FIRST History

In November 1988, a computer security incident known as the "Internet worm" brought major portions of the Internet to its knees. Reaction to this incident was isolated and uncoordinated, resulting in much duplicated effort, and in conflicting solutions. Weeks later, the CERT* Coordination Center was formed. Soon after, the United States Department of Energy formed the Computer Incident Advisory Capability (CIAC) to serve its constituents.

Over the next two years, the number of incident response teams continued to grow, each with its own purpose, funding, reporting requirements, and constituency. The interaction between these teams experienced difficulties due to differences in language, timezone, and international standards or conventions. In October 1989, a major incident called the "Wank worm" highlighted the need for better communication and coordination between teams.

The FIRST was formed in 1990 in response to this problem. Since that time, it has continued to grow and evolve in response to the changing needs of the incident response and security teams and their constituencies.

By 2002, the Internet had grown from 60,000 host computer systems to 150 million in nearly all countries in the world (see Internet Domain Survey at the Internet Software Consortium). Many companies now rely on the Internet in their daily business transactions. Incident response and security teams continue to form around the globe, covering a range of constituencies from whole countries, to multi-national organizations. The FIRST membership consists of teams from a wide variety of organizations including educational, commercial, vendor, government and military.

FIRST members growth by year*

(*) The statistic measurement method and regional breakdown changed in 2007.