What do we do with Black Hat, BSidesLV, and DEF CON week?

You are going to a week that is three events with three audiences and one calendar, and none of them is a buying event. The conventional view treats it as a community and recruiting week, or dismisses it as irrelevant to sales, and both views miss what it reliably is at seed. It is the one week a year when a technically deep product gets evaluated on its merits by the people who would actually run it, and it is the busiest week of the year for corporate development. It does not produce revenue this quarter, because the practitioners who love your demo are the same people who love your free tier and do not control any budget. Plan around both halves and the week pays for itself. Plan around pipeline and it never will.

Know which room you are in.

You are not at one conference. You are at a corporate expo, a volunteer-run practitioner conference, and a hacker convention, run by three organizations with opposite rules for vendors.

Black Hat is where the vendors, the press, the analysts, and the platforms' strategy teams are. It is the only one of the three with a show floor, and its CISO summit admits no vendors except sponsors. BSidesLV is the researcher room. It is cheap, it requires a badge bought in advance, and it is built to frustrate lead generation on purpose: it collects no attendee data, prints nothing scannable on the badge, and gives a sponsor a table rather than a booth, then suggests the sponsor not stand behind it. The talk matters there and the table does not. DEF CON takes no sponsorship of itself. It routes money to the villages, contests, and parties that its content creators run, and its rules forbid marketing booths, selling inside villages, and covert marketing of any kind. You may hold your own meetup at DEF CON. You may never claim to hold DEF CON's meetup.

Go to all three and buy nothing at any of them. Black Hat comes first, for the summits and the floor days, because it holds the strategy teams, the press, and the acquirers, and it is the half of the week that pays. BSidesLV comes next, for one cheap badge bought in advance, and for a talk if you have a researcher. DEF CON comes last, for the villages and the people who would run your tool. If the week has to shrink, cut from the bottom of that order. Bring a tool, a talk, or a researcher to each event, and never a booth.

Budget it as corporate development.

You budget the week as business development and corporate development, because that is what it delivers and pipeline is what it does not. In our portfolio this week has restarted stalled acquisition conversations more than once, and never by accident. The platforms' strategy teams travel to it specifically to survey the market cheaply, and every one of them is reachable in the same few days.

Two rules from the acquirer's side decide who you book. Your acquirer is usually already in your pipeline or your partner list, and inbound interest comes from vendors one workflow away from yours with a named gap in their portfolio, not from the giants who could build what you do. So book the adjacent vendors, not only the leaders. Their priorities are public before you fly, in their earnings calls, investor days, partner pages, and deal history, and the person who owns the mandate is the product or business-unit leader named against that gap. Corporate development brokers deals. It does not decide them.

The second rule is a warning. A coffee with a corporate-development team is free for the other side. Their funnel is wide and the coffee never has to lead anywhere, while the whole cost, your attention and a false sense of runway, lands on you. Until there is exclusivity and something at risk, it is a free option that they hold. Take every coffee, and write down its process state the same day: whether you were referred onward, which functions were engaged, and whether anything is at risk. Enthusiasm is not a process state.

Bring a tool, a talk, or a researcher.

You get in through doors that are free, that require something you built, and that close months before the week.

Arsenal is a demo station on Black Hat's floor for an open-source tool. It allows no company branding and bans pitching anything beyond the tool you submitted. That ban is the point. It is the one place on that floor where you are judged on the work alone, and it is the right first Black Hat presence for most seed-stage teams. DEF CON's Demo Labs is the same idea under stricter rules. A BSidesLV talk puts a researcher in front of the people who form opinions, for the price of a badge, and its Proving Ground program pairs a first-time speaker with a mentor for months beforehand. Startup Spotlight is the door for a team that has neither an open-source tool nor a researcher, which describes most commercial seed-stage companies. It is free to enter for a young, small company, and its finalists, not only its winner, receive the booth, the theater slot, and the analyst call you would otherwise pay for.

A booth buys visibility and team morale, not meetings, and no honest all-in accounting of a Black Hat booth exists in public. The cheaper routes that have worked are the same as at any big week: co-host a side event, take space inside a larger vendor's booth, or time a launch to the week without exhibiting.

Build the calendar before you land.

You arrive with the week already scheduled, because it compresses a quarter of meetings into a few days and creates nothing on its own. Its value is close to zero if you arrive hoping to meet people.

Schedule by room. The invitation-only receptions run early in the week and are busiest on the first two nights. The strategy teams and the press are on the Black Hat floor midweek. The researchers are at BSidesLV at the start of the week and in the DEF CON villages at the end. Put each person in one room per day, and put nobody at a booth.

Keep three source columns in your log from the first meeting: investor-sourced, practitioner-sourced, and cold. They convert differently, and the first one flatters you. A deal that closes on borrowed credibility tells you nothing about the cold market.

Closed rooms open on someone's name.

You get into the invitation-only layer of the week as someone's portfolio company or as an invited demo, and not otherwise. That layer includes an investor's reception for security leaders, a CISO-network breakfast, a founders-only room with one seat per company, and the vendor-free summit. Some of that layer is closed by rule rather than by invitation.

Use a reception seat to ask a security leader why a stuck deal is not moving, as well as to meet new ones. An investor's introduction buys the meeting, not the budget, so spend the seat where the product is ready for a senior look.

Play the researcher relationship long.

You are earning standing with the people who form opinions about security products, and standing turns into budget slowly. Research, public work, and free tools earn admiration from a community that rarely holds the budget. Attention and pipeline sit on opposite sides of a line that content does not cross.

So what you take away from those rooms is not leads. It is named people who will run the tool, a talk that got accepted, a finding you co-authored, and a village that wants you back. The researcher you met this August tells a CISO that your product works long after any badge scan would have gone cold, and a fast follower cannot buy that in a quarter.

Measure it in three ledgers.

You judge the week in November, not in the debrief, because meeting counts and enthusiasm arrive immediately and cannot be checked then. Keep three ledgers, not one. Acquirer conversations by process state: referred onward, functions engaged, anything at risk. Researcher relationships by what got deployed or published. New pipeline still alive a quarter later.

Expect the last one to be small. That is the predicted result, not a failure, and a large number there means you should check the source column. Hold next year's spend to those three ledgers.