Every August, Las Vegas turns into the most adversarial wireless environment on the planet for one week. In 2026 that week is expected to run from roughly August 1 through August 9, stacking three events back to back: Black Hat USA, BSides Las Vegas, and DEF CON 34. The crowd is part of the appeal and part of the threat model. You are walking into a building full of people who do this for a living, some of whom will absolutely poke at your devices for fun. This is a preview and a planning guide written before the events happen, so treat the schedule notes as logistics and the talk content as expectation-setting, not recaps.
Here is the expected shape of the week, based on the organizers' published plans; confirm the specifics against the official sites before you book anything. Black Hat USA is slated to run August 1 through 6 at the Mandalay Bay Convention Center, with the bulk of the week given to Trainings and the two-day Briefings main conference landing around August 5 and 6. BSides Las Vegas typically runs in the same window, hosted at the Tuscany Suites and Casino. DEF CON 34 is expected to run August 6 through 9 at the Las Vegas Convention Center, opening as Black Hat winds down. That overlap is the whole reason the week earns the "Summer Camp" nickname, and it is also why pacing is a real skill and not a joke.
Your Threat Model Is Not Paranoia Here
At most conferences, default device hygiene is fine. Here it is not. DEF CON in particular is a venue where the network, the chargers, the QR codes, and occasionally the badge are all fair game. You do not need to assume nation-state targeting. You do need to assume that a curious attendee will scan, sniff, and spoof everything in range because the environment rewards it.
The practical stance is simple. Carry as little sensitive data and as few authenticated sessions as you reasonably can. Anything you bring should be something you would be comfortable wiping on the flight home. The goal is not to be unhackable, which is a fantasy. The goal is to make yourself a low-value, high-effort target so that the opportunistic stuff slides off.
Devices: Burner, Hardened, or Stay Home
The cleanest option is a dedicated burner phone and a loaner laptop that hold none of your real accounts. That is overkill for many attendees and genuinely correct for some. If you handle incident response credentials, customer data, or production access, the burner is not theater — it is the right call.
If a burner is not realistic, harden what you bring. Full-disk encryption on. Screen lock down to the shortest tolerable timeout. Bluetooth and Wi-Fi off unless actively in use, because passive discovery is how a lot of the fun starts. Remove or sign out of apps you do not need for the trip. Turn off automatic Wi-Fi network joining so your phone stops broadcasting the name of every network it has ever loved.
Two specific habits matter more than any single setting. First, do not plug into public USB ports or borrowed cables — carry your own charger and a data-blocker, or use a battery pack. Juice-jacking is old news precisely because it still works. Second, treat any "free" hardware, dongle, or thumb drive you are handed as hostile until proven otherwise, which in practice means never.
Network Hygiene Without the Hype
Use cellular over Wi-Fi by default. Modern carrier data is encrypted at the link layer and far less hostile than a conference SSID you cannot verify. If you must use Wi-Fi, the official DEF CON secure network has historically been one of the better-run wireless networks anywhere, but verify the exact connection details on site rather than trusting a name that matches.
Run a VPN you actually trust, and understand that a VPN protects the transport, not the endpoint. It does nothing for a phished credential or a malicious app already on your device. Turn off AirDrop, file sharing, and any "discoverable" mode. Assume DNS is observed. None of this requires a tinfoil hat; it requires turning off the conveniences that leak data when nobody is attacking and become liabilities when someone is.
One more underrated control: reduce the number of live sessions you carry. Sign out of email, cloud consoles, and anything with standing access before you travel, and sign back in deliberately. A stolen device with no active sessions is a much smaller problem than one logged into your identity provider.
Choosing Talks Without Losing Your Mind
There are more good talks than any human can attend, and the schedule is intentionally brutal. Pick a thesis for your week instead of trying to see everything. Two or three themes, chosen in advance, will get you more value than a packed calendar you abandon by Wednesday.
As a preview rather than a recap, expect the 2026 floor to lean heavily into a few areas that have dominated the year's research. Agentic AI security is the obvious one: as teams wire LLM agents into real systems with real tool access, the attack surface around prompt injection, tool poisoning, and over-permissioned autonomous agents has become a serious research lane. Software supply chain attacks remain a perennial, and the conversation has matured past "scan your dependencies" into provenance, attestation, and the messy reality of third-party risk. Post-quantum cryptography and crypto-agility will get airtime too, driven by migration deadlines rather than any new break. Read the actual abstracts when the schedules finalize; the titles oversell and the abstracts tell you whether the work is real.
A note on the demos. Vendor floor demos are marketing. The Villages — Car Hacking, AI, Aerospace, IoT, and the rest — are where you get hands on something real. Budget time for at least one Village even if it is not your specialty, because that is where the week stops being a lecture series and starts being a hacker conference.
Networking and Pacing: The Part Nobody Preps For
The hallway track is genuinely where the value is, and it is also where people burn out. Vegas in August is brutal heat outside and aggressive air conditioning inside. The convention floors are enormous. People routinely walk ten-plus miles a day, sleep four hours, and wonder why they are useless by Friday.
Hydrate harder than feels necessary. Eat actual meals on a schedule, because the day will happily eat them for you. Wear shoes you have already broken in, not the new ones. Build deliberate downtime into the schedule — an hour in your room beats an hour pretending to absorb a talk you are too fried to follow. Set a hard "last drink" rule, because the social calendar after dark is relentless and a hangover is a self-inflicted denial-of-service on your own week.
For networking, quality beats volume. A handful of real conversations with people working on problems you care about will outlast a stack of badges you scanned. Bring a way to share contact info that is not your unlocked phone. Follow up the week after, when everyone is home and not running on no sleep.
How Safeguard Helps
A lot of what you will hear about this August — agentic AI risk, prompt injection, and the software supply chain — is exactly the territory Safeguard works in the rest of the year. Safeguard is a software-supply-chain and AI security platform built around our Multi-Agent TAOR Deep Think AI Engine, with Griffin AI, AIBOM and ML-BOM inventory, provenance and attestation, and policy gates that turn conference-floor anxiety into enforceable controls. We are deliberately model-agnostic: bring your own model, and the reliability lives in the verification and orchestration layer above it, where multi-agent verification cuts false positives so you act on verified findings instead of noise. If you want to talk through how this maps to your environment after Summer Camp, reach out.