The Latin American security conference circuit: an index

Why a regional circuit exists at all

The obvious path for a region joining a global technical field is to import: franchise editions of established conferences, fly in the speakers, translate the slides. Latin America mostly did not do that. It built independent events, in its own languages, funded locally, and several of them are now old enough to have outlived the companies that sponsored their first year.

That has consequences a visitor notices immediately. Talks are frequently in Spanish or Portuguese by choice rather than by limitation. Research is often aimed at targets that exist here - the banking systems, the payment instruments, the specific vehicles and devices sold in these markets - which northern researchers had no reason to test. And the organisers are usually practitioners running the event alongside a day job, which sets the tone of the whole circuit.

Argentina

Ekoparty — Buenos Aires, annually since 2001, the largest hacking conference in the region. Founded by five Argentines: Leonardo Pigñer, Federico Kirschbaum, Francisco Amato, Juan Pablo Daniel Borgna and Jerónimo Basaldúa. Pigñer runs it as a year-round organisation rather than an annual event, and the founders also built the security firms Base4 and Infobyte - the same people producing the conference, the research and the tools, which is the pattern that gives the Argentine scene its density. Amato is the author of Evilgrade, the framework that showed an unsigned update channel is a delivery system for whoever controls the network.

Brazil

H2HC — Hackers to Hackers Conference, São Paulo, since 2004: the oldest security research conference in Latin America, and the deep-technical end of the spectrum. Organised for two decades by Rodrigo Rubira Branco and Filipe Balestra; Branco announced his exit after twenty-one years and Balestra took sole leadership from 2025 - a deliberate, public succession, which is the thing volunteer conferences most often fail at.

RoadSec — since 2014, and structurally the opposite idea: instead of making the country travel to one city, the festival tours the state capitals and culminates in a large São Paulo edition. It is the entry point for most Brazilians who later end up at the technical events.

Mind the Sec — the corporate end: multi-day, expo-heavy, aimed at the decision-makers and the vendor ecosystem rather than at researchers.

The regional circuit — the part most easily missed from outside. Beyond São Paulo there is a national BSides constellation (Rio, Recife, Florianópolis, Vitória, João Pessoa, Brasília, Fortaleza, Porto Alegre, Curitiba) plus locally-run events in Juazeiro do Norte, Maceió, Natal, Aracaju, Belém, Salvador and Santos. BHACK in Belo Horizonte, Nullbyte in Salvador, Tosconf in Campinas, CryptoRave and 307c in São Paulo, and SBSeg on the academic side. The Fórum Brasileiro de CSIRTs and GTS/GTER carry the operational community. Anchises Moraes's annual calendar maps over forty of them a year and is the working document organisers plan against.

Latinoware — Foz do Iguaçu, since 2004, the free-software congress rather than a security event, and one of the region's largest FLOSS gatherings. Campus Party brought the tent-city format from Spain and found its biggest audiences in Brazil.

Colombia

DragonJAR — grown out of what became the largest Spanish-speaking security community of its era, founded by Jaime Andrés Restrepo and held in Manizales. Its defining choice was language: built in Spanish for a region expected to learn security in English. Restrepo's own research on attacking connected cars sold in Latin America is the clearest statement of the circuit's argument - regional targets need regional researchers, because nobody elsewhere is testing them.

Peru

PERÚHACK — Lima, free and pointedly technical, presenting security from the attacker's perspective and explicitly continuing the lineage of its predecessor LimaHack. BSides Perú has run since 2018. The pairing repeats a pattern visible across the region: one venue optimised for access, another for depth, rather than one event attempting both.

Chile

8.8 Computer Security Conference — Santiago, since 2011, co-created by Gabriel Bergel, deliberately "100% technical and academic" and wrapped each year in a different pop-culture theme. Its stated purpose is democratising knowledge, and it has since exported editions to other cities in the region.

Brazil beyond São Paulo

The events above are the ones with international profile, but they are a small fraction of the circuit. Anchises Moraes's annual calendar mapped more than forty security events for 2026 alone, and reading it is the fastest way to understand what the Brazilian scene actually looks like: BHack in Belo Horizonte and Nullbyte in Salvador anchor two regions outside the southeast, and BSides editions now run in Rio, Florianópolis, Recife, Vitória, João Pessoa, Brasília, Fortaleza, Curitiba and Porto Alegre alongside São Paulo's.

Then the specialists. CryptoRave holds the privacy and cryptography argument as a main track rather than a side conversation. SBSeg is the academic symposium, and the distance between it and the hacker conferences is unusually small here - the same names appear at both. The Fórum Brasileiro de CSIRTs is the one nobody outside the field notices and everybody depends on: the incident responders comparing notes once a year. And Tosconf, the self-described "shoddy conference" in Campinas, exists to satirise the professionalisation of all of the above.

Smaller cities carry their own: Juazeiro do Norte, Maceió, Natal, Aracaju, Belém, Santos, Pindamonhangaba. A circuit that reaches Pindamonhangaba is not a São Paulo circuit with visitors.

How they differ from the northern events

Set beside DEF CON and Black Hat, three differences stand out.

Scale is not the goal. Most of these events are sized so that the organisers still know a large share of the room, which is the property that DEF CON lost by succeeding and works hard to simulate through its villages.

The corporate and community ends are separate venues, not separate tracks: Mind the Sec and H2HC are different events for different people, where the northern circuit splits the same research between a paid conference and a free one held days apart.

Succession is the hard problem. These conferences are young enough that most are still run by their founders, and the H2HC handover is the first major test of whether the circuit outlives the people who built it. That is the question worth watching over the next decade.

An incomplete map

This index covers the events the corpus can currently document with sources: Argentina, Brazil, Chile, Colombia and Peru. The circuit is wider than that - Uruguay, Paraguay and Venezuela all have organisers and events that deserve entries here, and the gap is one of documentation rather than of activity.

That gap is a statement about this index rather than about those communities, and it is the next thing to fix. If you organise or attend one of them, the contribute page is the way to get it added properly - with the founders named, which is the part the record usually loses first.