Every August, roughly 50,000 security professionals converge on Las Vegas for a week that the community calls Hacker Summer Camp: three back-to-back conferences that run concurrently, overlap deliberately, and demand completely different strategies to survive. In 2026 the compressed schedule is tighter than usual. BSides Las Vegas runs August 3–5, Black Hat USA Briefings hit August 5–6, and DEF CON 34 opens August 6 and closes August 9. For two of those days, three conferences are running simultaneously in three different parts of the city.
Attending all three is possible. Attending all three well is a logistics problem. This guide covers what the conferences actually are, how to plan a week that doesn’t leave you broken by Saturday, and the specific tactical decisions — which badge to buy first, where to sleep, which nights to prioritize — that separate people who get real value from those who just collect swag.
What Each Conference Actually Is
The three events share a city and a week but serve fundamentally different purposes. Treating them as interchangeable is the first and most common mistake.
BSides Las Vegas is the community-run, nonprofit warm-up. It runs August 3–5, 2026 at the Tuscany Suites & Casino just off the Strip, and 2026 marks an expansion to two and a half days from the historic two-day format. Badge price runs around $110 and — critically — walk-ins are not permitted. Capacity is capped by the venue and the fire marshal, badges distribute through a donor drive and a hotel room block, and once they’re gone, they’re gone. If this is on your list, lock it down months in advance.
Black Hat USA is the corporate flagship. It runs August 1–6, 2026 at the Mandalay Bay Convention Center, with four days of paid Trainings (August 1–4) followed by two days of Briefings (August 5–6). This is where vendors demo, analysts publish, Fortune 500 CISOs take meetings, and the highest-production-value talks of the year get delivered. Full Briefings passes run into four figures; Trainings add several thousand more. Budget accordingly.
DEF CON 34 is the hacker conference. August 6–9, 2026, returning to the Las Vegas Convention Center West Hall. Cash at the door, no pre-registration required, villages covering everything from car hacking to voting machines to biohacking, contests, parties, and a culture that explicitly rejects Black Hat’s corporate polish. The DEF CON 34 CTF Qualifier runs May 22–24, 2026 if you want to compete for a finals slot before you even arrive.
Pick Your Week Before You Book Anything
The single biggest mistake first-timers make is trying to do everything. You cannot. The conferences are geographically spread — Mandalay Bay at the south end of the Strip, Tuscany off-Strip near Flamingo, the Las Vegas Convention Center at the north end — and even an Uber between them in peak conference traffic can eat 30–45 minutes. Attending a Wednesday BSides morning session and a Black Hat Briefings afternoon talk means burning the middle of your day on transit.
Decide what kind of attendee you are and commit. Three archetypes cover most people:
The corporate attendee has an employer paying for Black Hat Briefings, probably has vendor meetings scheduled, wants the analyst briefings and the exec networking. For them, DEF CON is optional decompression and BSides is a rumor. Book Mandalay Bay or a nearby Strip property, plan the week around the Briefings track, and consider staying through Friday at DEF CON for the technical talks Black Hat didn’t select.
The practitioner attendee is paying out of pocket or on a modest training budget. BSides and DEF CON deliver the best dollar-per-insight ratio by a wide margin — BSides at roughly $110 and DEF CON at a few hundred cash at the door. Skip Black Hat Briefings unless a specific talk is unmissable. Book a hotel closer to Tuscany and LVCC.
The full-camp attendee is doing all three, likely because the employer is paying and the calendar lines up. The hard decisions here are about which days to sacrifice. Expect to skip Black Hat Briefings sessions to catch DEF CON opening, and expect to miss BSides Wednesday morning to get to Black Hat.
Hotels, Badges, and the Things That Sell Out Months Early
Hacker Summer Camp books the city. Properties within walking distance of the venues go first, and room rates in the week of August 3–9 run significantly above off-season Vegas pricing. Book by late spring or accept a longer commute.
DEF CON 34 publishes an official room block at the Fontainebleau, Sahara, Wynn/Encore, and Circus Circus — all close to the Las Vegas Convention Center. The Fontainebleau sits directly across the street from the LVCC and is the premium choice if you want a 90-second walk to DEF CON. Black Hat’s block is concentrated at and around Mandalay Bay. BSides runs its own block at the Tuscany, with badges tied to that block through the donor drive program.
BSides badges deserve their own warning. They are not sold at the door. Every year a meaningful number of people show up at Tuscany expecting to buy in and find out the fire marshal doesn’t allow it. The paths to a badge are the donor drive (opens in spring), the hotel room block (reserved badges for guests), volunteering, or speaking. If BSides is on your list, handle it in April or May.
What Each Conference Rewards
Understanding what each event is optimized for will reshape what you prioritize once you’re there.
Black Hat Briefings reward preparation. The talk list publishes weeks in advance, rooms fill, and the best sessions have lines. Read the schedule, flag your must-sees, arrive at least 15 minutes early for anything with a well-known speaker, and treat the hallway track as a place to find the analysts and vendors you already wanted to meet. The Business Hall is where vendors demo and where you collect actual intelligence on what products do versus what marketing claims — spend real time there, not just the swag lap.
BSides Las Vegas rewards conversation. The talks are excellent, but the real value is in the Proving Ground track (first-time speakers), the career rooms, the pool, and the hallways. The culture actively discourages the corporate posturing that creeps into Black Hat. If you’re job-hunting, burned out, new to the field, or want to talk about policy and mental health and the non-technical side of the industry, BSides is where that conversation actually happens. Go to the pool at night. The pool is where Summer Camp happens.
DEF CON rewards wandering. The talk track is strong but the villages are the point. IoT Village, Car Hacking Village, AppSec Village, Social Engineering Community, AI Village, the Telecom Village’s 5G focus — you can spend an entire day inside one village and another entire day never setting foot in a talk room. Contests run throughout: the DEF CON CTF finals (for teams that qualified in May), the Social Engineering competition, lockpicking, badge hacking. Bring cash — registration is cash only, and some village activities are too.
The Operational Security You Actually Need
The “hostile network” warnings around DEF CON are part folklore, part real. The Wall of Sheep — the village that publicly displays credentials sniffed off the conference network — is still operating, and it still catches people every year. The baseline precautions are not optional:
Leave the daily-driver laptop at home if you can. Bring a loaner, a freshly imaged machine, or at minimum a machine you’ve backed up. Full-disk encryption on everything. Use a VPN you trust — many attendees run their own rather than trusting a commercial provider for the week. Disable Bluetooth and Wi-Fi when you’re not actively using them. Burner credentials for anything you log into from conference networks. Do not use the ATMs inside or immediately adjacent to DEF CON venues.
Cell service degrades badly in DEF CON halls when tens of thousands of people are all on their phones. Plan for offline, download any maps or schedules in advance, and don’t rely on streaming anything.
The Party Math
Summer Camp nights are a conference in themselves. Vendor parties run every night of Black Hat and DEF CON — most require RSVPs that fill up weeks in advance, some require invitation from a specific sales rep. Queercon, the Hacker Karaoke, the BSides pool party Tuesday night, the DEF CON Saturday night parties, badge-hacking meetups, team dinners — the social graph rewards people who plan.
The tactical advice: don’t try to hit every party. Pick two or three nights to go hard, take at least one night completely off, and respect that you cannot drink Sin City cocktails for six straight nights and still absorb technical content during the day. The people you see on Sunday at DEF CON closing ceremonies looking destroyed are the people who tried.
Pace is not optional. The conferences run long days in cold rooms on hard floors, the Strip walking distances add up to five or more miles a day, and the altitude-plus-dehydration combo catches people off guard. Water, sleep, and at least one real meal a day are the minimum. Bars and the “con flu” are real things; half the Slack channels on the flight home will be people reporting fevers.
Frequently Asked Questions
Can I skip Black Hat and just do BSides and DEF CON? Yes, and many experienced attendees do exactly that. BSides plus DEF CON costs under $500 in badges combined and delivers most of what makes the week valuable. Black Hat is worth it if someone else is paying or if specific Briefings or Trainings map directly to your work.
How early do I need to fly in? Arrive Sunday August 2 at the latest. Monday morning lines at the Tuscany for BSides are real, and a Sunday arrival gives you recovery time before the marathon starts.
Is DEF CON beginner-friendly? Yes, explicitly. The villages and contests are the point, and most run introductory content specifically for newcomers. The “DEF CON is only for elite hackers” reputation is outdated. Show up, wander, ask questions, and don’t pretend to know things you don’t.
What about badges for sale on the secondary market? BSides badges occasionally surface on resale at a markup; proceed carefully and only through people you trust. Black Hat passes are tied to registration details. DEF CON takes cash at the door and has no pre-registration, which eliminates the problem entirely.
The Honest Summary
Hacker Summer Camp 2026 will chew up anyone who treats it like a normal conference week. The payoff — the density of talent, the quality of hallway conversations, the hands-on learning in villages, the reconnection with a distributed community that only gathers in one place once a year — is real and hard to replicate. But it requires picking a strategy before you book a flight, defending your time once you arrive, and accepting that you will miss most of what’s happening around you. Plan for the week you can actually live, not the week the schedule makes possible on paper. The people who come back every year figured that out after their first trip.
