First Encounters (BlackHat + DefCon 2026)

Despite working in the field for close to a decade now, this was my first time going to BlackHat and DefCon (BH/DC from now on). The primary issue was distance, as I lived in Europe, but cost was a big hurdle too. This year, I was fortunate enough to attend through work, with a blue badge for BH and a full ticket for DC.

My expectations were rather tame, as many of my peers have been to the cons before and came back with mixed feelings. Even with that in mind, BH was a pretty low point.

I am fairly (obsessively?) wired into both the infosec and AI industries and have been for about 10 and 5 years respectively. The BH AI Summit talks were very much intro level, or perhaps even a level below that. There were also some questionable technical claims. At one point, for example, a speaker claimed there were “65,000 ways to exfiltrate data,” which struck me as an oddly specific and not particularly meaningful way to describe the problem. Even the Anthropic talk was very surface level.

I know BH is aimed more toward executives and managers, but if anything, that makes me more concerned about the quality of some of those presentations.

The Briefings looked a lot better, but my badge did not include them. The vendor hall was pretty overwhelming, but overall it was a good experience because I could actually talk shop with some of the vendors. The technical discussions I had with Semgrep were really informative for understanding where the AI code review industry is going. It was also a good opportunity to meet some online friends who worked at various booths.

I got about a dozen T-shirts and some other trinkets, some of which are actually neat and some of which will inevitably become gym shirts.

BH is supposed to be good for networking, but between shuffling from one talk to another, the back-to-back schedule, and the relatively large venue, there weren’t many opportunities to talk to new people, especially if you didn’t have lunches included. Most people seemed to be there for work, with their coworkers, and largely stuck to those groups.

I would rate my experience a 4/10 and would absolutely discourage anyone from paying out of pocket for the experience I had with this particular badge. The Briefings or trainings may have changed that considerably.

DefCon was better.

I didn’t expect some sort of hacker Mecca, but after all the stories I’d heard over the years, I wasn’t entirely sure what to expect. The villages were a bit confusing as a first-timer, between the queues, crowds, and occasionally unclear boundaries between people participating in something and people simply hanging around. Because of the excessively long queues and traffic, I didn’t end up doing many village activities.

I did attend a number of talks, both small and main stage, and most of them were fine. There were some standouts, and I would be remiss if I didn’t mention Cliff Stoll’s presentation, which was just incredible. The man is an inspiration to hackers around the world, and I got my 15-year-old copy of his book signed by him.

The theme of this year’s DC was agency, which I didn’t really see reflected as strongly throughout the conference as I expected, aside from some mentions of LLMs and other hype-cycle technology.

Once again, I got to meet more of my online hacker friends, which was great. I talked to some new people at DC, but nothing really lasting, mostly typical LineCon and lunch ad-hoc conversations. I’m part of the DC book club, though, and I got to meet its members and spend some time with them, which was a ton of fun. So I can say that, at least, I made some friends at DefCon.

Lastly, I got a ton of cool stickers for me and my wife.

I’d give DC a 7/10. It probably would’ve been more fun if more of my online friends had gone to DC as well. The crowds and general chaos detracted from the experience somewhat, too.

Would I go to DC on my own dime? Probably not. It’s getting more expensive, and Vegas is a pretty sad and hectic city to spend an extended amount of time in. But I would go to DC again, which I’m a bit more hesitant to say about BH. If I had trainings or Briefings, or got to present, I would be more inclined. As is, I’d rather avoid spending three extra days in the desert.

I’m glad I got to experience BH/DC now before life gets hectic again, and I’m thankful to my employer for footing the bill. I came away from DC feeling pretty inspired and with several ideas for things I’d like to work on, so I’d say it was a worthwhile investment for everyone involved.