Pentesters, incident responders and researchers learn most from people who do the same work. Those people rarely gather at the big vendor shows. They go to community and research events, which sell tickets in rounds, packages or cash lines that are easy to miss.
This page covers practitioner and research events in 2027. For each one you get dates, the venue and the cheapest published ticket that gets you into the talks, taken from the organizer's own site. If a 2027 price is not out yet, the table says Not announced. The large buyer and vendor shows, like RSAC and Black Hat, are on our cybersecurity conferences page.
Prices change between sale rounds, so confirm the live figure at checkout. The method is on How we review tools.
Nullcon Goa 2027
Nullcon Goa 2027 is India's long-running hacker and security research conference. Trainings run February 24-26, Day Zero is February 26, and the main conference is February 27-28, 2027. The venue is the Urja Bharat Convention Center (UBCC) at ONGC Goa. In-person.
Best for: Researchers, pentesters and security engineers in India and nearby regions. Teams that want trainings and research talks for far less than a US or European ticket.
Dates and city: Trainings February 24-26, Day Zero February 26, conference February 27-28, 2027. UBCC, ONGC Goa, India. In-person. Official event page.
What you actually get: Two conference days plus a Day Zero, with three days of trainings before. Conference, training and bundle passes are sold separately. Prices are shown in rupees and US dollars.
Notable limitations:
- All rates exclude taxes, and payment gateway charges apply.
- The super early bird rate ends November 12, 2026. The early bird rate runs to January 7, 2027, then the regular rate applies until sold out.
- The corporate pass costs more than the individual pass. Check which one your employer needs.
Tickets: Individual conference pass ₹8,499 / $155 super early bird, ₹9,999 / $180 early bird, ₹11,999 / $215 regular. Student conference pass ₹5,000 / $100. Corporate conference pass from ₹12,499 / $225. 3-day training pass from ₹44,999 / $805. All excl. taxes.
FIRST Conference
The 39th Annual FIRST Conference is the yearly meeting of FIRST, the global forum of incident response and security teams. June 13-18, 2027, at the Queen Sirikit National Convention Center (QSNCC) in Bangkok. Hosted by ThaiCERT and NCSA. In-person.
Best for: Incident responders, CSIRT and PSIRT teams, and the people who coordinate vulnerability disclosure. Teams that want contacts at other response teams before the next incident.
Dates and city: June 13-18, 2027. Queen Sirikit National Convention Center, 60 Ratchadaphisek Road, Khlong Toei, Bangkok. In-person. Official venue page.
What you actually get: Six days with peers who handle incidents for a living. FIRST member teams pay a lower rate than non-members. Registration is open now. FIRST says it is still securing discounted hotel options.
Notable limitations:
- The early-bird rate ends February 26, 2027. The late rate after April 30 is $3,800 for non-members.
- Registration may close before June 8, 2027 if it fills.
- No conference hotel is announced yet.
Tickets: Non-member or liaison member: $2,950 early bird (through February 26, 2027), $3,250 standard (through April 30), $3,800 late. FIRST team member: $1,700 early bird, $2,250 standard, $2,800 late.
TROOPERS27
TROOPERS27 is a practitioner security conference in Heidelberg, Germany. June 21-25, 2027. Two training days, then three conference days. The main conference venue is halle02. In-person.
Best for: Offensive and defensive practitioners who want deep technical talks and hands-on trainings at a smaller event than the big shows.
Dates and city: Trainings June 21-22, conference June 23-25, 2027. halle02, Zollhofgarten 2, 69115 Heidelberg, Germany. The training venue is still to be announced. In-person. Official site and travel page.
What you actually get: A Conference Package for the three conference days, or an All Inclusive package with trainings and conference. Snacks, lunch, a shared Wednesday dinner and a welcome shirt are included. Roundtables are only available with a conference booking.
Notable limitations:
- All packages exclude 19% VAT.
- The current price is the Enthusiast Rate. The page shows the saving, so later rates are higher.
- Student rates were dropped. Students are pointed to a separate special-offer page instead.
Tickets: Conference Package 2,190€ (Enthusiast Rate, saves 400€). Two days of trainings 2,690€. All Inclusive 3,590€ (saves 900€). Academic rates with proof of eligibility: Conference & Roundtables 1,390€, All Inclusive 1,990€. All excl. 19% VAT.
DEF CON 35
DEF CON 35 is the August hacker convention in Las Vegas. August 5-8, 2027, at the Las Vegas Convention Center. Villages, contests and talks run in parallel. In-person.
Best for: Hackers, researchers and practitioners at every level. Students and early-career people who want to meet the community. Teams already in town for Black Hat USA.
Dates and city: August 5-8, 2027. Las Vegas Convention Center, Las Vegas. In-person. Official site.
What you actually get: One registration covers the event. Much of the program sits in the villages and contests, not only the main talks. The 2027 price is not posted yet.
Notable limitations:
- No 2027 registration price yet.
- In 2026 the online price rose in steps from early bird to late, so buying early was cheaper.
- The 2027 talk schedule is not published yet.
Tickets: Not announced for DEF CON 35. For reference, DEF CON 34 in 2026 sold online at $560 early bird ($540 plus a $20 card fee), $580 regular and $600 late. Cash at the door was $520.
Was DEF CON cheaper with cash at the door?
In 2026, yes. Cash at the door was $520, versus $560 to $600 online. The 2027 terms are not posted yet.
Still to come in 2026
40C3, the 40th Chaos Communication Congress, runs December 27-30, 2026 in Hamburg, in the Hamburger Messehallen. The standard ticket is 200€. Supporter tickets are 230€, 265€ and 310€, and an Up-and-coming ticket is 60€. Tickets sell in fixed rounds: open sale on November 8 at 11:00, November 11 at 18:00 and November 19 at 20:00 (CET).
Other InfoSec conferences worth considering
BSides Las Vegas ran August 3-5, 2026 at The Tuscany in Las Vegas, the same week as DEF CON. The site does not list 2027 dates yet.
OffensiveCon ran May 15-16, 2026 in Berlin. It is a small offensive research conference. The 2027 dates are not on the official site yet.
REcon is a reverse engineering and security conference in Montreal. The official site does not list the next dates. This page will not guess them.
How we picked these conferences
We shortlisted practitioner, community and research security events whose 2027 edition has exact dates on the organizer's own site. A missing price did not exclude an event, which is why DEF CON 35 is in. Dates and prices were checked on the organizers' sites on 5 Nov 2026. In the table, "From" is the cheapest published ticket that includes the talks. "Not announced" means the organizer has not published a 2027 price yet.
FAQs
Which event fits incident responders?
The FIRST Conference in Bangkok, June 13-18, 2027. It is built around response teams. FIRST member teams pay $1,700 early bird instead of $2,950.
What does Nullcon cost from outside India?
Nullcon lists dollar prices next to rupee prices. The individual conference pass is $155 at the super early bird rate, $180 early bird and $215 regular, excl. taxes.
Can I do Black Hat USA and DEF CON on one trip?
Yes. Black Hat USA runs July 31 to August 5, 2027 and DEF CON 35 runs August 5-8. Black Hat is covered on our cybersecurity page, linked above.
Is TROOPERS worth it if I only want talks?
Buy the Conference Package for the three conference days. It is 2,190€ excl. VAT at the current rate. Add trainings only if you have a specific course in mind.
Where are the OWASP events?
On our AppSec conferences page. It covers Global AppSec, LASCON and other application security events.
Bottom line
Pick by the people you want to learn from. For incident response, book FIRST before February 26. For research talks on a smaller budget, look at Nullcon Goa in February and buy before the rate steps up. For deep technical sessions in Europe, book TROOPERS while the current rate lasts. For the wider hacker community, plan for DEF CON 35 in August and wait for the price.
