Where the research that breaks things gets presented.
OFFCON is a platform and a conference. The conference is the stage: advanced offensive research — red teaming, exploit development and zero-day disclosure — presented by the people who did the work, to an audience that does it too. It is where researchers from major technology companies and Pakistan's security community end up in the same room.
What gets presented
Red teaming & adversary simulation
Full-scope operations against real defences: initial access, evasion, lateral movement, and the tradecraft that separates a checklist pentest from an operation a blue team actually has to work to catch.
Zero-day & vulnerability research
Original findings, disclosed responsibly. New bug classes, novel exploitation of old ones, and the process of taking a vulnerability from a crash to a working, reliable primitive.
Exploit development
Memory corruption, browser and kernel exploitation, sandbox escapes, and the mitigations each one has to defeat — the deep end of the field, presented by the people living in it.
Cloud, mobile & hardware
Attacks on the surfaces the industry actually ships on now: cloud identity and misconfiguration, mobile and app security, and hardware and firmware teardown.
Who is in the room
Researchers with something new
The stage is for original work. If you have a finding, a technique, or a tool the field has not seen, the call for papers is how it gets here.
Engineers from major technology companies
Security teams from large technology firms come to see what is coming at them next — the research presented here is the early warning for the defences they will have to build.
Pakistan's security community
Students, CTF players, independent researchers and the country's growing professional scene — the conference is where Pakistani talent meets the international field on the same stage.
Why it is here
Pakistan produces serious offensive-security talent, and for a long time the only stages worth presenting on were on the other side of the world. The point of running a conference of this kind here is to remove that distance — to put local researchers, students and CTF players in the same room as the international field, presenting to the same audience, judged by the same standard.
The work does not get diluted to make that happen. The bar is original research, disclosed responsibly, that advances the field — the same bar the rest of the world holds. What changes is only who gets a fair shot at meeting it.
Conference questions, answered
What is the OFFCON conference?
It is an offensive-security conference: a stage for advanced, hands-on research rather than vendor talks. The material is the real work of the field — red teaming, exploit development, and zero-day vulnerability research — presented by the people who did it, for an audience that does it too.
Who attends?
Offensive security researchers and red teamers, security engineers from major technology companies, and Pakistan's own security community — students, CTF competitors and independent researchers. The point of putting them in one room is that the local scene meets the international field on equal footing.
How do I submit a talk?
Through the call for papers. If you have original research — a new technique, a zero-day, a tool, a piece of tradecraft the field has not seen — get in touch and we will send you the CFP details and timeline. Talks are selected on the substance of the work, not on where you are from or who you work for.
Can my company sponsor or send a team?
Yes. Sponsorship and group attendance for security teams are both available — contact us and we will walk you through the options. Companies also use the conference to recruit, since the room is full of people who can demonstrably do the work.
Is the research disclosed responsibly?
Yes. Zero-day and vulnerability research presented here follows responsible-disclosure norms — affected vendors are notified and given time to remediate before anything is presented publicly. The conference is a place to advance the field, not to drop live weapons on unpatched systems.
How does this connect to the CTF platform?
The competition and the conference are two halves of the same thing. The CTF arena is where skill is built and proven; the conference is where the people who have built it present what they have found. Placing well in OFFCON events is one of the ways new researchers get noticed for the stage.