If your feed is anything like mine, you have probably been inundated with Black Hat and DEF CON posts over the past week. After five years of sharing my own recaps, I recognize that I am adding one more voice to an already crowded conversation. If you care to keep reading, however, I will try to share what these conferences felt like from my perspective and what I learned along the way.
My fitness tracker recorded a little over 30 miles from Monday through Sunday. That does not include the many hours spent standing at booths, in villages, at parties, or waiting for the next activity to begin.
Hacker Summer Camp is not merely a series of conference sessions. It is six days of walking, standing, talking, learning, exploring, eating, dancing, staying out too late, and constantly choosing among more options than anyone could reasonably fit into one week.
Everyone experiences these conferences differently. Some people build their schedules around technical presentations. Others focus on the Black Hat Business Hall, customer meetings, competitions, speaking, or volunteering. At DEF CON, some people spend an entire day inside one village, while others find a table, open their laptop, and start coding. Some return to their hotel to rest, and a large percentage apparently never come back for the evening parties.
My own experience has evolved over five years. I once planned each day around attending as many sessions as possible. Today, sessions remain important, but they are part of a broader experience that includes exploring, volunteering, networking, working a booth, and simply being part of the energy surrounding these events.
Black Hat Begins Before Black Hat
Attending Hacker Summer Camp successfully requires a surprising amount of advance planning. I register early, arrange travel, get my badges, sign up for parties and workshops, look for volunteer opportunities, contact peers about meeting up, and post on social media to find out who else will be attending. In some ways, it is not unlike planning a successful Disney vacation. You need to understand the options, make reservations early, and accept that you still will not fit everything into the available time.
Black Hat began for me before the official opening program. After some flight delays, I arrived Monday afternoon and attended two evening mixers. One included a panel on agent security, while the other attracted more of a founder and investor crowd.
Monday evening placed me among more executive and investor types than I normally encounter socially. I met a few leaders from startups and smaller technology companies and, honestly, felt a little out of place at times. It was still interesting to hear what they were building and to experience a side of the industry that I do not often see in that kind of setting.
Once the main conference began on Tuesday, my time centered on the Business Hall, the Microsoft booth, selected presentations, and conversations with peers and vendors. David Weston’s opening keynote was excellent. Anyone working in cybersecurity or AI should find the recording on YouTube and watch at least the last 30 minutes.
I worked the Microsoft booth for several hours around midday on both Wednesday and Thursday. It continues to be one of my favorite parts of Black Hat. I get to answer attendee questions while meeting employees from parts of Microsoft I rarely encounter in my daily work. The booth also becomes a natural gathering place for Microsoft employees attending the conference. At times, it feels less like a product booth and more like a small Microsoft reunion.
I met or reconnected with somewhere between 35 and 40 Microsoft people during the week. I probably met two or three times that number from elsewhere in the industry. Some of that networking was intentional, but much of it simply happens when so many people with shared interests occupy the same space.
AI Everywhere, Differentiation Nowhere
The Business Hall remains one of the best places to take the temperature of the commercial security industry. You can speak with salespeople, engineers, recruiters, product managers, founders, and company executives, all within a few hours.
The most obvious theme this year was the continued explosion of AI. AI was already everywhere last year, but the number of companies and the similarity of their messaging were striking this time.
Many of the companies I encountered also seemed new in one way or another. Some were new to the industry, some were newly focused on AI, and others appeared to have recently attracted enough investment to afford a featured booth. Most claimed to have been around for years and only recently emerged as an AI butterfly. The companies may not have been new, but many of the employees, leaders, investments, and product narratives were. AI appears to have given quite a few organizations new life and a fresh opportunity to push toward the front of the pack.
Nearly every vendor seemed to offer some combination of AI agents, automated investigation, alert prioritization, threat intelligence, orchestration, exposure management, code security, or accelerated response. The products may operate differently beneath the surface, but their descriptions increasingly sound interchangeable.
Putting AI in a company or product name no longer makes it distinctive. Calling something an agent is also becoming less meaningful unless the vendor clearly explains what it can access, what decisions it makes, what actions it performs, and why it produces better results than dozens of similar offerings.
AI is also becoming less of a separate product category. It is being absorbed into endpoint protection, identity, cloud security, application security, SIEM, automation, incident response, managed services, and nearly every other corner of the industry.
Some of my best conversations were with smaller vendors that could clearly explain the specific problem they were solving. Some larger vendors seemed more interested in directing visitors into controlled sales presentations. That may generate leads, but it does not necessarily help someone understand what makes the product different.
Booths, Boxing Robots, and Missing Vendors
The displays ranged from practical to wonderfully excessive. I saw a robot playing chess, boxing robots, elaborate vehicles and visual displays, and even a Dungeon Crawler Carl cosplayer. Custom hats and shirts appeared to replace the LEGO sets that dominated previous years.
Despite my attempts to minimize the amount of unnecessary junk I brought home, I still collected some fun items and a few shirts I will actually wear. I do not wear many shirts promoting other companies, but there are always a few that are unique or comfortable enough to survive the trip home.
CrowdStrike’s absence was also noticeable. It has traditionally maintained one of the more prominent and theatrical booths at Black Hat. Its advertising was still visible elsewhere in Las Vegas, but the missing booth stood out compared to prior years.
I had registered for several evening events, including an exclusive Microsoft party, but attended far fewer than planned. Dinners in Las Vegas take longer than expected, conversations continue, and suddenly the event on your calendar has been underway for two hours.
My oldest child, Sophie, joined me this year, and my traveling companion brought his son. Even when I had registered for an event individually, there was no guarantee all four of us could attend together. I do not regret choosing time with friends and family over maximizing the number of exclusive parties I could enter. The event on the schedule is not automatically more valuable than the people standing in front of you.
DEF CON: A Different Kind of Value
The transition from Black Hat to DEF CON feels like leaving an enormous industry trade show and entering a festival created by and for the hacker community.
I attended several interesting and entertaining presentations, including one about researchers turning the tables on North Korean operatives fraudulently obtaining remote jobs. I also enjoyed watching parts of the social engineering competitions, where seeing techniques applied live provides a different perspective than hearing them described in a traditional presentation.
I had planned to attend a malware analysis workshop but was unable to participate. That left more time to explore the villages, attend other sessions, talk with people, and take in the conference. On Saturday, I also worked a half-day volunteer shift in a Red Team Village workshop area.
Volunteering changes your relationship with a conference. You are no longer only consuming an experience created by other people. Even in a small role, you are helping create it for someone else.
More Open, but Also Emptier
DEF CON felt physically different this year. In previous years, the AI Cyber Challenge and a large cyber-disaster response experience occupied significant portions of the available space. Without them, the main halls were larger, brighter, and easier to navigate.
The open layout improved accessibility and gave popular villages room to breathe. On the other hand, the high ceilings, bright lighting, and wide-open areas sometimes made the conference feel quieter and emptier, even when plenty of people were present. The extra room may also mean DEF CON has space to accommodate larger crowds in future years.
Silent headphones amplified that effect. Attendees wore headphones synchronized with individual stages, allowing multiple presentations to occur near one another without competing for volume. The speakers were much easier to hear, but the surrounding conference became strangely quiet.
In previous years, walking through DEF CON felt like moving through a music festival, with voices from competing stages creating a constant background roar. This year, you could walk past a large audience listening to a speaker and hear almost nothing.
The difference was especially noticeable during evening parties held in the main halls. In earlier years, many parties occupied darker rooms with lower ceilings, loud music, and crowds packed closely together. The larger halls absorbed more of the sound, while the bright lighting and open space made the gatherings feel less intimate. I would not necessarily call one arrangement better than the other, but they created noticeably different experiences.
Connections That Continue
Much of the value of Black Hat and DEF CON comes from encounters that cannot be scheduled.
During a previous year, I met a young woman leaving Circus Circus who asked if I knew how to get to DEF CON. I invited her to walk over with me, and we spent the better part of an hour talking before exchanging contact information. I later passed along a few industry contacts that I thought might help her.
While I was waiting in line this year, she messaged me to say hello and joked that I was probably standing in the DEF CON line again. That chance meeting had become a small connection that survived from one conference to the next.
I meet many students and early-career professionals during these events. I hand out business cards, connect with people on LinkedIn, offer introductions, and let people know I am willing to help. Not everyone follows up, which is understandable, but some do.
At this stage in my career, I have accumulated experiences, contacts, and lessons that may help someone who is just entering the industry. I enjoy having the opportunity to share those when they are useful. At the same time, these conferences expose me to people whose experience is very different from mine and who may become mentors, advisors, or sources of new perspective for me.
One year I met a security leader from Blizzard Entertainment while sharing a cab. Other years have brought unexpected conversations with industry leaders, vendors, students, researchers, and people whose work I have followed for years. This year, I also had the opportunity to introduce Sophie to part of that experience.
Another favorite moment happened Saturday night. A couple of years ago, I received a bandanna, glasses, and bracelets at a Darknet Diaries event. I wore them together this year as an improvised version of Jack Rhysider’s iconic look and then unexpectedly ran into Jack himself.
Jack seemed amused and approved of my impersonation. I have met him several times, and Darknet Diaries remains one of my favorite podcasts. Running into him while dressed like him was exactly the kind of strange and memorable encounter that feels completely natural at DEF CON.
The Parties Matter Too
I made it to several evening gatherings, and the parties remain one of my favorite parts of DEF CON. At my age, I am not normally going to walk into a nightclub and join a techno rave. At DEF CON, it somehow feels completely natural.
These are not carefully curated nightclub crowds. We are cybersecurity people, with all the eccentricity and awkwardness that implies. I am a goofball surrounded by other goofballs. For a couple of hours, a few hundred people drawn from a conference of tens of thousands can gather in a room, lose themselves in loud music, and enjoy a completely judgment-free shared experience.
There is something refreshing and invigorating about that. The parties are not separate from the community experience. They are another expression of it.
No Two Conferences Are the Same
Another attendee could spend the same week in the same buildings and have an almost completely different experience. They might attend dozens of technical sessions, compete in a capture-the-flag event, spend all day coding, conduct customer meetings in nearby hotels, rest every afternoon, or skip the evening events entirely.
That is not a flaw. It is one of the greatest strengths of Black Hat and DEF CON.
For me, Black Hat offered a concentrated view of an industry racing to incorporate AI while struggling to differentiate increasingly similar products. DEF CON offered selected technical insights, but its greater value came from volunteering, reconnecting with people, sharing the experience with Sophie, and participating in a community I genuinely enjoy.
Now comes the recovery. It will probably take the better part of a week for my weight to return to its pre-conference level, my feet and back to stop complaining, and the traditional postconference sniffles to pass.
Quite foolishly, I flew home early Sunday morning, ate dinner with my family, and then headed back out with my wife to see the Goo Goo Dolls that evening. It was not the most sensible recovery plan, but it was a fitting conclusion to a week spent fitting more into each day than the available hours should reasonably allow.
Then Monday morning arrived, and it was time to shake it off and get back to work.