How to Maximize the ROI at Cybersecurity Conferences

Aaron Crow (0:1.218): Hey everyone, excited this week. It's a big week. It's it's hacker hacker summer camp Black Hat in Vegas as well as Defcon. What 40,000 security professionals or people at least in one one place. And let's dive into all that that is. I've been going to Defcon and Black Hat for years now. I don't even remember when the last time or the first time I went.

Aaron Crow (0:29.582): I it was back maybe in 2012, something like that. I don't exactly remember. I don't have all of my badges anymore. I've moved and gotten rid of most of them. But this week I'll be in Vegas starting Monday through the end of the week. I'm actually not even gonna be on the floor at Black Hat. I'll be hanging out around going to vendor events, House of Blues.

Aaron Crow (0:57.802): for the Morgan Franklin Cyber Lounge. And then during DEF CON, I'll be at ICS Village and, you know, kind of making the ways around things. The cool thing with this, there's a lot of great, good, bad and ugly. So I kind of want to dig into it. I've seen a lot of posts of people talking about Black Hat and DEF CON and conferences in general, really. Cyber security is a big business, obviously. There's a lot of

Aaron Crow (1:27.372): value, there's a lot of need from new products, capabilities, functionality, training, people, process, all the things. So let's dive into some of the cool stuff, the good stuff, the bad stuff, the ugly, et cetera, right? So the good, right? So every year, some of the things that I really enjoy and look forward to is reconnecting with friends and connections and coworkers and counterparts.

Aaron Crow (1:56.850): even, even those that, you know, competitors and, people that I used to work with or used to work adjacent to or for et cetera. it's, it's there's what, again, we talked 40, 50,000 people that are in Vegas this week for this event. Obviously there's more than that in Vegas, but for this event, and it's really great to see so many people, in this space, be able to connect, have, have a drink, have, have lunch, you know, even if just a five minute conversation.

Aaron Crow (2:24.910): and see people in real life. Events like this, anytime you're at a conference, type of stuff, getting out of the Zoom bubble, meetings, the normal emails, Slack, Teams, whatever, just doing something different. These weeks are super tiring and exhausting. Just standing, walking, obviously in Vegas you walk a lot, but there's a lot of value that came out.

Aaron Crow (2:52.968): networking is huge. talk about it all the time. Network is vastly important, right? Whether you're looking for a job or eventually you're probably going to be looking for a job or you're going to be looking for an opportunity or you're going to be looking for a new product, you're going to be looking for a new capability, you're going to be looking to hire someone like any of those things can be true. And that's why networking is so important. Like you build this network of connections and you build build people.

Aaron Crow (3:17.674): and you never know when you're going to have to pull on that for, somebody that's had an experience in this thing that you're needing or has a, has a resource that may be value add, et cetera. Right. So, you know, there's, there's a lot of random conversations. There's a lot of, really, great conversations. There's a lot of fun events, et cetera. Right. So vendor events are everywhere. Like you go to Vegas. Yes, it's expensive, but deer and black hat, there's things going on at all times, morning, noon, evening, lunches.

Aaron Crow (3:47.042): dinners, practices, tabletop exercises, round tables, parties, all sorts of stuff. So there's a lot of events that actually provide value. There's a lot of events that are a lot of hype and kind of everything in between.

Aaron Crow (4:10.656): Switch up to Defcon. Obviously, Black Hat and Defcon are two ends of the spectrum of two different types of events. Black Hat being very specific, corporate, polished, sales focused, product evaluations and marketing and all the things. And Defcon is exactly the opposite of that. Your badges don't have your name on it. Nobody can scan you. Nobody's going to be sending a message to you about it.

Aaron Crow (4:38.694): If you want to reach out to people, have to get their information and they'd have to give it to you. There's a lot of people that come to that that aren't in cybersecurity that have nothing to do with cybersecurity. It's a cool party or their friends are in it or whatever. The cost is there or the cost is so low that people come from all over. And that's great. We want that excitement around cybersecurity. then events like or

Aaron Crow (5:8.462): places and organizations like ICS Village, like all of the villages that are at DEFCON. They're amazing because they're nonprofit, they're community driven, people like me and others that volunteer their time to speak, to talk to people and kind of share our knowledge and experience. ICS Village focusing on OT and industrial cybersecurity. We are able to talk to you.

Aaron Crow (5:38.446): Every year when I go, I'm talking to people that have never experienced OT. Many of them have heard of OT, maybe they've seen it in the news, but they still don't really grasp or understand it. I've had heated debates about how OT is no different than IT. And if you've heard my podcast, that's just not how I feel at all. And so many don't, but I'm okay having those conversations and helping people to understand why we feel it's different and how it's different. And they're not wrong in that the T, the technology side is the same.

Aaron Crow (6:7.734): or very similar in a lot of the spaces. Sometimes it's exactly the same. Sometimes it's the exact same equipment. It's just in an OT space. But that's not the conversation we're having today. So let's dig into some of the bad. Vegas in the summer, in August, it's hot. It's miserable. You don't want to go outside. You're walking a ton. Everything. Vegas used to be affordable.

Aaron Crow (6:33.130): restaurants and food and entertainment and hotels and everything was really, really affordable. It is not that anymore. It is, it is so expensive. you know, it's impossible to get a hotel room anywhere near, you know, where the event is for black cat, at least for me, maybe if you book now for next year. but you know, I'm not staying at Mandalay Bay. have, I don't think I've ever stayed at Mandalay Bay in any of these times. Usually it's halfway down the strip and having to walk or Uber, which gets old and tiring.

Aaron Crow (7:2.030): If you want to run back to your room, things like that, that gets frustrating. It's one of the things I don't like about this conference. RSA is the same, but other conferences, know, when you have it at a big venue or an attached hotel, that makes it easier. You can run up to your room, you can drop stuff off, you're not having to walk outside. And again, in August in Vegas is hot. It's one of the reasons, unfortunately, we were hosting another Lone Star Cyber Shootout.

Aaron Crow (7:31.054): in Vegas, but that didn't happen. We had to push that out. Part of it was, you know, we were concerned about the heat. Some things came through and things out of our control made us where we couldn't do it anymore. But we are still going to do one in Texas again in October. So if you're interested in that, definitely reach out. The other bad stuff, you know, just there's so many people, so many people go to Vegas. So many people go to Black Hat.

Aaron Crow (7:59.640): But what's the ROI? I remember as an asset owner, when I was working for a power utility, having to justify going to this thing, right? We have very little budget for that type of thing, right? Basically, was considered training. So I did the training stuff with Black Hat, took courses, things like that. And that was how I justified it. But it was a difficult one, right? It's expensive, it takes a lot of time. I was gone for, you

Aaron Crow (8:28.938): Almost a week. Actually, I think it was more than a week because I think the training was two days even before the floor open. But still there's, I had to really justify that ROI, which obviously I went to the, the, the, speaking engagements in the, in the training. So that's a value add, but so many people just, they do lobby con kind of like I'm doing this year, or they're just in the, in the expo. So they just go on, on the floor.

Aaron Crow (8:53.070): So what's the ROI there? If you're looking for a particular product, sure, you could talk to those folks, but you could talk to those folks anytime. So what is the value of, of black hat or, or just conferences in general, not to call out black hat specifically, but black hat's just a really, really big one. Um, you know, let's, let's talk about the next thing is, is all the vendor spaces. Um, and again, I, I've been a vendor, I've had booze, um, at conferences. You go to these places, they have all the t-shirts and swag and, and, hats and.

Aaron Crow (9:23.254): whatever the thing that they're doing. So they scan your badge, which means you get put into their CRM, which again, that's the reason they're there. Again, I am a vendor. I understand it. At the same time, just because I scanned for a pair of socks for my daughter doesn't mean that I want 17,000 text messages and phone calls and emails, et cetera, right? So it's gotta be a mix of those things. We can't say that we don't want

Aaron Crow (9:52.778): any vendors, because if the vendors aren't there, then the vendors are, then the event doesn't happen. The vendors are the reason why their sponsorship makes it possible for Black Hat to exist and big conferences like that to exist. So that has to be there and they have to get ROI on it as a vendor. And this is the thing. And I think I see a lot of CISOs posting and just cyber people, it's so annoying. get all this stuff. You have to realize like if there's no ROI for them, if there's no value, if there's no way that they can get a lead, a contact,

Aaron Crow (10:21.350): an opportunity from this, they're not going to go. We have this conversation every event when we're looking at potential sponsorship or even just attendance. What is the value for me as a vendor to show up at this place? Is it going to turn into what is the ROI? How do I justify sending a team, especially if you're talking about Black Hat and sponsorship, multiple tens of thousands of dollars, know, some of these places, you know, I don't want to call it by name, but some of these vendors are spending

Aaron Crow (10:50.070): millions of dollars on these things. So there has to be an ROI for them to be able to get to justify going right. You getting new logos, getting new opportunities, booking demos, you know, getting leads, et cetera. Right. So we have to take that. It has to be part of it again, or they won't, they won't come back and then black hat won't exist or any conference like that. Well, so there's a lot of talks at black hat and

Aaron Crow (11:19.234): People go to them, I know they do, I have in my past, but I've really stopped going. Again, this year don't even have a Black Hat ticket, but most years, even when I did, maybe I go to one or two talks, but it's just so busy that week. I don't have the opportunity and really time to dedicate to that. And a lot of folks that I talk to don't really go to the talks, unfortunately. I think that they...

Aaron Crow (11:49.368): that could be a good value add. And I think they are a value add. It's just about how many people are actually going to the talks. How many, what ROI as an attendee are you getting? You know, we talked about some of the good, amazing things, you know, connections and networking and, know, absolutely on the, on the vendor floor, you know, seeing the, the, the, the products that they have doing an in-person demo, meeting people in person and hearing it beyond just, you know, a sales call or what's on their website. That's hugely valuable.

Aaron Crow (12:18.056): But the talks are too. know, what is, what is the ROI? And that kind of goes into the next thing of, of leadership, right? Cyber, CISOs, executives, et cetera. Most of them don't go. And if they do, they're probably not sharing that they're a CISO. And that's just because they get bombarded. If, a CISO walks into your booth and it has CISO on their badge, they're just going to get mobbed. and they don't want.

Aaron Crow (12:45.382): So usually they'll not tell anyone. Now obviously people may know who they are, but they're not going to advertise, hey, I'm a cyber executive. I have leadership. have decision-making power, et cetera, authorization, because again, they'll just get attacked. Again, that goes back into the the cold sales calls from a t-shirt scan. I guess the biggest thing.

Aaron Crow (13:11.416): That's every year. This is every conference. Again, this is not just a breakout or beat up on, on black hat specifically, but it's, it's the drinking from a fire hose of hype. you know, this year I'm sure it'll be AI zero trust cloud, you know, all of the buzzwords, you know, quantum, blah, blah, blah, blah, blah, blah. they all have it. Everybody will have an AI thing on their marketing because that's what everybody's looking for.

Aaron Crow (13:41.410): Most in my experience, most products that even many of them, I won't say most, that's not fair. Many of them that have AI or whatever the buzzword is, it's a bolt on or it's a what's the value in it, right? Some of them obviously are AI native. They are focusing on those things and there are real products that have real real value. But again, most of them are just hyping. yeah, we've got AI. Yeah, we've got a chat bot. Yeah, we've got this. We've got that like OK, but did it really?

Aaron Crow (14:10.860): What is the huge value? And just adding AI doesn't necessarily make it better, as we've seen with recent episodes I've even talked about with the SharePoint attack. there's AI adding these types of things adds risk. It adds an attack vulnerability, right? So just because it can have AI doesn't mean it should have AI. It's like the IoT thing. Do I really need my refrigerator to have a screen and be able to connect to the internet? No.

Aaron Crow (14:40.704): really don't. I don't really want my fridge to connect to the internet. I don't want to have to patch it. I don't want to have to update its firmware or its bios or anything like that. Right. I'm, good with just a regular old toaster that I hit the button on. I don't have to schedule it from home or from remote. Right. I, when I'm doing toast, I have to get up and put the toast in there anyways. So until I have a, a, a, you know, AI bot that actually goes and makes my food for me and does everything, then I I'm good with what I've got.

Aaron Crow (15:10.432): Security FOMO. It is real. And it's, it's also fake. You know, there's a lot of fear going on. There's a lot of fear selling, you know, the end of the sky is falling, all the things. The unfortunate thing is, the security is, is a risk. It is, it is real. Like we see real events that are happening all the time. And also cyber vendors take advantage of that and they oversell, they over fear sell.

Aaron Crow (15:40.086): right? And they, the sky is falling nation state attackers, the end of the world, you know, obviously I'm being a little dramatic, but you know, it is, it is thrown out there. and, you know, you have to buy this because you're losing everything if you don't. Right. So, there's, there's a lot of non-technical people, which is great.

Aaron Crow (16:4.174): And also where are the technical folks, right? You know, I was, I was just talking with cam this week. Uh, the last episode I had with, with cam from, from, uh, um, we were talking through, like, what would it look like if we had a non-conference conference, one that was really technical, you know, a reset con in, uh, Savannah, Georgia is, is one of those, right? It's very deeply technical, um, less on the sponsorship side, more on the, on the conversations.

Aaron Crow (16:33.352): But what if there was a roundtable conference that everybody sat down and talked through things? You know, no vendor pitches, no bullshit panels, know, no, you know, celebrity speakers, just you and me and others sitting around and dialoguing around the issues and the value and solutions and problem statements and all, you know,

Aaron Crow (17:0.468): in interconnections, all of those things, that would be an incredible thing, right? So it just doesn't happen. It doesn't exist. And part of that is because, like I said before, how do you have a big event like that? You have to have sponsors and for sponsors to want to show up, there has to be an ROI. And if there's no, if they can't pitch, they can't get leads, why are they going to show up? So that's a hard one. Again, we've, we've, we've cracked that, that problem with our, with our events. And the way we do that is we have our

Aaron Crow (17:28.352): our sponsors sitting next to to the, their, their target audience. They're not selling to them. They're making connections with them. Hey, I'm, I'm so and so from vendor a and vendor a does blah, blah, blah, blah. Well, you're hanging out with those people all day long. You're not selling to them. You're making connections. You're making friends. You're having conversations. You're doing activities. You're eating lunch. You're having dinner, like all of these types of things during out the day. And then when they, at the end, Hey, they know that you sell whatever, firewalls or routers or switches or

Aaron Crow (17:58.190): AI software or whatever those things are. They've already got a connection with you, so if they need that thing, hey, I'm going to reach out to Bob because I had a conversation with Bob. I like Bob. Bob didn't try to sell me on things, but I know Bob does this stuff, so I'm going to reach out to Bob because I have a problem with XYZ and his problem is his product or solution or service or whatever solves that problem. So I'm going to reach out to him. Maybe I reach out to 15 other people too, but I definitely want to reach out to Bob because I know Bob.

Aaron Crow (18:24.108): Right. So that's the value for me is that's the connection. That's the way that I like making, you know, sales calls. I'm not your traditional salesperson. It's all it's all relationship and focused on that. Right. The connections, the experiences that I've had, the network that I've built. That's that's the way that that that, you know, I see the future of how do we make this better? Again, not that it's bad, just how do we make it better? You know, some of the hard questions that I think we should be asking, like

Aaron Crow (18:54.282): Why are vendors spending millions of dollars on booze with no measurable impact? Again, I'm with the CTO of a software company, know, senior director at a consulting firm, senior manager at another one, you know, all the way down to, you know, when I was an asset owner, right? Why, how, how do I justify going to this event? And we all have to justify, no matter which, which hat we're wearing, we have to validate and justify why, why are we going to go? And again, as a vendor, if I'm going to spend

Aaron Crow (19:25.766): $10,000 $100,000 a million dollars there has to be measurable value to return Otherwise, it doesn't make sense. I'm just burning money throwing it out the window And if it didn't make sense, then nobody would go and again if the vendors don't go then then there won't be a conference So what what would a non-conference model look like that actually delivers value? The idea that that came and I came up with it the other day. probably shouldn't be sharing it but you know it's it's

Aaron Crow (19:53.952): What if we had tabletops? What if we had, you know, the, the Lone Star events that we run where we're just, sending value. We're just showing up and having conversations. We're just showing up our Lone Star events. It's, it's, it's about the connections. We, we tell vendors that are sponsoring with us. Like you are not going to get up and give a presentation. Like you can give up and tell a story. You can get up and tell a use case. You can give up and tell a meme, like whatever.

Aaron Crow (20:22.520): but you're not going to pitch. You're not going to sell. You're going to show up and you're going to make connections. And if you do that and you're, and you're truly intentional about that, we've shown that vendors have come out the other side and gotten deals, have gotten leads, have gotten conversations and demos and all of that without having to sell. Now you can't send your junior person there to do that. It takes, it takes the right capability and skillset to do that. But that, that drives value. What other ways could we do conferences?

Aaron Crow (20:52.326): or whatever you want to call it, that can deliver value. And again, it has to be for all things. It can't just be for the end user, because who's going to pay for it? Because again, going back to my Lone Star events, like we make our attendees pay, which is sometimes uncommon for these types of events. You you go to Black Hat, most CISOs are not paying. Some sponsor is paying for them to be there. You know, maybe they have to pay for their trip and their...

Aaron Crow (21:21.610): lodging, but the ticket and the food and all the things are paid for, right? So we force ours to pay for it, right? Because we want them to show up. But that's subsidized by the vendors, the sponsors. Like they're not paying the full ticket price. Our ticket price would be for those attendees would be four or five times what they're actually paying if they actually pay what it costs. The actual cost of the event is way more than the tickets that they're about

Aaron Crow (21:50.796): Right? So there we're making it where it's enough that they want to show up, but not so much that they're like, wow, I can't, I can't afford that. Or I'm not willing to pay that that much. So that's where the sponsors come in. But again, on the flip side, there has to be value for the sponsors. So maybe it's about building smaller curated events with real conversations. Maybe, you know, what if budget went to training and tech demos or labs? there's, there's a lot of ideas, that, make it different.

Aaron Crow (22:19.180): And I've seen a few conferences that are trying to do these things. Obviously there's some smaller organizations that do this and usually they're surrounding, you you look at, you know, the villages that do this type of stuff that show up to these events. There's a lot of things out there. I think it's just a conversation that we should have around what could it be? You know, we already talked about, you know, the difference between Black Hat and DEFCON. I mean, you couldn't be to further obvious difference, right? You know, Black Hat's polished and corporate and suit and sell.

Aaron Crow (22:48.428): Defcon is raw and nerdy and chaotic and sometimes inaccessible, overwhelming. You know, who's each one really for? There's got to be something in between. I love Defcon and it's annoying. I love Black Hat and it's annoying. Both things can be true at the same time. This year I'm a little bit annoyed and a little bit not looking forward to it and also excited because both things are true, right?

Aaron Crow (23:19.295): what should you actually do in Vegas? You know, make sure that you're don't go to booze. You don't care about, right? You don't necessarily need the T-shirt or the swag. you know, find, find your tribe, make connections, talk to people. don't just stay on your own. hard for me. sometimes because it's overwhelmed, there's so many people, it's really easy to just kind of navigate, not talk to anyone. find your time, like go to one or two talks that, that actually align with your work.

Aaron Crow (23:45.326): Check out the ICS village and the other villages and really dive in, ask questions. Those people are there. They have knowledge. Even if it's, if you're not OT or you're not, you know, all the car hacking village or the, the, the arrow, the air, the airplane village, any of those types of maritime go check it out. Like it's, they've got a lot of knowledge. The people that are there are volunteers. They are there because they want to be there. They're because they're passionate about what they do. They're passionate about helping people to understand and grow the knowledge of folks. Right? Meet people. Don't just collect stickers.

Aaron Crow (24:14.860): I love the stickers. I've got stickers all over everything. But it's more than stickers. Like your stickers don't make you better. I guess that that could be argued, but meet people, right? Make connections and be honest with vendors, right? You know, when I go up to a booth and I want their T shirt or their, know, my daughter loves love socks. So I will actually go up to a vendor and say, look, I am not interested in your product. I have no value for it whatsoever. Not that your product is bad or good. I'm just not a buyer for this.

Aaron Crow (24:44.312): But I am, I would love to get a pair of socks for my daughter. And they're like, awesome. They still scan my badge. They still put me in there, but I'm being upfront and honest with those vendors. I'm not interested in your thing. I just want a pair of socks. And if they don't want me to give the socks, I've never actually had anybody tear me down, but I want to be honest with them. I don't want them to waste time on me when there could be other people behind me that are actual buyers are interested, right? So be honest with them and don't ghost them, right? When you get those outreaches, just respond, not interested.

Aaron Crow (25:13.698): just wanted the socks. Thank you for the outreach, right? Let those folks know you're not interested. You don't have to be rude about it when they call you, when they email you. They're just doing their job. And again, these vendors are trying to get value and just let them know, I'm not, that is hugely valuable to these vendors to know, Hey, take me off your list. So I don't wait. You don't waste your time on me or anybody at my company because my company is not a buyer for this thing. And that's okay. It's much, it's much better to be

Aaron Crow (25:42.354): Show up with integrity and be honest with these folks because that's that's hugely valuable. It's it's almost as valuable as chasing down a lead because I'm not focusing on energy and money and time and resources on leads that aren't actually interested. So I just remove them from my list and I can narrow it down to the ones that may be interested, right? That is hugely valuable. So the best thing I can say for you if you are going to black hat and you are going to scan your badge.

Aaron Crow (26:9.624): Be upfront and honest. And then it's again, you're still going to get the emails and the messages. Don't be annoyed. Just know that's what they have to do and just respond to them. Hey, thank you. I'm not interested. Simple as that. They usually, they have to remove you from their list anyways. So just do that. Ask them very nicely. Thank you for your time. Right. lastly, make sure that you hydrate, right? I don't know. I rock. I do a lot of fitness and things, but even that when I go to Vegas, I really have to focus on making sure that I drink plenty of water.

Aaron Crow (26:39.798): It's hot in Texas. It's a different kind of hot in Vegas, so definitely make sure that you hydrate drink more than what you think. Don't just drink when you're thirsty. You know you could absolutely die. Don't want that to happen for anyone, right? So you know the call to action is is have have ideas for better cyber events, right? How can we build this better, bigger, stronger? You know again, not to not to replace black hat. How can we make black hat better?

Aaron Crow (27:9.484): I can make DefCon better, right? It is our community. We get to do with it what we wish, right? So if you're going to be in Vegas, if you're here this week, definitely come by. I will be at the House of Blues for Black Hat or kind of around. You'll probably see me. Big red beard, can't miss it. And then DefCon, I'll be at ICS Village. Definitely go check out the villages, check out all the things.

Aaron Crow (27:34.434): Come see us and have a drink at the Cyber Lounge at Mandalay or in Mandalay Bay at the House of Blues and stay hydrated. That's it. Have a good one guys.

Transcript lightly edited for readability.