A Tron-style light cycle with a glowing cyan trail speeding toward New Parliament House on a dark neon grid

A light cycle streaks toward New Parliament House. The conference went all in on a Tron theme, and it worked.

BSides Canberra has wrapped up for another year, three days at the National Convention Centre, and it was a big one: around 3,000 registered attendees, roughly half of them from Canberra itself. For a community-run security conference that is a serious turnout, and you felt it everywhere, from the main track to the villages to the queue for coffee.

The whole event leaned hard into a Tron theme. The badges, the stage dressing, even the Black Bag challenge title played along. It was genuinely fun, and it gave the conference a coherent identity rather than the usual generic hacker aesthetic.

The talks

The big theme this year was the rising use of AI in vulnerability research, and it showed up all over the schedule. Sessions on agentic AI for security investigations, prompt injection against AI agents, hunting vibe-leaked API keys, and an autonomous N-day exploit generation pipeline all drew strong crowds. Whatever your view on where this is heading, the offensive security community has clearly moved past experimenting and into operational use.

The keynotes were excellent across all three days:

  • Day one: Thai Duong opened the conference (Bruce Dang was billed to join him but could not make it).
  • Day two: Renaud Feil with "Keep Calm. Hack On."
  • Day three: Professor Richard Buckland, who closed things out in style.

The standout session for me was Christopher Vella's Unlimited Exploitation of Signed Windows Drivers. Windows extends trust to any properly signed driver, and a legitimately signed but vulnerable driver is about the cleanest path into the kernel an attacker can ask for. Vella walked through how far that trust can be stretched. Well worth catching the recording when it goes up.

The CTF (no AI allowed)

Here is the irony I enjoyed most: AI dominated the talk track, but the capture-the-flag competition had a strict no AI rule this year. Fair enough too. When half the conference is about AI doing the hacking, the CTF is the one place left to prove you can still do it yourself.

I helped our team grind through one of the challenges and spent a good chunk of time in the beginner area, where I captured a few flags of my own. The beginner area is one of the best things BSides does: low pressure, well scaffolded, and full of people having their first proper go at this stuff.

Black Bag: TERMINAL MISALIGNMENT

The Black Bag challenge, run by the Australian Information Security Academy, was titled TERMINAL MISALIGNMENT this year in keeping with the theme. It is part puzzle room, part tradecraft exercise, and always one of the highlights.

I managed to get a flag in this one too: an ASCII-encoded light sequence I recorded inside the challenge room, decoded afterwards. A nice reminder that the signal is usually right in front of you if you are paying attention, and that the prep work I wrote about in my last post was not wasted.

Inside the challenge room. The laser warning sign was a nice touch. Somewhere in that red glow is a flag.

The badge, and a proud dad moment

The conference badge this year was a solder-it-yourself kit, and on Thursday night my 13-year-old son soldered mine up for me. He worked through it at the electronics workspace I have been setting up in the shed, steady hands, good joints, no drama.

My son soldering the BSides Canberra 2026 badge at the electronics workbench in the shed

Badge assembly in progress at the shed lab.

Watching your kid competently use the lab you have been building for exactly this kind of moment is hard to beat. The shed is officially earning its keep. And yes, it works:

The finished badge, powered up and blinking.

The people

As much as anything, BSides is about the people. I caught up with current and former colleagues I had not seen in far too long, plus the surprisingly large crossover crowd of cyber squash buddies. There are more security people on the squash courts of Canberra than you would think.

Huge credit to Silvio Cesare, Kylie McDevitt, and the enormous crew of volunteers who make this event happen every year. Three thousand attendees do not feed, badge, and entertain themselves. It was a fantastic conference, and I am already looking forward to next year.

End of line.

Related links