SO-CON is SpecterOps' annual conference focused on Adverary tradecraft, identity-based security and Attack Paths.

SO-CON 2027 features talks, trainings, and networking events focused on identity-based security and Attack Paths. It kicks off the week with a two-day main conference and ends with a selection of four-day adversary-focused training courses. The Call for Presentations (CFP) is open from October 14 through November 13, 2026.

Call for Presentations
We invite talk submissions for 50-minute sessions (~45 minutes of content and 5 minutes of Q&A) and 25-minute sessions (~20 minutes of content and 5 minutes of Q&A) that explore the offensive and defensive realities of modern identity security, Attack Paths, and the systems and relationships that make them possible.

Some suggested topics we would love to see:

Novel Attack Path research.
BloodHound and OpenGraph use cases, research, and extensions.
AI/ML for offensive and defensive Attack Path discovery.
Agentic AI Attack Paths in enterprise environments.
Detection and response workflows for AI-accelerated identity attacks.
Lessons learned from AI-enabled red teaming and infrastructure.
Identity provider attacks and defenses, including Active Directory, Entra ID, Okta, and others.
Hybrid and cross-environment Attack Paths.
Federated identity and Attack Paths across multiple identity providers.
CI/CD pipeline security.
SaaS application identity and authorization models.
Cookie, token, and session theft techniques.
Anything else interesting you've discovered, built, broken, defended, or learned in the world of identity and Attack Paths.
SO-CON is a technical conference. Product pitches, vendor presentations, and sales-focused submissions will not be accepted.

What makes a strong submission?
Strong proposals clearly explain what attendees will learn, why the topic matters, and what research, experience, technique, or perspective the speaker will bring. We particularly value technical depth, practical lessons, original research, and content attendees can apply in their own work.

CFP Review Process
To help reduce bias in the selection process, SO-CON anonymizes CFP submissions before they are provided to the CFP Review Board. We remove identifying information, including names, pronouns, and affiliations, from the title, description, and outline. Please avoid including identifying details in your submission wherever possible.

Reviewers compare anonymized submissions using an Elo-based comparative rating system, considering factors such as relevance to the conference, technical quality, originality, and the value the session is likely to provide attendees.

The SO-CON team uses these ratings as an input when curating the final conference agenda, alongside considerations such as topic diversity and overall program balance. The final agenda will include talks selected through the open CFP, alongside sessions from SpecterOps employees and invited speakers. We will also select a number of backup proposals in case a speaker is unable to participate.

Selected speakers will be contacted directly to confirm their participation.