Key Takeaways<\/p>\n
- \n
- RSAC 2026 runs 23\u201326 March in San Francisco \u2013 moving from its traditional April slot (source: RSA Conference, Moscone Center).<\/li>\n
- it-sa Expo & Congress takes place 27\u201329 October in Nuremberg \u2013 the DACH compliance must-attend for security teams (source: N\u00fcrnbergMesse).<\/li>\n
- Black Hat Europe returns 7\u201310 December in London \u2013 training remains the real draw, while the Business Hall has lost much of its substance by 2026.<\/li>\n
- DEF CON 34 lands 6\u20139 August in Las Vegas \u2013 Village focus eclipses Main Stage; attendees who only catch keynotes miss the conference.<\/li>\n
- Regional and niche events (OffensiveCon Berlin, Troopers Heidelberg, FIRSTCON) are gaining market share in 2026 \u2013 smaller crowds, higher signal density.<\/li>\n<\/ul>\n<\/div>\n
Related<\/span>Copilot security risk 2026: prompt injection & oversharing under DSGVO scrutiny<\/a> \/<\/span> Claude myth debunked: situational awareness for security teams<\/a><\/p>\n
What makes a robust CFP process?<\/h2>\n
A Call for Papers (CFP) is a conference\u2019s open invitation to researchers to submit talks. The deciding factor for quality is who evaluates the submissions. A technical review board comprises active security researchers who vet entries for originality, reproducibility, and relevance \u2013 and reject submissions whose core claims have already been published or whose methodology is unsound. Conferences without a visible review board, without a published rejection rate, and without named reviewers are not operating under this quality-control mechanism. That is the single most important indicator of a publication\u2019s editorial standard.<\/p>\n
As of April 2026, the major security conferences (RSAC, Black Hat, DEF CON) publish the names and roles of their review-board members. Those that do not have the burden of proof reversed.<\/p>\n
Guardrails: When an Event Really Pays Off<\/h2>\n
The first question before any booking isn\u2019t \u201cwho\u2019s speaking there\u201d but \u201cwhat will I take away operationally.\u201d Security events add up by a simple formula: learning effect plus reliable contact, divided by total cost per attendee. Everything else is travel-expense prose.<\/p>\n
Three guardrails separate must-attend from nice-to-have. First: does the conference run a CFP process whose review board consists of practicing security researchers? Second: are there technical tracks without sponsor keywords in the title? Third: does the exchange happen in small formats (villages, workshops, birds-of-a-feather) or only in expo halls?<\/p>\n
If two of the three answers are no, it\u2019s likely a marketing fair with a security label. That isn\u2019t inherently bad \u2013 such formats can suit vendor screening or analyst talks \u2013 but the travel-cost application should then be justified accordingly.<\/p>\n
\n3<\/div>\nKey questions before every conference booking: technical review board, sponsor-free tracks, small formats<\/div>\nSecurityToday editorial heuristic 2026<\/div>\n<\/div>\nThe Big Must-Attend Events \u2013 Where Substance Still Holds<\/h2>\n
Four dates in 2026 sit on the calendars of most CISO teams. They aren\u2019t automatically relevant every year, but each edition delivers at least two tracks that justify the travel effort.<\/p>\n
RSAC<\/strong> in San Francisco runs from 23\u201326 March 2026 \u2013 three weeks ahead of the traditional April slot. Anyone who habitually books flights and hotels late should adjust their calendar early. RSAC remains the go-to event for strategy, analyst meetings, and international peer exchanges. Technical content is broad; those seeking depth should aggressively filter for the Cryptographers\u2019 Track and Implementer Sessions.<\/p>\n
it-sa Expo & Congress<\/strong> in Nuremberg, 27\u201329 October, is the DACH anchor. It\u2019s a trade fair, not a conference \u2013 keep that in mind. Yet across three days it gathers nearly every relevant German security vendor under one roof, flanked by Congress tracks on NIS2, KRITIS, and BSI baseline protection. For procurement decisions and compliance orientation, the format is hard to beat.<\/p>\n
Black Hat Europe<\/strong> in London, 7\u201310 December, delivers substance mainly in trainings and briefings, less on the Business Hall. If you\u2019re only walking the expo floor, skip the ticket. The trainings \u2013 Red Team operations, reverse engineering, cloud attack paths \u2013 are at a level many internal programs can\u2019t match, and that part pays for itself.<\/p>\n
DEF CON 34<\/strong>, 6\u20139 August in Las Vegas, remains the hacker conference that cares least about corporate agendas \u2013 and that\u2019s its value. Taking the villages seriously (ICS Village, AppSec Village, AI Village) yields insights you won\u2019t see on any vendor stage. Main-stage keynotes are window dressing. If you\u2019re sending SOC or Red Team staff, set clear learning goals per village \u2013 or it becomes expensive entertainment.<\/p>\n
Overrated Formats: Where ROI Has Shifted<\/h2>\n
Without naming names: a number of second-tier European security events lost editorial substance noticeably in 2025 and 2026. Agendas now lean toward sponsor keynotes, unmoderated panels, and executive roundtables that essentially qualify leads.<\/p>\n
That\u2019s not a verdict on the organizers \u2013 exhibitor business is a legitimate model \u2013 it\u2019s a verdict on the benefit for technical security teams. When more than 60 % of the agenda consists of vendor slots and independent researchers make up less than 10 %, the learning density a conference day needs is simply missing.<\/p>\n
Practical takeaway: such formats work as a one-day scouting visit for marketing, not as a three-day technical deep dive. Shift budgets accordingly.<\/p>\n
Must-Attend or Opportunistic: What Separates the Categories<\/h2>\n
\nMandatory events<\/h3>\n
- \n
- CFP with Technical Review Board<\/li>\n
- Practitioner-level training<\/li>\n
- Peer exchange in small formats<\/li>\n
- Independent research tracks<\/li>\n
- Documented zero-days or new techniques<\/li>\n<\/ul>\n<\/div>\n\n
Opportunistic<\/h3>\n
- \n
- Sponsor-heavy agenda (>60 percent)<\/li>\n
- Panels without moderated Q&A<\/li>\n
- Executive roundtables without Chatham House rules<\/li>\n
- Keynotes focused on strategy narratives<\/li>\n
- Analyst briefings behind closed doors<\/li>\n<\/ul>\n<\/div>\n<\/div>\n
The table is not meant as a quality judgment. Some opportunistic formats are ideal for market observation or nurturing existing vendor relationships. They simply shouldn\u2019t be booked under training budgets.<\/p>\n
Smaller formats with substance \u2013 the 2026 winners<\/h2>\n
Two years of data reveal a clear pattern: specialized and regional conferences are gaining ground, while mega-shows grow broader and shallower. Three formats stand out for 2026.<\/p>\n
OffensiveCon Berlin<\/strong> has long been the European gathering place for exploit developers and vulnerability researchers. Small, expensive per attendee, yet editorially unmatched. Anyone serious about offensive security keeps OffensiveCon on their radar.<\/p>\n
Troopers<\/strong> in Heidelberg remains one of Europe\u2019s few conferences that consistently prioritizes depth over breadth. Tracks on Active Directory security, industrial-control systems and cryptographic engineering reach a level rarely seen at large expos.<\/p>\n
FIRSTCON<\/strong>, the annual conference of the Forum of Incident Response and Security Teams, is the most relevant international event for CERTs and SOC leads. Rotating venues each year complicates planning, but the content justifies the effort.<\/p>\n
NULLCON<\/strong> in Goa, the traditional Asian counterpart to OffensiveCon, stays on the radar for 2026 as a spring event with a strong research focus. Only approve travel budgets if your team includes researchers whose work will resonate there.<\/p>\n
Event calendar 2026: verified dates<\/h2>\n
\n\n23\u201326 March<\/div>\nRSAC 2026<\/strong> \u2013 San Francisco, Moscone Center. Strategy talks, analyst meetings, international peer networking.<\/div>\n<\/div>\n\n6\u20139 August<\/div>\nDEF CON 34<\/strong> \u2013 Las Vegas Convention Center. Villages, hands-on labs, hacker community.<\/div>\n<\/div>\n\n27\u201329 October<\/div>\nit-sa Expo & Congress 2026<\/strong> \u2013 Messe N\u00fcrnberg. Essential DACH stop for procurement and compliance.<\/div>\n<\/div>\n\n7\u201310 December<\/div>\nBlack Hat Europe 2026<\/strong> \u2013 ExCeL London. Training and briefings are the real value, not the expo floor.<\/div>\n<\/div>\n\nSpring 2026<\/div>\nNULLCON<\/strong> \u2013 Goa. Annual spring event; confirm exact dates via official sources.<\/div>\n<\/div>\n<\/div>\nSources: RSA Conference, N\u00fcrnbergMesse, Black Hat (Informa), DEF CON. Status April 2026.<\/p>\n
Consequences for Budget Planning<\/h2>\n
The sober calculation for 2026: two mandatory global appointments per CISO per year (RSAC plus either Black Hat Europe or DEF CON), plus it-sa as the DACH anchor and one specialized conference per core topic (OffensiveCon, Troopers or FIRSTCON). This covers strategy, procurement, technology and community engagement \u2013 without burning the conference budget on events whose learning impact is questionable.<\/p>\n
When sending team members, brief them with clear learning objectives per track and require a short report. Three pages suffice: which techniques are new, which vendor claims can be independently verified, which contacts are relevant. This disciplines selection and turns conference travel into verifiable professional development.<\/p>\n
A second lever: rotate attendance. If three team members take turns going to RSAC instead of always sending the same person, knowledge transfer to the team increases. Otherwise, conference insights remain trapped with one individual and never reach the operational level. Adding internal 30-minute debriefs per returnee further multiplies learning impact \u2013 at no extra cost.<\/p>\n
A third lever: deliberate abstinence. Not every conference must be attended every year. If in 2026 you skip a large trade show and instead send two team members to OffensiveCon or Troopers, you invest the same budget for a markedly higher learning yield. The assumption that you \u201chad to be there\u201d is usually habit, not a decision.<\/p>\n
Virtual, hybrid or in-person \u2013 what works in 2026<\/h2>\n
Many organizers in 2026 offer hybrid formats with cheaper online tickets. For pure lecture consumption this works \u2013 talks can often be viewed weeks later in the media library at a fraction of the cost. What online cannot replace is corridor exchange: the chance encounters between sessions that, in an SOC team, often deliver more value than the booked track itself.<\/p>\n
A pragmatic split: senior roles travel on-site where networking and peer conversations justify the expense; junior roles use online tickets strategically for selected tracks, supplemented by team-based review of the media library. This combination frequently out-performs the traditional \u201ceveryone attends\u201d approach economically.<\/p>\n
As of April 2026 a pattern emerges: conferences that make their media library available quickly and completely signal confidence in their content. Those that artificially restrict or delay access often have less substance than their on-site marketing suggests.<\/p>\n
Bottom line for the current year: the security-conference market is differentiating itself more sharply than in previous years. With clear criteria, explicit learning goals and rotating attendance, you extract far more substance from the same travel budget. The rest is calendar management.<\/p>\n
Frequently Asked Questions<\/h2>\n
Every question is locked. A tap unlocks the answer.<\/p>\n
\nHow do you realistically assess the ROI of a security conference?<\/strong><\/summary>\n
A robust approach sets concrete learning objectives before registration, documents implemented insights after the event, and compares effort (ticket, travel, work time) against operational outcomes within the team. Not every conference must yield measurable output every year, but without this discipline the line between professional development and calendar maintenance blurs.<\/p>\n<\/details>\n
\nHow can you tell substance from marketing theatre?<\/strong><\/summary>\n
Look for technical depth in the program, practical demos instead of keynote slides, and speakers who come from day-to-day operations. A strong signal is when the media library is made available promptly and in full after the event. If organizers ration or delay recordings, their content is often weaker than the outward presentation suggests.<\/p>\n<\/details>\n
\nWhen do smaller, specialized formats pay off?<\/strong><\/summary>\n
When your team needs to build or deepen expertise in a specific domain (red teaming, cloud security, OT). Events like OffensiveCon, Troopers or similar deliver more hands-on takeaways than a broad trade show. The audience is narrower, but the per-participant benefit is typically higher.<\/p>\n<\/details>\n
\nWhat should you do with vendor halls if you\u2019re not buying anything new?<\/strong><\/summary>\n
Structured market intelligence is a legitimate goal: walking the floor with clear questions (current roadmap, integration depth, support quality) gives you a snapshot of the state of the art that informs RFPs and architecture decisions. Without guiding questions, the vendor hall quickly becomes a collection of swag.<\/p>\n<\/details>\n
\nHow to prioritise travel budgets when funds are tight<\/strong><\/summary>\n
Invest in senior roles on-site, where peer exchange and networking justify the expense. Allocate junior travel to targeted online ticket tracks, followed by team debriefs. Attend major trade shows on a rotation basis rather than every year. This blend often delivers more substance for the same budget than the usual \u201ceveryone goes.\u201d<\/p>\n<\/details>\n
\n<\/p>\nEditor’s Picks<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/03\/st-dsin-jahreskongress-2026-digitale-siche-250x211.jpg\")
<\/span>Editor’s Pick<\/span>DsiN 2026: Digital Security in a Connected Society<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/03\/st-cybersec-europe-2026-br-ssels-security--250x167.jpg\")
<\/span>Editor’s Pick<\/span>Cybersec Europe 2026: Brussels\u2019 EU Security Hub<\/span><\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"Which security conferences in 2026 deliver real value and where the ROI turns\u2014RSAC, it-sa, Black Hat Europe, DEF CON under sober editorial review.","protected":false},"author":50,"featured_media":12313,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"RSAC CISOs Substance","_yoast_wpseo_title":"Conference Radar 2026: Where CISO Budgets Meet Substance","_yoast_wpseo_metadesc":"See which 2026 security conferences deliver real value and where ROI drops\u2014RSA, it-sa, Black Hat Europe, DEF CON reviewed objectively.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[216],"tags":[],"class_list":["post-12617","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-events"],"evm_reading_time_minutes":12,"wpml_language":"en","wpml_translation_of":12314,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/12617","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/50"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=12617"}],"version-history":[{"count":5,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/12617\/revisions"}],"predecessor-version":[{"id":21592,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/12617\/revisions\/21592"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/12313"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=12617"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=12617"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=12617"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}