Detection Engineering and Threat Hunting
Conference 8-9 November 2025
DATE
8-9 November 2025
locations
Tacoma, San Diego, Austin, Orlando, Montreal, Córdoba, Edinburgh, Amsterdam, Bonn, Oslo, Kuala Lumpur, and Online
Organizers
Countdown to DEATH
About the event
- DEATHCon is a globally-distributed cybersecurity conference for Detection Engineering and Threat Hunting (DEATH).
- The conference is 100% hands-on: Workshops, Hacking Laboratory, and Capture-the-Flag.
- All the workshop instructions are pre-recorded for convenience in all time zones.
- The workshop leaders are available through Discord chat at convenient times in their home time zone.
In-Person Gatherings
All the content and the lab environment are available to participants online - there is no need to travel anywhere to learn from the Workshops and get help from the workshop leaders. However, if you would like to meet other DEATH practitioners in person, enjoy some food and beverages together, and collaborate in-person, there are ten locations around the world that will be hosting DEATHCon gatherings for groups of 10 to 50 people, depending on the location. On-Site tickets are sold separately by each site organizer, and include access to all the same content as an Online ticket.
Workshops
Hands-on workshops to learn detection engineering skills are the heart of DEATHCon.
See 2024 workshops or 2023 workshopsLab Access
Join your VMs to our detection engineering lab keep learning through the end of the year (or later!)
Time Zones!
All the videos are recorded, so you can watch workshop videos in your time zone or weeks later.
Pay what you can
Online ticket prices are flexible, or you can volunteer to help for a free ticket.
VolunteerCFP: Call for Workshops, Call for Volunteers
CFP: Workshop Proposals
If you would like to lead a workshop, please first review some of the successful workshops from past years to get an idea about what has worked well before. A wide range of topics from using offensive security tools for purple teaming to writing queries in KQL/Splunk/Elastic, or malware analysis to write YARA rules, etc. Workshop leaders attend free, get an exclusive challenge coin, free swag, and some travel expenses paid if you want to attend one of the sites! If you identify with an underrepresented group in cyber, we would especially love to have you lead a workshop!
Submit your response to the CFP here.Volunteer
If you would like to help set up and run the lab environment, we need people in many time zones to help keep the lab running smoothly. Volunteers get a free (online) ticket, an exclusive hoodie just for crew, and many thank-yous from attendees. We also need a couple of volunteers to help run logistics at the Seattle site (free in-person ticket and food).
Submit your application to volunteer here.Workshop Videos from Past Years
All the workshop materials remain the property of the workshop leaders. Some workshop leaders have chosen to release their materials publicly after DEATHCon is over, and we encourage all to share the learning for free!
Hands-on RPCFW for hunting and protection (2023)
Building a Malware Analyzer with Machine Learning (2023)
Building a Malware Analyzer with Machine Learning (2023)
Pricing table (USD)
Online Ticket
Participate from your home in any time zone!
$170
- Or, pay-what-you-can discount!
- VPN and Lab Access for 2+ months
- Search logs in Sentinel, Elastic
- Discord Access
- Long-term access to workshop recordings on Skool
In-Person Gatherings
Sold by site organizers, price depends on site
$350+
- Includes Online ticket in price
- Lunch provided both days
- Dinner and drinks provided Saturday
- Refreshments on-site
- See site-specific details
T-shirts and SWAG
Sold separately to keep ticket cost low
$20+
- Shirts
- Hoodies
- Shipped direct to you
- All proceeds go to support KC7 Cyber Foundation to provide free education!
Important Dates
29 March 2025: CFP Opens, Workshop and Volunteer Applications Open
1 June 2025: First Round CFP Acceptance, CFP will remain open
1 July 2025: Early ticket sales (for past years attendees)
12 July 2025: Ticket sales general availability (round one)
7 Sept 2025: Ticket sales (round two)
7 Sept 2025: Lab Network and Architecture Planning Starts
6 Oct 2025: Lab Available for Workshop Leaders
27 Oct 2025: Workshop recordings and materials are due from workshop leaders
8-9 Nov 2025: Conference!
31 Dec 2025: Lab will remain available at least until end of year.
Feb/Mar 2026: Stretch goal to keep lab available (if funds permit).
Get your tickets
Tickets will go on sale July 12 for round one sales. We'll hold some online tickets in reserve for round 2 sales on September 6.
Online tickets and Seattle site tickets are sold by Randy.
Tickets for all other sites are sold by each site organizer, and local taxes may apply.
