Are cybersecurity events still giving people a reason to turn up, or have too many become expensive sales floors with the same conversations on repeat?

Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode I'm joined by James Bore, Chartered Security Professional, Gary Hibberd, co-founder of Consultants Like Us and Lisa Ventura, founder of the AI and Cybersecurity Association and Unity Group Solutions.

Cybersecurity events have changed. What were once places to discover new technology, catch up with people across the industry and exchange ideas have become a packed calendar of conferences, roundtables, dinners and vendor events competing for people's time. With InfoSec Europe introducing a £50 ticket charge, it raises a bigger question about whether the traditional conference model is still delivering enough value.

We look at why experienced security professionals are increasingly choosing community and fringe events, why the same conference conversations keep coming back and what actually makes an event worth attending. From vendor pitches and expensive exhibition stands to better speakers, smaller audiences and conversations in the pub next door, we discuss where cybersecurity events have gone wrong and what could make them useful again.

Three key talking points:

• When a conference stops being worth it
• A ticket might be free or cost £50, but the bigger investment is your time. We look at why established cybersecurity events are struggling to give experienced professionals a compelling reason to walk through the doors.
• Why smaller events feel different
• Community and fringe events come up repeatedly throughout the conversation. Discover why smaller audiences, more focused subjects and speakers who genuinely know their field can create something the biggest conferences struggle to replicate.
• People don't go to events to be sold to
• Expensive stands and polished sales pitches do not necessarily build relationships. We discuss why attendees increasingly value access to practitioners, useful conversations and genuine connections over another lap of an exhibition hall.

If you're choosing which cybersecurity events deserve a place in your calendar, or organising one and wondering what will actually make people turn up, this conversation is for you.

On why smaller events work:

" You actually make it small and targeted and tailored. And that's how you engage."

James Bore

Listen to this episode on your favourite podcasting platform: https://razorwire.captivate.fm/listen

In this episode, we covered the following topics:

• How Cybersecurity Events Have Changed
• Explore how major industry events have moved from places to discover technology and meet the community towards a much more commercial model.
• Is InfoSec Europe Still Worth Attending?
• A new £50 ticket charge sparks a wider discussion about what attendees actually get from one of cybersecurity's biggest events.
• The Rise of Community Events
• Discover why BSides and other smaller events are becoming the preferred choice for security professionals looking for different conversations and ideas.
• Too Many Cybersecurity Events
• The calendar is packed with conferences, dinners and roundtables. We discuss why more choice is making people increasingly selective about where they spend their time.
• Escaping the Vendor Pitch
• Learn why exhibition floors dominated by sales conversations can struggle to engage the CISOs and security professionals vendors most want to meet.
• Why Relationships Matter
• People still buy from people. We explore why informal conversations and genuine relationships can offer more value than another product demonstration.
• What Makes a Good Conference Speaker
• Interesting events need people with something meaningful to contribute. Find out why practitioners, specialists and different perspectives matter.
• Having a Reason to Attend
• Going to an event simply because it is there is not enough. We discuss why attendees need a clear idea of what they want from their day.
• Can Big Conferences Be Fixed?
• Bigger does not necessarily mean better. Explore whether smaller, targeted events built around particular audiences could offer a better model for cybersecurity.

Resources Mentioned

James Bore on LinkedIn

Infosecurity Europe

Black Hat

Security BSides

Hack Glasgow

SteelCon

The Real Cyber Awards and Conference

Connect with your host James Rees

Hello, I am James Rees, the host of the Razorwire podcast. This podcast brings you insights from leading cyber security professionals who dedicate their careers to making a hacker’s life that much more difficult.

Our guests bring you experience and expertise from a range of disciplines and from different career stages. We give you various viewpoints for improving your cyber security – from seasoned professionals with years of experience, triumphs and lessons learned under their belt, to those in relatively early stages of their careers offering fresh eyes and new insights.

With new episodes every other Wednesday, Razorwire is a podcast for cyber security enthusiasts and professionals providing insights, news and fresh ideas on protecting your organisation from hackers.

For more information about us or if you have any questions you would like us to discuss email [email protected].

If you need consultation, visit www.razorthorn.com, We give our clients a personalised, integrated approach to information security, driven by our belief in quality and discretion.

LinkedIn: Razorthorn Security

YouTube: Razorthorn Security

TikTok: Razorwire Podcast

Instagram: Razorwire Podcast

Twitter: @RazorThornLTD

Website: www.razorthorn.com

All rights reserved. © Razorthorn Security LTD 2025

Infosec years ago used to mean something.

It was the big event of the year.

If I hear anyone else tell me that AI is one of the biggest risks that we face, you know, to humanity, I'm going to scream.

It's the same conversations, the same patterns.

We're not solving anything, we're just covering the same old ground.

I've given up on the larger conferences, simple as that.

Because it is those same conversations for me.

It's around connecting and catching up with people.

Although I'd argue I've I could do that better at community events than I can at infosec.

Now it's just become a big fat money grabbing, greed fueled.

You do know you're talking to a Yorkshireman.

You should never put the word only in front of pounds, let alone 20,000 of them.

It wouldn't be worth the money if it was free because going in there is such a hostile, crowded environment.

Hello and welcome to another edition of Razor Wire.

Now today we are going to be discussing something that has been hotly debated over the last month or so depending upon when this comes out around events.

What are good ones, what are bad ones?

How's it evolved over time?

Why all of a sudden are we starting to get charged to go to events?

Whereas before you would have to pay potentially a gate charge, but before that everything was free.

So come with me on a journey with with three of my favorite guests to discuss this particular interesting issue.

Welcome to the Razor Wire podcast where we discuss all things in the information security and cyber security world from current events and trends through to commentary from experts in the field, providing vital advisory on on what it is to work in the information security and cybersecurity space.

And in order to discuss this important ramifications around cybersecurity events, the pricing of those events and the various other different topics that we are going to explore today around cybersecurity events.

I have brought in three of the best people I can think of to to discuss this.

So I have Lisa, Gary and James.

Since James is the newbie here and hasn't been here before, I will let James start with an intro, then we'll move over to Gary and then over to Lisa.

So James, your time to shine.

Okay.

James Bohr.

I do various security things, childhood security, professional, way more public speaking than anyone would like, particularly at community events and have all sorts of opinions about speakers being paid.

Fantastic.

Gary hi.

Gary Hibbard, co founder of Consultants Like Us.

And we're all about information security, data protection, privacy and of course artificial intelligence.

And like James, do a fair amount of public speaking around the world.

Yeah, I'm looking forward to this conversation.

Fantastic.

And Lisa.

Hi everyone.

So I'm Lisa.

I'm the founder of the AI and Cybersecurity association and also my consultancy business which is Unity Group Solutions.

I offer security awareness and culture change and I work with a variety of clients and like James and Gary, I do a lot of speaking when I can at various events, like to go to various events when I can and yes, do have some opinions around events in cyber at the moment.

Fantastic.

And obviously everybody knows who I am.

I don't do a lot of speaking events, I just do the podcast.

As a general rule, I'm better in front of the camera than I am in real life, although apparently that's starting to change.

A lot more people starting to ask me to do this anyway, cyber security events.

I have been in this industry for 30 years, as a lot of people know.

I don't need to belabor that.

And one of the key events that has always been there since, since the year dot has been Infosec.

It's now called Infosec Europe.

I'm not, I know there's a lot of other infosecs that have popped up around all over the place, but that was the original one.

There was a few smaller events, you know, sort of like distributor events and so on and so forth, but an actual kind of full on event, Infosec was really the thing and always kind of has been and many, many years ago it was down in the Olympia.

What would tend to happen is basically everybody would descend, go and have a speak with the vendors, go and see the mates, go and see people they knew in the industry.

Then everybody would gravitate out to the various different pubs that surround the place to have more discussions normally over something golden and slightly bubbly.

And it was just generally considered to be kind of like the event for Infosec to go to.

Is that fair to say for just the Infosec event or am I missing something out, guys?

I mean it was in my younger days, but in those days it was a lot of it was just for the free T shirts.

Honestly, the swag was a lot better back then.

Yeah, the swag was a lot better.

I think from my perspective, like yourself, I've been in this industry since year dots in 30 years and started out going to infosec.

I'll be honest, over the years I've tended to go once, miss a couple of years, go again, miss a couple of years, go again.

Until I started doing consultancy and then I found that actually going along and speaking to the vendors, they didn't have a lot to say.

There was not a lot of innovation.

I was hearing the same kind of conversations quite often.

So I.

It started to then be.

I would go and then miss three or four years and then I'd go again, miss the three or four years.

But I am going this year.

I've got another reason to go along as well, because of where it is and because of other events around it.

But I'm going to go along and I'm going to be intrigued to see if the vendors have got anything new to say and indeed if.

If the people that I mix with have got anything new to say and what the conversations are.

Yeah.

It was because my ex at the time was working for Portcullis Computing Security.

It's now been brought out by Cisco, but Portcullis took over one of the nearby pubs and.

And completely rebranded it as the Portcullis Arms.

And so that was where I spent a lot of my time.

Rather than going around and speaking to the vendors, I'd have a quick foray in to have a look, but then back out into the Portcullis Arms.

And that worked really well, but very similar to Gary.

Since then I would go a few years, maybe have a bit of a break.

Of course we had the pandemic, we couldn't go then, but I always found I got more value and this is only me got more value out of the Fringe events that were going on around the main show.

Pentest Partners always do a really good one in the Fox.

Of course there's Cyber House Party, there's all those things, but there are other ones going on as well.

I had better conversations and much more value out of the Fringe events than the actual main one itself.

Absolutely.

I mean, you know, it did move over to the Excel number of years ago and I found in the early days when it first moved over, there was not really a lot out there.

I preferred Olympia because you could kind of get out and see these fringe places, but in the early days of the Excel, you know, there wasn't a lot else there.

There's a lot more now, there's a lot more going on.

But I tend to agree with you, Lisa.

I see a lot of people who spend a lot of time, they go to the event, they do the kind of round robin two or three times around just to see what's going on and then they go outside and everybod basically then spends most of their time in various different pubs chatting with the various different people who come and join them and, you know, speak to the various different.

It's normally distributors that have the local pub.

And of course we got Pen Test partners with Ken and Gerard and what have you take over the Fox.

And I've noticed over the last few years they've slowly taken over more and more and more of the floor in there.

So it'll be interesting to see what's happening this year.

But we do have other events.

We have things like Black Hat and what have you.

You know, there's a lot of events that are starting to pop up all over the place and something that you guys mentioned around Covid, Covid really changed everything, I think, because before COVID for security events, you had the big ones and the fledgling ones that are a little bit larger now.

But you used to have a lot of Thursday evenings, didn't you?

It was like distributors would say, oh, come along, free pints, you can speak to a couple of vendors and all the rest of it.

And because everybody you know working for companies based in London tended to be in London every single day before hybrid working became popular.

It was good to go to.

You got to see and experience things.

But then Covid hit and for what, a year and a half, two years, literally no events happened.

You know, we had these terrible virtual events that I don't even know what they were about.

But the history of our cyber security environment, we're seeing a lot more and a lot bigger events nowadays and that's good.

I think that is good.

It's good to go and see what's going on in the industry and what have you.

I kind of agree with Gary going in and seeing some of the vendors, you know, you kind of get the same message.

Yeah, light segue, but it is a very important point.

So I am the co founder of the Real Cyber Awards and we did that a couple of years ago.

We started it basically.

Lee and myself, my business partner and myself, we just went to a number of awards and we always left feeling a little bit cold, a little bit.

Even if we won, if we were shortlisted, great, if we won, better, I suppose, but we always walked away with just an empty feeling of that was all right.

But there's more fun to be had with this, with awards and such.

This year we are putting on the real Cyber awards and conference for very similar reasons that we go to conferences, both fringe and more well established, I guess.

And we always walk away just saying, if I hear anyone else tell me that AI is one of the biggest risks that we face, you know, to humanity, I'm going to scream.

If I'm going to hear just one more vendor telling me that it is AI enabled, I'm going to scream.

So we were like, right, what could we do?

Because we're not, we're definitely not one for just throwing mud at the, and stones at the industry.

We, if we see a problem, we go, well, how can we fix it?

What could we do that will be better?

And with the greatest of respect to a lot of the fringe events, it's the same kind of conversations.

You know, it might not be AI, but it may be talking about the latest hacks and you know, every 39 seconds someone's going to be hacked and talking about firewalls or a very technical level, which are great for a certain audience, but they can be quite alienating and quite feel a little bit cold for some people.

So he said, look, let's run a conference that is more human, risk based, focused on something that, on topics that the industry needs to know.

So if you ever.

Have you got a book inside you, do you want to get published?

Well, here's how you get a book published.

You want to get a podcast started?

Well, here's some people who started podcasts, how to get started in this, in this industry and how to get your voice heard on stage as well as on a virtual stage.

We just said, right, let's do a conference that yes, it's information security, data protection, privacy and of course AI will get a mention.

It isn't just the same conversations time in and time out.

And that is the problem with a lot of conferences, either both the free ones and the ones that you are paying for.

They're just saying the same thing.

I couldn't agree more, Gary.

I go to so many and I've been, I've had this conversation with my husband actually weeks ago.

It's like it's the same conversations, the same patterns.

We're not solving anything, we're just covering the same old ground.

And by the way, yes, I might have the AI in Cybersecurity association, but I completely agree with you about this.

AI enabled and AI is going to cause the destruction of humanity and all that.

And that's why I actually set it up to try and just get some clarity around the noise.

Gary.

So I just, yeah, I just wanted.

To say, listen, I have nothing, no problem with AI.

You know, it's an amazing technology and I don't want this to just go down the AI route because I think it's an important conversation.

We have to have AI governance.

You know, I was speaking at DTX Manchester a few weeks ago.

I asked a hundred people in the audience, are you in using AI and have you got it enabled in your business?

All hands went up.

When I asked them about AI governance, all hands went down.

So there's a big conversation to be had at your association.

It's absolutely much, much, much needed.

What we can't have is just what I did feel again.

And it's no disrespect to DTX Manchester, but when I walked around, that was the last major conference I went to was I walked around, it almost felt like the vendors had just simply tipped AI into all their livery on the signs.

And I was like, oh, come on guys, come on, you've got to go deeper than this.

You know, don't just keep saying, but it's AI enabled, it's got AI, it's powered by AI.

I'm like, come on, let's have a deeper conversation.

It's here.

You know, if you, if we all believe that, what, walk towards the dystopian view of AI, then clearly we're going to be in a situation of, well, you know what, all bets are off.

Let's just go pack up and go home because, you know, the end is nigh.

But we don't feel that there is things that we can do and we within our industry are perfectly placed to do this.

We've seen it, it's cyclical, we've seen new technologies.

We, most of us were there at the birth of the web.

We've heard about, you know, I'm hearing the phrase, you know, AI is like the wild, wild west.

And I'm like, what have I heard that phrase before?

And he's like, during virtualization gdpr, you know.

Yeah, I mean, all of these.

I've done plenty of videos where we talk about the fact that, you know, the marketing around this place is all.

Is like Ouroboros, you know, the snake swallowing its own tail.

It just goes in a cyclical fashion constantly.

And it's all driven by marketing.

And marketing has changed.

I mean, events have changed.

But I'll hand over to James because I know he wants to probably put his word in here.

I mean, I was going to say I've given up on the large conferences, simple as that.

Because it is those same conversations.

I remember when we had automation, which was AI.

At the time, Robotic process automation was tagged as AI.

Next year I hear Quantum's going to be back.

So you can put your money on that, on the predictive markets.

But it is just this cycle and I've had enough of the big commercial conferences which keep repeating it and are run by vendors.

So now I'm pretty much only going to the community conferences, the B sides type ones, not just BSides but all of the others, like Hack Glasgow, like Steelcon, because that's where different conversations happen.

Because they, yes, they've got sponsors, but the sponsors are there because frankly, it's a good way to prove that you're credible in the community rather than just throwing flyers at people and stealing email addresses to spam people for the next 25 years.

I've got some who are still doing it.

From the first infosec I went to.

It is vital that it changes.

But the commercial ones are just, they seem completely tapped out.

Yeah, I think James just.

And well, all of you, really your thoughts around this?

Because when I go to a conference, whether it be a fringe event or whether it be a mainstream event, for my mind, it's always got, there's got to be a reason, there's got to be a strategy to it.

What am I going for?

What is the outcome?

What am I hoping to get?

It might be that I just want to go and connect with a number of people in, in a city because I've not been down to, I don't know, I haven't got down to Bristol.

So I'm going to get down to see an event and I'll go and meet up with a few contacts that I haven't met with for a while because Bristol's quite a long way to go from Yorkshire.

You've got to have a strategy and a reason to do it.

And I think, you know, if there's one piece of advice, if I may give it to any marketing teams who are working for the large conferences is you've got to not just sell the.

These vendors are going to be here.

It's got to be, well, what transformation?

What do you want?

What's going to change about me for, for coming to this event?

And I think a lot of people miss that when they're putting on events.

They just simply go, oh, we've got this vendor and these vendors and these, and this company and we got, you know, sponsored by this, whatever.

It's like, okay, well what are they bringing to the Party other than a logo.

Well, I think this is one of the big problems I have because the original kind of infosec.

Let's just use infosec as an example because we're going to be talking about some of the pricings shortly.

It was a good chance for us all to just meet up, you know, in the oc.

Yeah, there were vendors there.

Yeah.

You know, you go along and they do the spiel.

But then of course, security stopped being just this weird thing that everybody thought was possibly important but didn't really want to do to becoming this massive money maker.

And we saw the explosion of vendors and I think a lot of these events that suddenly started popping up all over the place realized that they could charge quite significantly for the vendors to go to the event.

It stopped from being something that was just interesting to go to where you'd have those conversations and see cool new technology.

We were lucky to have email security.

But as everything changed, we got more firewall technology and then we got software as a service technology and so on and so forth.

It was a great way to find out what was going on in the industry.

The events have changed from being, yes, money generation and showcasing products to becoming more about VCs, PEs, who've just bought all of these new kind of predominantly Israeli and US companies and buy our products.

Buy our products.

I don't, I can go to a lot of these booths and there's normally just like one techie there, one person who knows about security.

There's a million million sales and marketing people there who, quite frankly, I'm not being rude to them, but when you sat in front of a CISO trying to convince them, you know, buy our product.

The CISO is not going to buy it from you.

They're going to buy it when they've had a conversation with somebody who actually knows the industry, which is what we've done.

This is why we have the podcast.

I wanted to get to the meat and bones with wonderful people like yourself to talk about what security means and what, what matters to the community.

Now it's just become a big fat money grabbing greed fueled by a section of, you know, where you can put up a stall and, you know, you'll, you'll have millions and millions and millions of people coming along, because back in the old days there was a lot of people who went.

But now we've got today and with what Infosec have pulled, and I'm sorry, Infosec Europe, if you're watching this, but, you know, charging 50 quid for a ticket like a month before the event, whereas previous years it was okay, yeah, you'd pay the gate charge if you went on the day and you didn't pre book a ticket.

But let's be honest, most of us Infosec people didn't really know if we were going until maybe a week or two beforehand where we'd sign up and what have you.

But it just seems to be that, you know, these events are now trying to find desperately ways to get more money, because I don't think the footfall is there like it used to be.

Is that fair?

That's completely fair.

And the reason goes back to what Gary said, it's what's the actual value in going.

If I'm going to Infosec Europe, the real question is why?

I know all of the vendors who are going to be there.

I know who to speak to at those vendors if I actually want a conversation with them.

And those are not the people who are going to be on the booth trying to scan my badge to send me emails.

I'm already getting emails from them.

But it's not just that, it's also when you go to the smaller conferences where you've got people who are speaking, they're speaking about an issue that matters to them.

They're in the community, they know what issues matter to the community.

It might be aimed at someone who's brand new, it might be aimed at cynical, bitter old men like myself and Gary and yourself, Jim, but it's aimed at someone.

It's something someone wants to talk about.

If you go to the large conferences, and I have spoken at some of them in the past, you might get a few people who are there because they've been invited to speak and fortunately not charged to, but also not paid to.

But most of them are there to do sales pitches.

Yeah.

No, advertising is free.

I can get that anywhere.

Why would I go to a conference free or paid in order to get more advertising when I've got community groups, I've got online groups, I've got all sorts of ways to meet people now I've got all sorts of ways to actually have the conversations that matter and listen to people speaking about things that matter.

And the way they seem to be doubling down on it is to add more and more sponsored speakers because they're struggling to fill up slots, which just drives people away.

It's a weird cycle where I cannot understand what the thinking behind it is.

Well, it's all it.

It comes down to from, it's a business model, right?

It's the organizations.

And I know we're talking about Infosec here, and just for clarity, I have paid the £50.

You know, I'm going to go this year, but that's because, fortuitously, I'm also speaking at the Digital Construction Week event, which is also in the same building on the state, pretty much on the same day as, or one of the days that Infosec is.

So I paid the money, but I recognize that it's.

This is a business model.

Now, you know that I've never had a, you know, a stand at Infosec or any of these large, large events, but I've had them call me and they've said the words to a Yorkshireman, it's only £20,000 to have a stand.

And I'm like, you do know you're talking to a Yorkshireman.

You should never put the word only in front of pounds, let alone 20,000 of them to anyone who is at these events.

I mean, I should imagine Infosec aren't really that interested in our opinion, because I would imagine, and I hope they're getting a lot of heat from the vendors, because if the vendors are paying 20 grand to have a little stand when the footfall is like, literally not falling and there's no one turning up because the speakers aren't the level that they were hoping or whatever, or there's just people are walking away in droves because they're paying the, you know, they refuse to pay the £49, then I would imagine Infosec and others are going to have to look at their business model.

And it is a business model.

And that's the sad thing, which is why I am genuinely supportive of the fringe events.

It's just that, again, when I look at time versus what am I getting out of it, you know, what's the value of me being there?

Can I contribute to that group?

Will I gain any transformation?

Will I get anything from that group?

Some of them, yes.

Some of them, not so much.

So I'm very selective about events, whether they're mainstream or not.

But the fringe events, I would agree with everyone on this, on this podcast, is that I think those events are driven by passion and enthusiasm rather than good old folding coin, you know, so It's.

It's the monetary push for it.

I think that's the.

That's the thing that irks a lot of us, I guess.

I mean, for me, anyway, going to.

Say, on regard to the pound 50 fee, are they trying to generate revenue to pay Nico Hulkenberg as the keynote speaker?

Just saying that is not going to be cheap to have the likes of a current Formula one racing driver as a keynote speaker.

I'm going to ask it, I'm going to say it.

The producer has always said to me, you need to be more controversial on this.

Everybody always agrees with you, and you need to kind of thought, why in the name of gods have we got a guy who was.

Is he.

He's a Formula one racing driver, Nico Hulkenberg.

He's speaking at Infosec on the Tuesday about what?

Yeah, you tell me.

He's not an Infosec professional.

There's plenty of really good ones.

There's some.

There's, you know, there's you guys.

It's not me.

I mean, nobody wants me.

Nobody ever invites me to anything, you know, but I mean, let's be honest.

What is that meant to be a hook?

Is that meant to get you to stump up 50 quid?

I have no idea who that was.

I mean, Lisa mentioned the name.

I'm not at all.

He's either CISO of some large security company or, you know, is he an ex hacker from around, you know, from, you know, off distant shores?

Mitnick level hacker.

He is a current Formula one racing driver.

Amazing.

Well, whoopty doo.

We're gonna learn a lot from that keynote speech.

And it's probably been written for him by AI because let's face it, I mean, you know, I do lament.

I.

And to be honest, I am going to be going to the smaller events.

I'm going to try and get up to Gary's event.

Definitely.

I have much better conversations there.

And I mean, I got my.

So I didn't stump up 50 quid.

I had a lovely vendor who turned around and said, I've got some free tickets.

Would you like one?

And I said, absolutely.

So, you know, I will be there.

Um, and I've had a lot of other vendors outside of that who have contacted me.

I think it's because they see that, you know, the podcast has gotten as big as it has.

We've just hit like half a million views in the last 90 odd days.

We're.

We're getting a lot of views and I think they see it as a vehicle to sort of build upon their own marketing because I think they've realized, you know, the amount of money that you spend, because, I mean, you've mentioned, Gary, 25 grand.

That's not even for one of the large pitches.

That's not even for the really, really well placed ones.

That's one of the ones that's kind of off to the side and around the corner a little bit.

I was chatting with another.

Another company, you know, similar to mine.

I'm very friendly with a lot of the guys in this industry and they may or may not have been mentioned before, but.

But they've said, yeah, all we do is we rent out the pub next door.

It's cheaper even when you're buying everybody beers than it.

And we get more out of it than you do going and putting your pitch up.

Because half the time it's students who just want a job or, you know, the CISOs just don't go in anymore.

And I can see what's going to happen.

I'm going to go in and with my free ticket and I'm going to go around and see all these really upset vendors because the footfall is going to be zero.

I mean, there'll be people still going, I'm guessing.

You could have all kinds of conversations, you could learn all kinds of stuff from different people, but now it's just like vendor fest.

Cool.

You're showing me your GRC product.

Well, that's going to be useless in about five years because the AI will write that for me and I won't need your product.

Maybe I'm just being cynical.

No, and I think you.

I don't.

Yeah.

I mean, let's.

Let's be controversial.

It's.

I don't.

But I don't think this is controversial as such because I think we all feel it.

You know, what's the one thing that is, I think, universally agreed when you go into a shop, like, I don't know, let's pick a vendor like Levi, and you walk in and they go, are you looking for anything, sir?

You go, yeah, I'm looking for some jeans.

Like, why do you think I'm in here?

Why?

What?

Can I help you with anything?

No.

I'm a grown adult.

I know what I'm looking for.

And it's the same feeling for me, because I'm not into cars, which is just being demonstrated by earlier conversation about formula One, if I go, you know, if I go into a car dealership and a salesman walks up to me and says, what are you looking for?

And I'm like, what do you.

A bag of chips?

What do you think I'm looking for?

But I don't want to talk to you.

But if I am going to talk to you, maybe if I am knowledgeable about this, I want to actually talk to the mechanic who's going to talk to me about the actual vehicle itself.

And when we go to conferences, the feeling is.

And, yeah, we see it.

I do it.

You walk along and you're like, your eyes are to the floor thinking, I can't.

If I get eye contact with someone, they're going to draw me in and they're going to, oh, Gary, would you like to talk to us about?

And I'm like, no, no.

I'm just trying to make my way down to the coffee lounge.

I know that one last time I went, it was when the podcast was.

Was kind of popping as well, and the whole gods.

I got recognized by tons of vendors and, like, other people walking around, and it was weird.

I've never had.

I've never experienced.

I've always been the silent, you know, the quiet guy with a hat on, just slinking around like Gollum.

And, you know, all of a sudden, boom, everyone's like, oh, do you want to come over and talk to us?

Oh, you know, we've watched your podcast, blah, blah, blah, and all the rest of it.

Oh, can we sponsor?

You know, it's like, God, what, sorry, who?

Just, you know, I just want to get around and have a look.

I just want to look.

Can I just return to something?

I'd be interested in James and Lisa's views on this as well.

But you said something earlier which I think is really interesting, is that some vendors will say, look, it's easier and cheaper for us to hire the pub next door and pay for the beers and such.

What you're saying is, and this is the bit that I think a lot of vendors who are putting on these large events are missing, is it's about building relationships.

It's about the community.

It's not just about, are you here to buy a firewall?

Are you here for SOC services?

Are you here for GRC or whatever it might be?

It's, can I trust this person?

And that's a lovely thing in our world, in this broader world of digital and AI and such, is that people still buy from people.

And I want a relationship.

I want to know that I can trust this person.

Because you're probably going to ask me to invest not just money, but also time and effort and potentially my reputation on spending 10, 20, 50, £100,000 on this product and service that you're talking about.

And I've never met you.

Whereas if I go to the pub next door and I hear a technician talk about the technical aspects of a firewall or malware protection or mdr, whatever it might be, then I can have a beer with that person, or, you know, soft drink in my case, but, you know, it's a case of just saying, I want to have a conversation.

Can I trust them?

It's about building those relationships.

And large vendor events just feel too clinical.

You're not going to get that by picking up a pen or a notepad or a squidgy thing or a T shirt from a stand and then going, yeah, I'll come back later.

It's like, nah, I've just got good swag.

It's about building relationships.

That's, for me, that's what a good event should do.

Gary, coming in on that, I could not agree more.

And like, James, that's why I much prefer the community events and to do those, the B sides, the World Seasides.

You were there, Gary.

James, you were there.

What a fantastic event that was.

And I know it was their first one, but it was absolutely superb from start to finish.

That whole day was amazing.

Hopefully people from Infosec and other large vendor events are listening and some of the B side events and other events, fringe events, are listening as well.

Is, you know, my talk was 10 things that star Wars Can Teach Us About Security.

So it was a little bit different, it was a bit interesting, a bit fun.

And equally, there was plenty of talks that day that just.

The title was like, oh, I like that.

That's an interesting take on it.

Whereas a lot of these larger events, you just go along and they, you know, it's, you know, the, the top 10 vulnerabilities in your network, it's like,.

Okay, and half the time the speakers are talking about stuff we already know about.

Yeah, yeah, tell me something new.

I genuinely, when I train people to be speakers and to go on stage and own that stage is, you've got to come, you've got to think about the audience.

What do you want them to know, feel or do differently after listening to you?

And if you're only going to give information when the.

Then, with the greatest of respect, just put your PowerPoint slides up on screen, let me read it.

And then after 20 minutes, I'll, I'll walk away going, well, that was interesting.

That was interesting.

Didn't know that before, but I want you, you know, you've got to walk away with a different feeling or do something as a result of listening to someone on stage.

As long as you're not going to do what the head of Microsoft did in that video from way back where he's screaming and running around on the, you know, on the stage like a lunatic.

Yeah, no, I mean, I, I'd love.

To see you do that at your event.

Go do it.

You got me thinking now, now, now I'm thinking, yeah, there's no need to see my dance moves.

There's no, you know, that's, that's it.

But back to the Real Cyber Awards and conference this year.

Our conference, part of it will have an 18 rating and it will be cyber trauma informed presentations.

Because one of the speakers, Dr. Catherine Nibs, She's a cyber trauma specialist.

So she's going to talk about some very, very dark aspects of our online world, which in a broader sense, you know, I wouldn't, I wouldn't explore those conversations on a platform like this.

Cause I don't know who's listening.

But what we can do, we can control that audience when they're there.

But that's going to be so interesting and so in depth that, you know, genuinely, a lot of people I know, myself included, go to the dark Web.

We know things, we see things and we experience things.

Like Dr. Catherine Nibs, she sits in her counseling rooms with children and listens to their experiences about being online.

So when we're talking about online safety, with the greatest of respects to all the experts at our level, great.

But I would always defer to Catherine and I would say to her, so what's really happening?

And she'll say, this is what children are experiencing, this is what they're feeling, this is what they're telling me.

Obviously not disclosing personal data or anything like that and keeping confidentialities, but that is infinitely more interesting than just coming in and saying, these are the OWASP top 10 LLMs that we need to be concerned about.

Well, this is it.

I mean, we're so.

We're.

Razathon's doing an event in Gibraltar around the October 7th.

We're just organizing it at the moment.

And so we've invited a couple of vendors to come along and what have you.

It's going to be a small local event.

You know, they don't get a lot of events out there, so we're bringing the vendors to them.

And we were having a chat with the vendors and if you are watching vendors, I am going to say something, I might get in trouble.

But hey, I get in trouble a lot.

We said to them, when you do your presentations, because you'll be able to do your presentations, please don't send up sales guys, don't send up a sales pitch.

Send up the people who do the work or are in that industry or have worked on that product that you've got that can actually talk to actual CISOs who are interested.

Not a PowerPoint presentation with somebody stumbling through it like a lunatic.

You know, we want to have good conversations like yourself, Gary.

You know, at the end of the day, people want to go to these types of events to be inspired and to have those conversations not to be sold to.

Although I do fear what the vendors are going to say to Infosec after this one because I don't think it's going to be positive.

No, I think you're right.

I think that that is the fear.

I mean, Lisa, from your point of view and James as well, you know, if you were going to Infosec this year, Lisa, did you say you are going?

I have a ticket I can't make.

And by that I mean actually I've got a press card, so I was able to actually apply for a ticket without having to pay the 50 pound fee because I've.

I've got a press card but I can't make the decision to go until closer to the time.

And the only reason I will go is slightly selfishly, I've got a friend that lives not 10 minutes from Excel and it's a great opportunity to go and see her and spend some time.

Well, you've kind of answered my question.

You kind of answered the question which was why, if you're going, what is your strategy?

What is your goal?

Is there a goal to.

To go to it?

For me, it's around connecting and catching up with people.

Although I'd argue I could do that better at community events than I can at Infosec.

And the only thing which is absolutely nothing to do with cyber is it's a great opportunity to go and see my good friend who lives very close to the venue.

That's it.

I can't.

So it might just be.

Do I just not justify the train costs and so on of getting there and all the additional costs even for that thing of catching up with her, which I can do on a video call anytime anyway.

Are you going, James?

No, I'm not.

But it's actually because I'm not available.

What I would have been doing if I was, would have been going along, not going into the conference.

I've got people I want to meet there.

I've got some people who are actually exhibiting there where I want to talk to some of their staff.

They've agreed before to happily wander out and meet me outside because I just don't want to deal with going in.

So, yeah, it's very much a.

It's not worth my time.

I mean, it's not worth my time.

It's not worth the money for the ticket.

It wouldn't be worth the money if it was free.

Because going in there is such a hostile, crowded environment.

I'd rather meet someone for a coffee outside.

It is an interesting thing you've just said there.

I mean, it'll be interesting to see if it's crowded this time, but you've just said absolutely the right word there.

Time.

The most valuable resource available to anyone is time.

And that again, is when.

When I'm training consultants like us and to go on stage and own that stage.

And typically I'm training technicians for the very reason that James mentioned earlier, is that you want technicians on stage, not the salesperson.

And I want them to have a voice.

And quite often they're like, yeah, I don't want to do public speaking.

It's not what I'm about.

It's like, no, we need you on stage because we've had enough of the salespeople.

But we want you to speak with passion and enthusiasm for the topic that you've got.

And this is advice to every speaker.

I always give is just remember, it's the audience are giving you the most valuable thing that they have, not their money, but their time.

So make it, you know, do your work, make sure you prepare for that presentation.

Make sure you understand what the audience and audiences needs are.

And I just don't think vendors really give it any kind of credence, that sort of level of thought it used to.

Yeah.

Not anymore.

Yeah, no, because it's now a business model.

It's not now, as you said earlier, now large organizations have just gone.

There's a lot of money.

A lot of people seem to be interested.

Money, money, money.

Yeah, yeah.

You know what I suggest to a lot of these events runners?

Yeah.

Why don't you actually engage with me, Lisa, Gary and James, and we will actually make your event work.

We will actually advise you on what you need to do to draw in the crowds.

Because what you're doing at the moment is obviously not working if you're having to charge 50 quid if you don't book, you know, because it is.

It was free initially, but obviously about a month or so beforehand, it topped over to 50 quid.

Rather than relying on people stumping up 50 quid because they're not going to.

They're not.

Not at the level you want them to.

Why don't you actually kind of make it engaging?

As Gary and James and Lisa have said, make it engaging rather than, you know, I mean, a racing driver.

I was good.

I was just genuinely.

I was just gonna say that he's.

Like, is he gonna race it in his racing car?

Who.

Who thought that you could just tell that the person on with the loudest voice on that committee loves Formula One and would have been like, you know what?

We've got a budget.

Do you think we could get like a Formula one?

It's like, I don't know.

I don't know.

Someone being a massive Taylor Swift fan saying, but maybe we could get Taylor Swift to do a video or, you know, we'll, you know, it's like.

But you're just.

What?

Taylor Swift would be a good choice.

We've got Swift on security.

I agree.

Funnily enough, Taylor Swift could talk about the fact that she had to cancel the number of her concerts because of the bomb threat.

And also, it's like incident management.

You've actually, you know, there's a link right there.

So that's.

Maybe that's my Seaside's talk, what Taylor Swift can teach us about security.

Sorry, carry on.

There you go.

I want to push back on that, though, because I don't want to engage with these large conferences to tell them how to add value, because I don't think it's possible.

There's an issue that quality doesn't scale.

My answer to how do they actually add value?

Would be, well, you take your massive, oversized conference and you split it into 100 smaller events and you space them around and you target them at appropriate audiences instead of trying to capture everyone.

And you select the appropriate vendors for those and you select the appropriate talks and you break it up.

You don't try and just make it massive for the prestige.

You actually make it small and targeted and tailored, and that's how you engage.

You can't do it at size.

Agreed, James.

And also, don't we just have a plethora now of events every day?

My inbox is full with invites to this event, that event.

Come to this conference, come to this roundtable, come to this dinner, come to the.

We are over saturated, we really are with events.

We could be now going to something.

Infosec years ago used to mean something.

It was the big event of the year.

We are so saturated now with events and conferences and as Gary rightly said, time absolutely valuable.

We could be going to something every day of the week if we were so minded.

It's insane the amount that's out there.

Sorry, I was on my.

I think you are absolutely right.

And to tie those two things, what you've just said there and what James just said, you know, these events, you know, there used to be a phrase networking is not working.

And I think that's the problem that, you know, we could, like you said, you could fill our diaries up and salespeople could come back and say, I've been to 20 events this, this month.

And you were like, so what have you done?

What?

You know, have you got any sales?

Have you done anything?

It's like, no.

How many leads did you get?

How many leads did you get?

How many meetings have you had?

How many conversations?

How many, whatever.

But interestingly enough, what James said and I would support him on this is.

I mean, first of all, I'm up for talking to anyone, as my wife will attest.

I will turn up to the opening of an envelope if you want to talk to me about security and I will happily talk to Infosec or whoever and tell them where they're going wrong.

Conversely, they could just come to the Real Cyber Awards and conference in October in York, 30th of October.

Just, I've just throw that in there.

No, but the point is they, they, they've got lessons to learn and I'd be more than happy to, to talk to them about it.

But to James point, interestingly enough, like in Leeds, you have the Leeds Digital Week, which is just a week full of events, small events popping up all around and it's on a website and it's all these free talks at pubs in.

You know, an accountant or a law firm might open up their offices and run an event and they just pop up for a week.

Just lots of different small events leads.

Digital Week, that kind of thing is brilliant because it brings all those fringe events into one place.

They still have sponsors.

Yeah, but it's to, to James's point, you can go, oh, well, I want to learn about human risk management, so I'm going to go to that.

Or I want to learn about offensive defense.

You know, it's like, I'll Go to that event or you.

I want to.

Actually, I do want to learn a little bit more about OWASP or grc.

There's two different events.

Right.

Which one am I going to go to?

They're the kind of things that definitely get more engagement, I think.

And having a.

Having that consolidated in a city or in a, you know, a central location, I think is.

Is genius.

I think he's a great idea.

Gary.

We have exactly this.

We have Worcestershire Tech Fest in February.

Very similar to Leeds Digital Week.

It's around about a week to 10 days of events exactly like that at different organizations, different venues across the county.

Brilliant.

Few days of stuff.

Real value in that.

Yeah, but not vendor led.

That's the key thing.

No.

Yeah.

Times are changing.

Times marketing has changed.

You know, I mean, look at webinars.

We do much better than any webinar ever with this podcast nowadays.

We're not trying to sell stuff like a lot of other podcasts out there.

And we probably get more engagement than infosec is going to get this year, let's be honest.

Anyway, our time has come to an end and it's been absolutely fantastic talking to you guys all and about know, fringe events, big events, small events, the fact that, you know, events are starting to charge and that kind of thing.

It's very important.

And I'll.

I'll report back on how it goes.

I mean, I will try to meet up Gary, with you down there.

Did you say you were going?

Yes.

Yeah, I'll be there the second and third.

Some beers will be had and I'll look forward to seeing you, Lisa as well.

But obviously, James, you're not going, so I'll have to meet you another time, another event.

B sides.

Yeah, I'm fantastic.

I'm not sure if I'm going.

I literally won't know until probably the weekend to even the Monday before if I'll go or not.

So.

Yeah, I have to see if you're there.

Yeah, I look forward to seeing it.

If you're not, we'll catch up another time.

But for all of you out there, thank you ever so much.

We have been seeing significant amounts of traction.

It's really, really good.

The reason we started this podcast was we could actually get some property conversations going outside of Vendorland and it seems to be working.

So thank you to all of you in the us, the uk, Europe, South Africa and the UAE who spend a lot of time checking out our podcast.

We never thought we would get this big.

So thank you ever so much for all of that and we will be bringing you all kinds of new content over the next God knows how long.

We've got a long list and portfolio of things that people have DM'd me via LinkedIn or sent through the website.

So if you want to mention something that we you want us to talk about, maybe I can grab some of these fantastic people to come back and discuss this important aspect of what we're trying to do.

Just get in contact and we'll make it happen.

But for all of you out there, thank you very much, have a great day and maybe I'll see you at Infosec.

See you later.

In addition, I do have a book recently come out, the Cyber Sentinel's Handbook, A primer for Information Security Professionals.

Now this book is very much geared up towards professionals at all levels of their career, be they starters, be they newcomers, be like people have been in there for a little while and maybe looking for a little bit more direction, albeit the older ones looking to maybe reground themselves in some of the more important aspects of the trade that maybe they've forgotten over time.

I've had lots of good feedback from a lot of different readers at lots of different levels, so please feel free to get yourselves a copy.

We've got the E copy, we've also got the paperback copy and if you don't want to spend any money, you can go on Kindle Unlimited and read the book for free there as well.

Thank you ever so much again.

Look after yourselves and we'll be seeing you again soon.