SEC504: Hacker Tools, Techniques, and Incident Handling

Experience SANS training through course previews.
Learn MoreLet us help.
Contact usConnect, learn, and share with other cybersecurity professionals
Engage, challenge, and network with fellow CISOs in this exclusive community of security leaders
Become a member for instant access to our free resources.
Sign UpMission-focused cybersecurity training for government, defense, and education
Explore industry-specific programming and customized training solutions
Sponsor a SANS event or research paper
We're here to help.
Contact UsAfter a decade of chairing events, I’m sharing why certain talks get selected and how to improve your chances of being accepted for future events.
We are super excited to announce the Call for Presentations (CFP) for the 2025 SANS Security Awareness Summit, the premier event focusing on the human side of cybersecurity. Having chaired this and other events for the past ten years, I want to share insights into why certain talks get selected and how you can improve your chances of being accepted. Speaking at conferences is not only a great way to expand your network and build your brand but also a tremendous opportunity to give back to the community.
First, a bit about the review process. Every organization has a different way of reviewing submissions. At the SANS Security Awareness Summit, we use an Advisory Board of 10-12 volunteers who review and score each submission. A group-based review helps balance subjectivity, as members come from diverse backgrounds and have different priorities.
Once submissions are scored, we begin the selection process:
The goal is to create a diverse agenda that meets attendees’ needs. Remember, the reviewers often go through 50-100 submissions, so they can’t spend a lot of time on each one. To improve your chances, ensure your submission is clear, concise, and to the point.
1. Follow the Guidelines: First and foremost, read and follow the submission guidelines. Most conferences or summits provide detailed instructions on topics they are looking for and common challenges the community is attempting to solve. These guidelines exist to help you succeed. Still, 10-15% of the submissions we receive are disqualified simply because they fail to meet basic requirements.
2. Choose a Relevant and Specific Topic: Your topic significantly impacts your chances of being selected. For example, the Awareness Summit focuses on security behavior and culture. Talks on security information and event management (SIEM) infrastructure, red teaming, or identity and access management (IAM) deployments won’t be selected. Vendor pitches are also an automatic rejection.
The strongest submissions address specific problems the community is struggling with, such as:
A weaker submission might be “How I Built My Awesome Security Culture Program”—this is too broad and focuses more on the speaker’s accomplishments than actionable insights. Remember, your talk should emphasize how your experiences can help attendees and help contribute to the Awareness community overall.
3. Craft a Clear and Concise Abstract: Your abstract is the most important part of your submission—it’s the Advisory Board’s window into what your talk is about. Prioritize clarity over cleverness. Many rejections happen because the abstract is confusing or scattered. If your abstract is long, rambling, or confusing, the assumption is that your talk will be too.
A good abstract should:
Length is also important. The average accepted abstract is 200-500 words. Some submissions have exceeded 3,000 words, making it difficult to determine the main focus of the talk.
4. Focus on Audience Benefit: The goal of any talk is to help your audience. Avoid focusing on yourself. Instead, share lessons learned and real-world action items attendees can apply at work. Don’t tell us how awesome you are, share knowledge that attendees will benefit from.
5. Embrace Failures as Learning Opportunities: Share your failure stories! We all make mistakes, but we often have a hard time sharing them. Don’t be afraid to share your failures and the lessons you learned. Attendees love these stories as they are powerful learning events, and we can all easily relate to making mistakes.
6. Seek and Accept Feedback: If an event provides feedback on rejected submissions, take advantage of it! However, be prepared to receive constructive criticism. Do not get defensive. Instead, embrace the feedback to improve future submissions.
If your talk isn’t selected, don’t get frustrated. The selection process is very competitive, and sometimes multiple submissions cover the same topic. Continue to refine and learn from each submission process, take feedback into consideration, and you will get a chance to speak!
Lance revolutionized cyber defense by founding the Honeynet Project. Over the past 25 years, he has helped 350+ organizations worldwide build resilient security cultures, transforming human risk management into a cornerstone of modern cybersecurity.
Read more about Lance Spitzner