# Incident Response: What Happens After the Worst Case Scenario — Nestor Angulo de Ugarte

> What actually happens inside the 'black box' when a hacked site is handed to a cleanup team — with real examples and tricks you can apply yourself, framed around the Blue Team's work.

Canonical: https://nestorangulo.pro/speaking/wordsesh-2022-incident-response/

- Format: Conference Talk
- Event: [WordSesh 2022](https://wpsessions.com/sessions/incident-response-what-happens-after-the-worst-case-scenario/)
- Location: Online
- Date: 2022-05-18 (May 18, 2022)
- Language: English
- Speaker: [Nestor Angulo de Ugarte](https://nestorangulo.pro/about/)
- Themes: Incident Response, Web Security, WordPress Security

When a hacked site is handed to a cleanup team, what actually happens inside the process? This session opens up that "black box" — the triage, the decisions, the sequence of actions — using real examples from the front line of WordPress security work.

The framing is Blue Team: defenders responding to an active incident. That perspective shapes everything from how you prioritise what to fix first to how you communicate the situation to the site owner without making it worse.

Alongside the walkthrough, practical tricks you can apply yourself — even without a team behind you — to recover faster and reduce the chance of it happening again.

[← All talks](https://nestorangulo.pro/speaking/)