# Speaking at cybersecurity conferences: Topics, calls and credibility

Author: Marin Niehues, Stage Starter · Published: 2026-07-23
Topic: Finding Conferences (https://www.stage-starter.de/en/blog/topic/finding-conferences/)
Source: https://www.stage-starter.de/en/blog/speaking-at-cybersecurity-conferences/

You become a speaker at a cybersecurity conference with a talk that shows your own research or documented practice and contains no product pitch. Most security conferences fill their programme through a call for papers, the public call through which a conference collects talk proposals. Their committees are among the strictest of any industry, because their audience spots every exaggeration at once. This article explains the types of security conference, the topics that get accepted and the rules by which credibility is earned.

**On security stages, evidence is what counts: a reproducible result, an incident worked through in detail or a measurement from your own operations. If you sell consulting in this field, most of your clients sit at conferences attended by people responsible for security in companies.**

## What types of cybersecurity conference are there?

Cybersecurity conferences fall into five types: research and hacker conferences, community conferences, trade fairs with talk forums, summits for security leaders and the security tracks of industry conferences. Each type has its own audience and its own route into the programme, and for consultants they differ above all in how many decision makers sit in the room.

Research and hacker conferences such as Black Hat in Las Vegas look for new technical findings on vulnerabilities and attack techniques. Selection is in the hands of a review board of practitioners who check every submission for novelty, depth and accuracy. The Black Hat call explicitly excludes product and vendor pitches. Community conferences such as the BSides events held around the world grow out of the local scene, cost little or nothing and accept people without a speaking history. BSides Las Vegas runs a dedicated programme that pairs first-time speakers with experienced mentors over several months.

Trade fairs such as it-sa in Nuremberg combine an exhibition with a talk programme. Exhibitors give a large share of the talks on their open forums, alongside vendor-neutral sessions from associations and organisations and an accompanying congress. Summits for security leaders address CISOs, the heads of information security in companies, and fill their programme mainly through invitation and partnerships. The fifth type is the security tracks at conferences for banking, healthcare, energy or manufacturing. Their audience has to solve security questions in its own field, and for consulting this is the stage with the highest density of potential clients.

**Security in the conference market**
- 86 conferences | with security as main topic and an open call
- 289.2 bn euros | damage to the German economy in 2025
- 87 per cent | of companies surveyed were affected

The first figure comes from our analysis of 2,415 conferences publicly advertising speaking slots for 2026, and it equals 3.6 per cent of them. On top of these come 281 conferences on cloud and DevOps, where security talks regularly make the programme. The other two figures come from the Wirtschaftsschutz 2025 study by the German digital association Bitkom, covering 1,002 companies, according to which 70 per cent of the damage stems directly from cyberattacks and 72 per cent of companies rate the threat level as high. With this situation, companies increasingly need talks that show what works when an attack happens.

## How do programme committees judge the credibility of a security talk?

Programme committees judge the credibility of a security talk by three things: the evidence, vendor neutrality and the responsible handling of sensitive information. A programme committee is the group of experts who read all submissions and put the programme together. In security it often consists of researchers and practitioners who speak on stages themselves and test every claim against their own knowledge.

Evidence is the strongest criterion. An abstract, the short description of the planned talk, convinces when it contains a verifiable statement: a vulnerability that was reported and fixed, the analysis of a real attack, measurements from a detection programme or the cost of recovering from ransomware, an attack in which data is encrypted and released only for a ransom. Certifications in your short bio show training, and a committee rates documented work higher than any letters after your name.

Vendor neutrality is enforced more strictly in security than in almost any other field. Committees recognise advertising by a product name in the title, by a problem that only your own tool solves and by scaremongering without figures, known in the scene as FUD, short for fear, uncertainty and doubt. In earlier calls, Black Hat Europe even announced that a blatant vendor pitch could cost the speaker the honorarium and future speaking opportunities. Where the audience draws the line is described in [Expert talk or sales pitch](/en/blog/expert-talk-or-sales-pitch/).

The third point is responsibility. A talk about a vulnerability counts as serious when the vendor was informed beforehand and had time to fix it, a practice known as coordinated disclosure. Case studies from client work must be anonymised so that no client can be identified, and many organisers use the Traffic Light Protocol, a four-colour label that sets how far information from a session may be passed on.

**Law and confidentiality**
If you show attack techniques or tools on stage in Germany, you are operating near section 202c of the German Criminal Code, which penalises preparing to spy on or intercept data. Case studies are governed by the confidentiality agreements with your clients, and written approval before submission protects both sides. This article provides an overview and does not constitute legal advice.

## Which security topics do programme committees accept?

Programme committees accept security topics that link a current problem with your own experience, and they reject general threat overviews the audience already knows from the press. On corporate stages, these include reports on the response to a real incident, on building detection with measurable results and on securing supply chains. Since the German law implementing NIS2, the European directive on network and information security, came into force, many companies have been looking for talks on how the new obligations work in day-to-day operations.

A growing field is the security of AI applications. Committees are interested in prompt injection, attacks in which manipulated inputs push a language model into unwanted actions, and in how companies secure AI assistants that access internal data. Equally in demand are OT security, the protection of control systems in manufacturing and energy supply, and identity management, because a large share of attacks start with stolen credentials.

Research conferences apply different standards. A talk there needs a new technical finding, and a consulting experience report, however good, rarely finds a place in that programme. For consultants who want to win clients, industry conferences and trade fair congresses are therefore usually the more productive stages, while research conferences bring standing in the professional scene.

**A security topic makes the programme when it shows a problem the audience has to solve right now and an experience it can adopt. The more concrete the evidence in the abstract, the lower the risk the committee takes with the person.**

## How do you get on a security stage in front of decision makers as a consultant?

As a consultant, you get on a security stage in front of decision makers by tailoring your topic to the audience's perspective and submitting where people responsible in companies sit. A conference for hospitals wants a talk on how a clinic restored operations after an attack, and the technology behind it stays in the background there. At a developer conference, by contrast, the code carries the session, and the same knowledge needs a completely different version.

This tailoring takes work, because each type of conference demands its own titles, abstracts and examples. Deadlines run throughout the year as well: in our analysis, the median gap between the end of a call and the start of the conference is 50 days, and if you only learn about a conference when its programme is published, you wait for the next edition. How a call for papers runs from submission to acceptance is explained in the guide to the [call for papers](/en/blog/call-for-papers-guide/).

[Stage Starter](/en/) takes this work off your hands: we find the right calls, write the submission and submit it. That includes tailoring your topic to industry conferences, trade fair congresses and community stages, an ongoing search for security tracks in your clients' industries and following up until a decision is made. You provide your expertise, decide which case studies stay confidential and approve the talk and abstracts. What the work covers for this field in detail is set out in the article on the [speaker agency for cybersecurity experts](/en/blog/speaker-agency-for-cybersecurity-experts/).

For our clients' submissions we reach up to 19 per cent acceptances per conference, while 5 per cent at most is usual in the market for this volume of submissions. The basis is 2,189 submitted abstracts, of which 94 of the 1,374 decided were accepted. The chance of at least one acceptance from n submissions at rate p is 1 − (1 − p)^n. For eight conferences that gives around 34 per cent at 5 per cent and around 81 per cent at 19 per cent. No agency can guarantee an acceptance, because the programme committee decides.

## What does a speaking slot at a security conference cost?

A speaking slot through an open call for papers costs you nothing beyond preparation and travel, while a slot bought as part of a sponsorship package quickly costs 10,000 euros or more for a single speaking slot. Bought slots are common at trade fairs and summits, because exhibitors and partners acquire part of the stage time with their package. These sponsored sessions are often not labelled as such in the programme, and a security audience still recognises them quickly by their content. When such a slot pays off is covered in [Sponsored talks and pay to speak](/en/blog/do-speakers-have-to-pay-for-the-stage/).

**Routes to the security stage**
Aspect | Submitting yourself | Pay to speak | Stage Starter
Cost | your working time, week after week | quickly 10,000 euros or more for one slot | from 990 euros net per month for the whole operation
Stages | the conferences you find yourself | trade fairs and summits with partner programmes | industry conferences, trade fair congresses and community stages your clients attend
Credibility | selected by the committee | bought slot, often recognised by the audience | selected by the committee

For consultants, the route through the committee is the stronger one, because selection by independent experts confirms the credibility that matters in security. A single contract from one appearance is worth more than the price of a sponsorship package and more than any fee an organiser could pay.

**You get onto a cybersecurity conference stage with an evidence-based talk free of product pitches that handles sensitive information responsibly. Clients for consulting sit mainly at industry conferences and trade fair congresses, and each of these stages calls for its own version of your topic.**

**Sources**
- Bitkom: Wirtschaftsschutz 2025 study, survey of 1,002 companies in Germany, presented in September 2025.
- Stage Starter analysis: 2,415 conferences publicly advertising speaking slots for 2026, plus our own submissions for clients.
- Organiser information on the calls of Black Hat and BSides Las Vegas and on the it-sa programme.

## Frequently asked questions

### How do I become a speaker at a cybersecurity conference?

You become a speaker at a cybersecurity conference through a submission to a call for papers or a direct request to the organiser. What matters is an abstract with verifiable evidence, such as a reported vulnerability, an incident worked through in detail or measurements from operations. Most security committees reject product presentations in the first round.

### Do I need certifications like CISSP to speak at a security conference?

You do not need a certification to give a talk at a security conference. Committees assess the content of the submission and the documented work of the person. Certifications can appear in your short bio and show training, yet they do not replace evidence in the abstract.

### Which security conferences suit a first appearance?

Community conferences such as BSides and the security tracks of industry conferences suit a first appearance. Many BSides events explicitly welcome first-time speakers and some run their own mentoring programmes. Industry conferences add the advantage that potential clients sit in the room.

### Can I give a talk as a vendor of a security solution?

As a vendor you can give a talk if it helps the audience even without your product. Black Hat explicitly excludes product and vendor pitches in its call, and other committees act similarly. A report from a client project with transferable insights, on the other hand, stands a good chance.

### May I talk on stage about incidents at my clients?

You may talk about incidents at clients if the client has agreed or the example is anonymised so that nobody can identify them. The confidentiality agreements from the engagement are decisive. This article provides an overview and does not constitute legal advice.

### Are speakers paid at security conferences?

Speakers from an open call receive no fee at most security conferences, but often a free ticket and sometimes travel costs. Some large research conferences pay an honorarium, and invited keynotes are paid at summits and corporate events. For consultants, a contract from the audience is worth more than any fee anyway, as the article on [speaker fees](/en/blog/speaker-fees-guide/) shows.

### How many security conferences with a call for papers are there?

In our analysis of 2,415 conferences publicly advertising speaking slots for 2026, 86 have security as their main topic. On top come 281 conferences on cloud and DevOps as well as the security tracks of numerous industry conferences and trade fairs. Our database covers around 22,700 conferences in total.

### Do I have to hack live at a security conference?

Live demonstrations are common at research and hacker conferences and the exception on industry stages. In front of decision makers, a clear account of how an attack unfolded, its cause and its consequences works better than a demonstration. If you do show something live, keep a recording ready as a fallback, because the network on site is rarely under your control.

Whether your security topic and your target clients fit the stages we submit to is something we clarify in an [initial consultation](/en/erstgespraech/).