Guide to Black Hat (Updated for 2026)
August (5-6) Briefings and Business Hall
Mandalay Bay Convention Center Las Vegas
(1000$ for Business Pass, 3000$ Briefings)
This is the premier Cyber Security conference. It offers different types of entry packages. Buy early to get a discount or convince your work to pay (as they should).
Don’t bother driving here, take a Lyft or an Uber directly to the convention center so that you don’t have to slog through the heat. Don’t forget to grab your Black Hat backpack! Just like IP addresses we could run out at any moment. Be nice to the grandma handing them out.
Bring a water bottle, the water fountains will be cold but the sodas will be lukewarm at best (you will also have to contend with carrying around the little cups while looking for a trash can).
Navigating the Business Hall (Pass)
The Business Hall pass is the cheapest and most accessible and has the benefit of buying Def Con tickets as part of the package. The orderly experience of picking up your Def Con badge with people who just took a shower is worth the cost of the Business Hall pass. (Hint: do this as early as possible.)
Before going into the Business Hall take a moment to go up the first flight of stairs, carefully avoiding the Black Hat merchandise shop, and stop by No Starch Press Books. This is your chance to get a huge discount and stock up on books that catch your interest. No Starch Press books are great because they are not filled with fluff scraped from Stack Overflow after watching YouTube videos. Most everything you find here is great for hands-on learning and was already affordable even before the Black Hat discount. Oh-oh! Looks like your backpack already has a small rip in it, be careful putting in your purchases.
Walking into the Business Hall for the first time can be a little overwhelming. Steer for the quieter section that looks to be configured like office cubicles. But to get there you will have to pass the CISA booth. If you are early in your IT career CISA training and resources are invaluable and more importantly align very closely to some of the trickier questions you will be asked on your CISSP exam. No one is trying to sell you anything, instead you can learn about the different ways you can access the resources CISA has made available. I think the strap just broke on your backpack. Grab your CISA stickers and pamphlets and head further in.
In the quieter part of the Business Hall is a place for smaller companies but also houses all the organizations doing outreach at the event. ISC2, ISACA, CSA all will have a presence at the conference, but this is also a great place to find community organizations that help ease you into the industry. Blacks In Cyber Security, Women in Cyber Security, Latinos, Gays and Queers are all here. If you wear the right hat and make the right sign the Furries will come find you. Finding a community you feel connected with is like hitting the Jackpot, you now have a plan for Def Con and your chances of having an amazing time have exponentially increased. For the 600$ entry fee this could be the most valuable part of the Black Hat experience.
Besides communities and foundations, the rest of the booths will be made up of smaller vendors. If you see something that interests you don’t hesitate to engage with the people at the booth, this is why they are here and for a lot of the booths in this section this is the only conference they will attend. Don’t feel bad about asking for a demonstration with no intention of buying, showing interest is incredibly valuable at these conferences, everyone is usually very engaging.
There will be product briefings held in the center of the hall throughout the day, all of them trying to sell you something and unless the subject matter directly affects your job should be ignored altogether.
Finally, you are ready for arguably the most important purpose of the Business Hall: collecting your free swag. Do I need a rolled-up hat? Do I even know what a Kenji is? Who cares, it’s free! Stay away from the green-colored water and be careful filling your rapidly disintegrating backpack. Don’t for a moment feel uncomfortable grabbing free stuff from vendors you will never do business with. Think of all the free advertising they get when all this is filling the back of your closet.
Career/Job Opportunities
There are always companies hiring. Firing too and you never know when you need to find a new job. It is perfectly acceptable to use the Business Hall to scout potential employers. It is also perfectly acceptable to send out your resume after the event especially if you tailor it correctly to focus on what would make you useful to that specific company. You can spend a few minutes hanging around a booth and get a pretty good idea of the company culture and it is absolutely ok to ask “Are you guys hiring?”. There are various levels of executives at the event, every major player will have someone handling recruiting duties and you will often see recruiters walking around. Don’t worry about handing out your resume, grab a card and let them scan your badge, wait 2 weeks or so after the event and start to reach out.
Take the time to learn the major players and at least a general sense of their products. Taking notes is difficult when you are walking around a crowded convention floor with a bunch of swag and a ripped backpack but do your best, grab business cards. If you are very new to the industry a one-time Business Hall ticket can end up providing quite a bit of value if you approach it with the right attitude and some planning.
Value of the Business Pass 3/10
$1k, if out of your own pocket, is hard to recommend. There is certainly value to be had but unless you have never been to Black Hat and simply want to pre-purchase a Def Con badge the cost is prohibitive. If this is your first time and you believe you will be back next year for the Briefings AND you are looking for a community to join or doing some serious job-hunting the value rises, but only as a one-time experience.
Briefings Pass
This is the more expensive ticket and hopefully your employer paid for it. The quality and in some cases the necessity of Black Hat briefings have been debated for some time but if you are prepared there is value to be had.
Don’t worry about talks being packed, the facilities are roomy with excellent air conditioning. Learn where the talks are, there are 3 floors and while it’s only a 5-minute walk at most, the halls are filled with people, and it can get a little chaotic on the main stairwell. The event app will become active the week before, use this to plan your itinerary and schedule the talks. The app allows you to review the presentation and I can’t stress how important that is for the presenters. If you enjoyed the briefing, please add positive feedback and review in the application, it matters.
Planning is key as you want to minimize the amount of walking you must do between sessions while collecting the maximum amount of Continuing Professional Education units possible. You will have to choose from a selection of briefings in roughly one-hour windows with each briefing lasting about 40 minutes. Sometimes the briefings that interest you will be on opposite sides of the venue. Avoid FOMO! All the briefings will be available online after the conference, including all the slides – you don’t have to worry about two briefings overlapping.
Try to avoid the obvious sales pitches but be careful to dismiss a briefing by title alone. If you had to deal with privacy and compliance “Hot Topics in Cyber and Privacy Regulation” was very insightful and valuable.
Try to attend briefings that are related to your current job activities, including those that might be categorized as Policy. More specifically, look for talks given by CISA as these will be targeted at a broader audience.
There will typically be a couple of briefings labeled as Community & Career, if these are of interest, they will always have an opportunity to engage with the presenters at the end, but you will have much better luck finding career opportunities in the Business Hall.
There are going to be talks where 15 minutes in you are either going to realize it’s a disguised sales pitch, or you are being briefed on something so outdated as to be completely useless. Rarely, but occurring alarmingly more often at Black Hat, are talks that are just straight bullshit coughcryptographic agilitycough. It’s perfectly okay to get up and leave if you don’t feel like the briefing is useful to you.
Just like with BSides I don’t recommend you record or try to take extensive notes. Do engage with the presenters, especially if you have a legitimate question or concern. Wear light clothing and comfortable shoes, bring a water bottle if you can squeeze it into your Black Hat backpack without ripping it in half or you will have to use little paper cups. Eating depends on your tolerance for bad fast food and medical requirements. The food court is very close by but will be packed throughout the event and I recommend bringing a snack and waiting until after the conference to eat. There is plenty of room to relax and pull out the old ThinkPad but carrying around that extra 10 lb. really starts to get tiresome and is usually unnecessary.
Socializing during briefings is tough. A lot of people are already in groups, and everyone has a set schedule and somewhere to be. Instead, this is a time to connect with presenters and projects. Large industry players will have a very strong presence and you get to talk to guys like Adam Stuart from Microsoft who is responsible for a ton of the information coming from Microsoft Learn efforts. Google, Amazon and just about everyone else will be there.
If the presenters are not trying to sell you something (however overtly), they are likely trying to get you involved with something. Projects that made it so far as to be presented at Black Hat have room for just about any type of contributor and even highly technical projects need plenty of peripheral support.
Briefings Pass Value 7/10
There are still excellent briefings happening at Black Hat and you can quickly get caught up on all the topics that you can’t focus on throughout the year. There has also been an alarming drop in quality, and this dates to well before COVID. There have been talks where the information was straight up nonsense, on niche topics where the presenter either didn’t expect an expert to be listening or didn’t care. There were talks where conclusions were tenuous or more likely useless and not actionable.
CISO Summit
This is an approval-only event that costs an extra 1k to attend and supplements the Briefings with an additional day of talks. I have never paid for this out of pocket and have never heard of anyone who has; it is always sponsored or paid for by your employer. Just like the Briefings the value you get out of the Summit depends greatly on your preparation and attitude. If you are an independent contractor, MSP or a decision-maker of a company selling cybersecurity products or services you can pick up some incredibly valuable insight. You also have direct access to individuals that is not possible through a Zoom call for a product demo. You can ask questions that would not get answered in another forum. Often policy decisions that could affect the entire industry are discussed by presenters with first-hand knowledge and influence. On the other hand, some years the entire day is spent listening to nonsense where you truly understand the meaning of someone “Pissing in your pocket”. The value of attending varies, but I will say that in all cases the Summit is better when attended with a friend. Think of it as a “Moving the Couch” type of thing, a hell of a lot easier with two.
Training Sessions
August (1-4) Black Hat August 6-8 for Def Con Around 4-5k for Black Hat, 2-3k for Def Con
Trainings are specialized sessions that take place over the course of two or three days prior to the actual conference. They cost an additional fee, usually several thousand dollars and focus on one specific area of practice.
These sessions are led by expert professionals who guide you through a carefully prepared “boot camp” style experience that focuses on practical, hands-on learning. Some training sessions have been going on for years and have a tightly tuned process to first present and later reinforce the processes and methods taught. The best ones will have a strong support system in place before, during and after the session. I can’t stress how important the “before” part is, look for sessions that verify the minimum knowledge level required as well as those with detailed descriptions of the course and the environment.
If your employer is covering the cost, these are a no-brainer. Pick a session that most benefits your current work process. Look for skills that will benefit your team and advance your career. A lot of training sessions will focus on a specific attack or defense vector, I recommend starting with sessions that focus on generalized defense. “Defending the Enterprise” is a yearly session that gives you current and, more importantly, actionable insights that you can implement in nearly any scenario.
Be prepared. Time is very limited and if you have not completed the prerequisites or don’t have a handle on the subject matter things get out of hand quickly. Every training offer will have a detailed description of the prerequisite skills you must have to participate. You may also have to prepare your own operating environment for the session, like setting up and configuring a cloud subscription on Amazon or Azure. Be ready to interact via CLI only; use whatever shell the instructor expects you to use. You can, and should, ask questions but you are expected to meet the minimum knowledge requirements.
Learn to take notes. You are going to have to take notes quickly and in different environments, sometimes you are saving snippets of code, sometimes a link. Sometimes you are just writing a reminder to yourself about some interesting technique. Depending on the session, expect to spend your evening organizing notes and trying to train muscle memory to log in and authenticate faster. It helps to have a system to organize your notes, Obsidian is one of many options, but the most important thing is to take notes and not rely on your memory or the provided documentation. I mention Obsidian because you can quickly create links to information you haven’t collected yet, giving you a good idea of things that you will have to research on your own time. Regardless of the quality of the training sessions, every single one needs to be reinforced by practice.
Since everyone has the same interests, socializing is easy and natural, but also optional and some people prefer to focus on training and keep to themselves. Sessions that require teams or cooperation will state so in the description. A lot of the sessions last 2-3 days and even then are very condensed, being in Vegas makes it super easy to get together after the session to review and practice.
Training Value : Some 10/10 some 3/10, mostly 7/10.
There are a couple of training sessions that cover the keystones of a topic so well that you leave with both competence and confidence to continue without handholding. These sessions will leave you with a clear sense of direction and enough “homework” to reinforce what you learned. They will have a community you can join and will continue to offer support. These are what I consider 10/10.
Most training sessions have been returning for many years and most will be very good if not 10/10. Being absolutely clear about the requirements is key, the most common cause of disappointment is not being able to keep up with the session because you don’t have the prerequisite knowledge or, worse, didn’t do the required steps to set up the required environment.
There have been a few, rare, training sessions that left me disappointed. If the presenter is excited about the latest techniques that will make your blue team oh so excited and pulls out Windows Server 2000 you are free to ask for a refund.