BSides Ottawa 2026 · 19–20 November · Ottawa, Canada
Submissions close 15 September 2026, 23:59 EDT
Somebody owns the data. Somebody owns the model. Somebody owns the keys and the circuit breakers. This year we want to know who, and we want to hear it from the people who went and found out.
// until the CFP closes.
Researchers, innovators, thought leaders, change makers, practitioners, and influencers have all stepped onto the BSides Ottawa stage before anyone outside their own team knew their name. Some of them had never presented anywhere. That is not an accident. It is the entire point of the room.
BSides Ottawa is a grassroots, volunteer-powered conference. There is no gatekeeper, no speaker circuit, no pay-to-play. We are a safe and open environment to share your thoughts, teach an unusual topic, or tell a fascinating security story. We would rather hear a rough talk about real work than a polished talk about nothing.
You do not need to be from Ottawa. You do not need to be from Canada. If you have something the community should hear, we want it on our stage.
Never spoken before? Good. First-time speakers are explicitly welcome. Tell us when you submit, and we will do what we can to help you prepare.
Spoken everywhere? Bring us the talk the bigger cons made you sand the edges off.
Not a “speaker”? You are an operator, an analyst, a student, a public servant, a builder. That is exactly who we programme for.
Not from here? International submissions are welcome and encouraged. Read the travel note before you submit.
Our 2026 theme is Who Controls the Stack? Control is the thread running through everything the community is arguing about right now: residency, dependency, autonomy, keys, circuit breakers. Each domain takes one layer and asks the same question of it.
Pick a layer when you submit. If your talk sits across two, say so, because the crossovers are often the best sessions of the two-day conference.
who controls the model?
Agents are being handed credentials, shells, and production access faster than anyone is threat modelling them. We want the offensive work, the defensive work, and the honest failure reports, from people who have actually pointed a model at something that mattered.
Bring usWhat you built, what you pointed it at, and what broke. Methodology and data.
Not thisA survey of what AI might mean for security. We can read that anywhere.
who controls the data?
Residency is easy to write into a contract and hard to prove in a running system. Show us the gap. Where does the data actually live, whose law actually reaches it, and what happens on the day the provider is no longer available to you?
Bring usAn inventory, a teardown, or a contract clause that failed under pressure.
Not thisA walkthrough of residency regulations with no system behind it.
who controls the keys and the circuit breakers?
The bottom of the stack is where deadlines are real and failure is physical. Two major shifts are generating practical work in Canada right now: post-quantum migration and implementation planning around the newly enacted Critical Cyber Systems Protection Act. We want to hear what that work actually looks like.
Federal departments and agencies were expected to develop initial PQC migration plans by April 2026, with high-priority systems targeted for migration by the end of 2031. That puts cryptographic discovery and inventory work squarely in the present. Tell us what discovery actually found.
Bring usTooling, inventories, migration scars, and post-mortems from real environments.
Not thisA compliance timeline read aloud. We know the dates. We want the findings.
who controls the rest of it?
The theme is a prompt, not a fence. Talks do not have to sit in any one corner of security. They can simply help the community understand what is going on around us and the challenges facing government, industry and academia, at home and abroad. Lockpicking, hardware, careers, policy, DFIR, appsec, threat intel, war stories, the weird thing you found at 2am. Bring it.
Bring usAnything the community would be better off knowing. Genuinely.
Not thisA product pitch. See the house rule below. It is the one we enforce hardest.
Reviewers kill sales decks first, everywhere, every year. If your talk cannot survive having your employer's name removed from it, it is not ready. Naming your own tool is completely fine. Building the talk around buying it is not. Open-source the thing, or show the method so someone else could rebuild it.
Choose the format that fits the material. A tight 20 minutes beats a padded 45 every single time, and our reviewers know it.
Shorter, mentored, and built for a first-time speaker. Q&A included.
The workhorse. One idea, delivered properly, with time for questions.
For substantial original research that genuinely needs the extra room.
One facilitator, three or four voices who actually disagree with each other.
Hands on keyboards. Tell us what attendees need to bring and install.
One sharp idea. The lowest-risk way to get on a stage this year.
Every speaker you admire had a first talk. BSides Ottawa is exactly the kind of room where new speakers should be able to take that first shot. If the idea is good, lack of stage experience is not a reason to keep it to yourself.
Tell us this would be your first conference talk. We care about the idea, the evidence and what the audience will learn—not whether you already have a speaker reel.
Your first talk does not need to explain an entire field. One useful finding, technique, case study or hard-earned lesson is enough.
Reviewers can work with an imperfect abstract if the substance is there. Explain the problem, what you did, what happened, and what people can take home.
If there is something that would make presenting more workable for you, flag it when you submit or contact the CFP team. We want good ideas to make it to the stage.
Presented before and interested in helping newer speakers prepare? Get in touch.
We are not trying to make this mysterious. Reviewers read a lot of submissions, and the ones that get accepted almost always do the same four things.
Before you tell us what you did, tell us why anyone should care. If the first sentence is about your methodology, it is the wrong first sentence.
A tool, a technique, a case study, a number they did not have. Name it explicitly. “Attendees will gain insight into…” is not a takeaway.
This is the single biggest differentiator. Give us the sections with rough time allocations. Talks with detailed outlines get accepted at a far higher rate, because reviewers can actually picture the session.
“X is a problem and we have several novel approaches we'll share on the day” tells a reviewer nothing. Spell them out. We cannot evaluate what you are hiding.
// weak
Container security is a growing concern for modern enterprises. This talk will explore the challenges organisations face and share several novel solutions our team has developed.
↓ same talk, rewritten ↓
// strong
Most container security tools miss runtime threats because they only scan images at build time. This talk demonstrates three techniques for detecting container escapes in production, tested across 40 clusters, and releases the eBPF tooling we used to do it.
// problem → specific takeaway → evidence → artifact
Ottawa is a government town, and this year's domains invite talks about migration gaps, critical infrastructure readiness, incident response, and things that broke. Some of the most useful lessons will come from work that cannot simply be dropped into a slide deck.
Do not include information you are not authorised to disclose. Instead, consider whether the useful part of the talk can be anonymised, generalised, or presented at the level of method rather than incident. If you are unsure whether that kind of version would fit the CFP, contact us before submitting at cfp@bsidesottawa.ca.
The useful bits to know before you spend an evening writing.
We are looking for clear, useful sessions with substance behind them: original research, practical techniques, strong case studies, honest lessons learned, unusual perspectives, or a genuinely good security story. First-time speakers are welcome. Reviewers should be able to understand what you will cover, why it matters, and what the audience will leave with.
You do not need permission, a job title, or a track record. You need one idea worth sharing and enough detail for reviewers to see why it belongs on our Main Stage.
Submit your talkFor any further questions, email cfp@bsidesottawa.ca.