Some Defcon attendees discuss why people are still getting hacked and what the cybersecurity community needs to do better
The cybersecurity industry is worth billions of dollars, and tens of thousands of people attend Black Hat and Def Con every year. So, are we getting any safer?
Context & Ripple Effects
A year after reporting showed [[a:933790|corporate demands, professionalization, and bug bounty programs reshaping hackers' attitudes toward privacy and anonymity]], VICE returned to Defcon with a harder question: with a cybersecurity industry worth billions and tens of thousands attending Black Hat and Def Con annually, why are people still getting hacked? The question lands against concrete evidence from the same floor — the prior year's Voting Village hacks, including by an 11-year-old, which vendors and officials tried to downplay.
First-order effects
- Attendees' critique puts pressure directly on the vendors and officials who dismissed Voting Village findings, forcing a public argument over whether conference-stage demonstrations translate into fixed products.
- Researchers weighing corporate employment and bounty programs against independent disclosure face the trade-off the attendees name: the professionalized pipeline pays, but pulls attention toward sanctioned targets.
Second-order effects
- Conference organizers respond by formalizing what was once ad hoc — dedicated villages and structured challenges become the mechanism for channeling attendee skill at named problem areas like voting machines.
- Vendors of exposed systems face a recurring annual spotlight: each Defcon cycle re-tests their products before press and policymakers, raising the cost of downplaying results.
Third-order effects
- If the pattern holds, the hacker conference completes its shift from countercultural gathering to instrument of state and industry security policy — a trajectory the corpus already shows reaching a 2,200-person, White House-backed generative-AI vulnerability challenge at Def Con's AI Village.
- The industry's core tension — billions in spending coexisting with persistent breaches — pushes the field toward measuring defense at the ecosystem level rather than per-product, since individual tools demonstrably aren't closing the gap.
The trend: Defcon is evolving from an underground gathering into an institutionalized proving ground where government and industry direct hacker scrutiny at specific technologies, even as the industry's overall safety record remains contested.