BruCON

BruCON

BruCON is an annual Belgian cybersecurity conference that brings together practitioners, researchers, vendors, auditors, policymakers and enthusiasts from across Europe and beyond. Founded in 2008, the event is known for technical talks, hands-on trainings, Capture The Flag competitions and an emphasis on applied security in networks, software, embedded systems and critical infrastructure. Attendees typically include representatives from major technology companies, academic institutions, national CERTs and international organizations.

History

The conference was founded in 2008 by a team including members connected with Belgian security groups and regional hacker communities, emerging alongside events such as DefCon, Black Hat (security conference), ENISA, OWASP, and FIRST. Early editions featured speakers from institutions like KULeuven, Université libre de Bruxelles, SANS Institute, Microsoft, Google, Cisco Systems, and Intel researchers, and engaged with topics similar to those discussed at Chaos Communication Congress, RSA Conference, CanSecWest, and Troopers (conference). Over time the program grew to host workshops influenced by pedagogy from Carnegie Mellon University, ETH Zurich, University of Cambridge, and collaborations with national teams such as CERT.be and cybersecurity units from NATO. The conference has periodically reflected trends set by disclosures at venues like Black Hat USA, policy debates in European Parliament, and technical developments from projects at Mozilla Foundation and Linux Foundation.

Conference Format and Activities

The event combines keynote presentations, technical talks, panel discussions, hands-on training, and competitive events. Training sessions have been led by instructors associated with SANS Institute, Offensive Security, eLearnSecurity, and academics from Imperial College London and TU Delft. Speakers and workshops cover exploitation techniques demonstrated at venues such as Pwn2Own, reverse engineering methods common to practitioners from GCHQ, NSA, and research presented at Usenix, NDSS, IEEE S&P, ACM CCS, and USENIX Security Symposium. Capture The Flag (CTF) competitions often attract teams that have also competed at DEF CON CTF, pwn2win, and collegiate squads from ETH Zurich, KU Leuven, and Ecole Polytechnique. Vendor village and sponsor booths typically include representatives from Trend Micro, Kaspersky Lab, Palo Alto Networks, Check Point Software Technologies, Rapid7, CrowdStrike, and open-source projects like Metasploit Framework and OpenSSL. Panels address legal and regulatory processes intersecting with institutions like the European Court of Human Rights and directives influenced by European Commission policymaking.

Notable Speakers and Presentations

Past programs have featured researchers and practitioners whose work intersects with prominent figures and institutions: vulnerability researchers whose advisories appeared alongside publications from Google Project Zero, cryptographers with links to RSA (cryptosystem), and academics from Massachusetts Institute of Technology, Stanford University, Princeton University, and École Polytechnique fédérale de Lausanne. Presentations have covered topics related to incident response handled by teams at Cisco Talos, threat intelligence work similar to Mandiant (now part of Google), firmware attacks akin to disclosures by Xeno Kovah and Trammell Hudson, and hardware security research comparable to studies from Karsten Nohl and Daniel J. Bernstein. Sessions have also paralleled investigations publicized by Wikileaks, analyses from Citizen Lab, and threat reports issued by FireEye and Symantec.

Community and Impact

The conference fosters a community that intersects with hacker spaces, university labs, corporate security teams, and governmental cybersecurity units. Attendees often collaborate with local groups such as Brussels Hackerspace, engage with student societies like ISACA Student Chapter and ACM Student Chapter teams, or join wider networks including Chaos Computer Club, European Cybersecurity Organization, and volunteer incident response teams modelled after CERT Coordination Center. BruCON has contributed to professional development, spawning job connections with employers such as IBM Security, Accenture Security, Deloitte, Ernst & Young, and consultancy groups akin to KPMG Cyber. The conference has helped circulate tools and open-source projects that later appeared in repositories maintained by GitHub and influenced curricula at institutions such as KU Leuven and Université catholique de Louvain.

Organization and Funding

The event is organized by an independent non-profit team in Belgium with partnerships across academia, industry and civil society. Sponsors have ranged from multinational corporations to local startups and NGOs, including names like Microsoft, Google, Amazon Web Services, Facebook (now Meta Platforms), Oracle Corporation, SAP SE, Siemens, Atos, Capgemini, Booz Allen Hamilton, and security vendors such as Qualys and Tenable. Financial support and in-kind contributions have also come from foundations and research funding bodies similar to Horizon 2020 and national science agencies. Logistics and venue arrangements have involved collaboration with municipal authorities in Brussels and conference centers that host events comparable to those run by Reed Exhibitions and Informa PLC.

Category:Computer security conferences