders, in technical and non-technical communities, to ensure teams can work in an environment that is conducive to their goals.

FIRST brings together Internet security teams and experts from across the world, to share knowledge and insights, ensuring a safer Internet for all. Founded in 1990, FIRST consists of security practitioners from over 816 corporations, government bodies, universities and other institutions, representing over 113 countries in the Americas, Asia, Europe, Africa, and Oceania.

FIRST gives the global incident response community a place to build trust and work together. It also provides valuable opportunities to build capability, such as:

• technical colloquia for security experts,
• hands-on classes,
• annual incident response conference,
• publications and web services,
• special interest groups, and
• community and capacity building.

The FIRST Community & Capacity Building program was launched in 2022 to help grow, strengthen, and expand the global incident response community. Since launch, the program has delivered a diverse range of initiatives across the globe with support from the UK FCDO, Swiss FDFA, Fortinet, Organization of American States (OAS), US State Department, and others. In June 2025, FIRST CORE was launched as our flagship sponsorship program to support a wider range of community and capacity building activities. This role will drive the development and growth of FIRST CORE.