Hacking conferences in Spain: which to attend and how to make the most of them

By Kike Gandia · Research · 9 min read

Illustration on a midnight-blue background: a map of Spain in neon lines with the cybersecurity conference venues linked by a dashed route, three of them in gold, and a twelve-month timeline below

Spain has a cybersecurity conference almost every month, and not only in Madrid and Barcelona: Cuenca, Albacete, Donostia, Palma, León and Santa Cruz de Tenerife all have their own. The problem isn’t finding one, it’s choosing. A summit for CISOs and a hacking conference with a CTF share the word “cybersecurity” on the poster and little else.

To keep track of them we have gathered them all in our calendar of cybersecurity conferences in Spain, with a map, a calendar and dates checked against each organiser’s website. This article is the other half: how to read that calendar and which ones are worth attending depending on what you are after.

29: conferences in the calendar (across 2026 and 2027)
18: cities (from Donostia to Gran Canaria)
10: regions
8: in the Community of Madrid (in 2026 alone)

Calendar data as of 15 October 2026.

Four kinds of conference, four audiences

Before looking at dates, it helps to know what kind of event each one is. In the calendar we group them like this:

Community Hacking conferences: Technical talks, workshops and CTFs, run by associations or volunteers. This is where original offensive research is presented: RootedCON, h-c0n, EuskalHack, Bitup, No cON Name, MorterueloCON and SecAdmin.
Business CISO summits: Strategy, risk management, regulation and vendors, in a talks-and-panels format: EspañaSec Cyber Summit, Securmática, CISO Edge and the Barcelona Cybersecurity Congress.
Public sector Government bodies: Organised by public bodies for their ecosystem: the CCN-CERT STIC Conference, INCIBE’s ENISE, the National Police’s C1b3rWall and the Andalusian regional government’s congress.
Niche Research, OT and training: JNIC for academic research, Virus Bulletin for malware analysis, CCIcon for industrial environments and INCIBE’s Summer BootCamp, which is a training programme rather than a conference.

The three we feature

Three conferences are marked in gold in the calendar. It isn’t a ranking: they are community events we follow closely, each at a very different moment.

Bitup Alicante

The BitUP community’s conference takes place on 30 and 31 October 2026 at the Alicante provincial auditorium (ADDA), with technical talks, a CTF and bug bounty. It is also the closest one to home for our team, in the Valencian Community.

Navaja Negra

One of the longest-running hacking conferences on the circuit, at the Albacete School of Computer Engineering. The association behind it cancelled the 2026 edition because it could not be held “with the necessary guarantees”, and has said it will do everything it can to bring it back. We keep it in the calendar, marked as cancelled, while we wait for news about 2027.

EuskalHack

The conference of the non-profit EuskalHack association, in Donostia, deliberately keeps its audience small: technical talks, workshops, challenges and an open space to talk. The 9th edition took place on 19 and 20 June 2026 at the Colegio Mayor Olarain; the 10th, with no date published yet, is expected in June again.

What is left of 2026

The last quarter packs in a good part of the calendar. This block is calculated from the date you are reading it, so it always shows what comes next:

Upcoming conferences as of 15 October 2026: 20ENISE (León, 21–23 October), Bitup Alicante (30–31 October), Barcelona Cybersecurity Congress (3–5 November), 20th CCN-CERT STIC Conference (Madrid, 24–27 November), No cON Name (Palma, 26–27 November) and SecAdmin (Seville, 27–28 November). Hackron Gran Canaria is announced for October, with no day published. The full calendar is at /en/resources/cybersecurity-conferences/.

What is already confirmed for 2027

As of mid-October 2026 only a few organisers have published dates for next year. The rest appear in the calendar as estimates, in the month they are usually held, and are updated as soon as they are announced.

Conference	Date	Venue	Status
h-c0n	5–7 February	Madrid	Confirmed · CFP open until 1 November
EspañaSec Cyber Summit	9–10 February	Novotel Madrid City Center	Confirmed
RootedCON Madrid (17th)	4–6 March	Madrid	Confirmed
JNIC 2027	No date yet (usually May)	University of Salamanca	Venue confirmed
HoneyCON	23–25 September	Guadalajara	Confirmed

Which to choose for your profile

Pentesting and red team Community conferences: RootedCON to see the latest work and meet half the industry; h-c0n, EuskalHack or No cON Name for more technical talks in a closer format. The workshops are worth as much as the talks.
Students and juniors Universities and associations: HackOn, run by URJC students, MorterueloCON or HoneyCON have a learning atmosphere and CTFs, which are the best way into the field.
CISOs and leadership Business summits: EspañaSec, Securmática or the Barcelona Cybersecurity Congress. If you work with the public sector, add the STIC Conference and ENISE.
Public sector The institutional ones: The CCN-CERT STIC Conference is the reference for the public sector; C1b3rWall, if your work involves cyber-investigation.
Industry and OT Industrial environments: CCIcon, by the Industrial Cybersecurity Center, focused on control systems and OT networks.
Research Academia and malware: JNIC for the academic world and Virus Bulletin when it is held in Spain, as in Seville in 2026.

How to make the most of it

Before — Pick talks and workshops
Check the programme and book workshops early, since places are usually limited. If there is a CTF, sign up, even in a team with strangers.
Before — Consider speaking
If you have original research, check when the CFP opens. It is the fastest way for the conference to get to know you rather than the other way round.
During — Prioritise what isn’t recorded
Many talks end up published on video; workshops, the CTF and hallway conversations don’t.
During — Talk to the speakers
One specific question after a talk is worth more than ten business cards handed out in the sponsor area.
After — Apply just one thing
Pick one technique or tool you saw and try it in your environment that same week. Otherwise it will most likely stay in your notes.

Giving a talk: what works in a CFP

We have been on stage at RootedCON, and what works best in a community conference CFP tends to repeat itself:

Original research: a technique, a tool or a finding the audience hasn’t seen before.
A demo: if it can be shown live or on video, that beats describing it.
No product pitch: a disguised sales talk shows in the abstract.
An abstract that makes sense in two lines: what you will show and what attendees take away.
Responsible disclosure: if third-party vulnerabilities are involved, they should be reported and fixed before you go on stage.

Right now, for example, the h-c0n 2027 CFP is open until 1 November 2026. The calendar flags each conference’s open CFPs.

How to use the calendar

The conference calendar has three views: a map of Spain by region, a calendar with the whole season at a glance and a list by month. You can filter by type, status and region, and every dated conference can be added to Google Calendar or downloaded as an .ics file for Outlook or Apple Calendar.

Dates checked, not copied. Each date shows whether it comes from the organiser’s official website or from a secondary source. Those not yet published appear as estimates, in the month the conference is usually held, and are updated when they are announced.

Frequently asked questions

What is the biggest cybersecurity conference in Spain?

By attendance, RootedCON, held in Madrid in early March; its 2027 edition, the 17th, runs from 4 to 6 March. Among the institutional ones, the CCN-CERT STIC Conference and INCIBE’s ENISE stand out.

Are there hacking conferences outside Madrid and Barcelona?

Plenty: Bitup in Alicante, Navaja Negra in Albacete, EuskalHack in Donostia, MorterueloCON in Cuenca, HoneyCON in Guadalajara, SecAdmin in Seville, No cON Name in Palma, Hackron in the Canary Islands and Sh3llCON in Cantabria. The calendar’s map shows them all at a glance.

Is a conference worth it if you aren’t technical?

Yes, if you choose well. Business summits are designed for leadership and the institutional ones explain where regulation is heading. A community conference also helps you understand how an attacker thinks, which is the basis of any Red Team exercise.

Heading to any of them? If you want to talk pentesting, Red Team or how to train your technical team, write to us and we will find a slot, in person or remotely.

Topics

#Hacking-conferences #Cybersecurity-conferences #RootedCON #Bitup #Navaja-Negra #EuskalHack #CFP #CTF #Community #Spain

Keep reading

Will we cross paths? Book 30 minutes