fwd:cloudsec North America 2025

Call for Participation (CFP)

CLOSED: The CFP is closed

fwd:cloudsec 2025: Living on the Edge

After decades of cloud infrastructure, we’re starting to find stable footing. Thanks in part to the contributions made by independent cloud security practitioners, cloud platforms have smoothed off the sharpest edges and even the risk-averse are finding ways to use them.

But progress doesn’t stop, and once again we’re forced to leave the paved path and start living on the edge: integrating AI architectures into our apps that have more data, and more diverse data, along with more varied access patterns. We may have mapped out the big three clouds, but having an impact means exploring new patterns and new clouds, with faster-evolving and more abundant threats.

For fwd:cloudsec 2025, we’re looking for first ascents and new paths while gathering to admire the view from atop the mile-high city. Come with stories of surprising edge cases and double-edged swords. Update us on what practices from five years ago are no longer relevant. Help us sand off the rough edges of all the new cloud services we keep encountering in our day-to-day lives.

Who should submit

As an independent conference specifically focused on the needs of the cloud practitioner community, we’re particularly interested in hearing things that wouldn’t make the stage at another cloud or security conference.

We especially want to hear from practitioners directly — those responsible for building and maintaining secure cloud services. The definition of “practitioner” here is deliberately broad – and definitely encompasses more than just “engineer”.

We know presenting is intimidating, and while we’re proud that cutting-edge researchers and founders want to speak at fwd:cloudsec, the heart of our community is bringing together speakers of different backgrounds and experience levels. We reserve time during reviews to provide feedback, develop and support emerging work - even if that means helping people go to bat with their own PR teams to make sure interesting lessons see the light of day. If you’re concerned that your employer may not support your submission, reach out to us!

From the beginning, fwd:cloudsec has always prioritized being accessible to as many members of our community as possible, especially those who are presenting at our conference. Continuing our commitment, and thanks to our generous sponsors, this year we’re offering honoraria alongside hotel rooms and/or reimbursements for speakers who don’t have an employer paying for their conference expenses. We have always believed it’s critical that all who contribute to fwd:cloudsec in this way are able to do so regardless of ability to pay, and this is an important way we’re enabling this.

For more information on speaker compensation and early-speaker support, see below.

Conference format

We keep fwd:cloudsec small and approachable to encourage attendees to interact in real-time. All talks will be presented live in Denver. We’re looking for talks that inspire others to ask questions and build together. As in previous years, we will be live-streaming the sessions and hosts will be soliciting questions from the in-person audience, Cloud Security Forum Slack and social media in real-time.

Each year we ask participants to reflect on themes we think are most impactful to our work as independent cloud security practitioners. Talks addressing these themes are more likely to be selected.

Surveying the wilderness: attacks and vulnerabilities, defensive practices

Ransomware and cryptominers are still hiding beyond the perimeter. Infostealer malware and identity compromise aren’t solved problems. In 2025, what do we as cloud security practitioners need to know about these and other attack trends, tools, techniques and practices? For defenders, what practices best map out our territory — or are there new classes of vulnerabilities that we need to know about now, because they’ll be driving the conversation for the next few years? Is this the year deepfakes and spear phishing should be considered a cloud infrastructure threat – not just a corpsec one? (Your organizing committee doubts it — but we’d love to hear a convincing argument.)

Great topics

Packing your gear: tools for operating safely

Safety-minded explorers make sure they have the right gear to survive harsh and changing conditions. What do you make sure is in your pack?

Evolving cloud architectures — and changes to business and global pressures — mean revisiting the defensive approaches that may have worked in the past. What new systems are helping you operate at scale? What have you chosen to build instead of buy — or what old approaches are you walking away from? How are you changing your technical environment to make it easier — and cheaper — to share with teams who might’ve had a different budget line in the past?

Great topics

Mapping the frontier: supporting new clouds and technology

Before the cloud, infrastructure teams thought primarily about “compute, network and storage”.Then we had infrastructure as a service and software as a service. The concepts are still useful — but they mean new things now:

Compute means more than EC2 and containers; even container orchestration and CI/CD are well understood. But new compute platforms have sprung up, promising WASM everywhere, GPUs when you need them, or your specific application development or AI agent deployment platform, managed in a fully serverless way.

Networking means more than subnet boundaries; every week there’s a new control plane or zero-trust attack surface, with API boundaries that appear internal to your perimeter finding sneaky ways to be exposed to external attackers..

Storage isn’t just about securing your postgres cluster: you have multi-region and edge databases, off-the-shelf datalakes, and notebooks and meshes that consume them using distributed and granular operations.

What are we doing to cope with these changes, when we no longer expect our application teams to deploy entirely — or even primarily — in the kind of cloud that has great CSPM support and a big budget for an annual marketing conference?

Great topics

Forming a fellowship: organizations and community

It’s dangerous to go alone. Security teams work best when we work together — and when we work with our friends in IT, with infrastructure, with legal and compliance, with finance, and with others that we’re probably forgetting. Meanwhile, our organizations’ relationship with governments across the world are changing rapidly, as we find ourselves needing to consider political and regulatory questions as part of our technical approaches more than ever before.

How are changes in the market, organizational structure, and political landscape influencing what we build?

Great topics

What not to submit

All experience levels are welcome, but fwd:cloudsec attendees will typically have a fair amount of hands-on experience with cloud engineering and security. Introductory-level talks on broadly-deployed technologies, vendor presentations, or purely theoretical architecture talks will not be accepted and may not even be referred to the whole team for review.

fwd:cloudsec is specifically targeted at independent cloud security practitioners. There are great generalist Kubernetes and application security conferences out there, and while we welcome talks that touch on these areas, we’re less interested when they’re the sole focus of the talk — can you connect the talk to the type of practitioner, often in a central infrastructure or security team, who is concerned specifically with cloud configuration and defense?

As a smaller conference, the value is in bringing people together. Your talk will get audience questions, so bring something with white space to be filled in, challenges to be responded to and discussions to be started.

Speakers and reviewers are expected to disclose conflicts of interest — if research was paid for by a particular vendor, that’s not disqualifying but the chairs would like to know to ensure we stay neutral.

We want you to be selective in what you submit, so please follow the below restrictions — if you violate them, all your submissions may be denied:

Disclosure policy

We support responsible disclosure. As an independent conference, that does not mean giving vendors or sponsors a veto over possible presentation topics. Submitters should inform vendors of any discovered vulnerability as early as possible to give them a chance to patch the issue, and we won’t accept any talks that have not made good-faith efforts to work through their vulnerability disclosure processes. But beyond that, we admire the work Project Zero has done here: 90 days from notification is generally a reasonable time to patch an issue, plus 30 days to coordinate disclosure. After that time has elapsed, it may be more important to let the public know than to continue to keep the issue under wraps. If you still have disagreements as to whether a vulnerability should be presented, let’s talk through options.

Support for diverse and first-time speakers

We especially encourage first-time speakers, women, and members of other groups less represented at security conferences to present at fwd:cloudsec — first pass reviews by our committee members are performed “blind” (without author information attached), though as we approach final selections we strive to build a balanced program and are proud to have a review committee comprised of many different backgrounds.

And if you’re interested in feedback or partnership on ideas before you submit, join us on the Cloud Security Forum slack — many of the review panelists and past speakers are active in #fwdcloudsec and will gladly talk through an idea. Some of our best past talks were developed through side channels and DMs.

And finally, if you’ve never spoken at a national conference before (something where most attendees do not live within a day’s drive), we’re especially interested in hearing from you and want to provide formal support to help you find the best fit talks. If you submit by Friday, February 28, we’ll share review committee feedback in depth and provide you a point of contact on the review committee who can offer suggestions to hone your talk for the fwd:cloudsec audience.

How to submit

Most talks are expected to be 20-minute lightning talks on a single topic. There are a limited number of 40-minute slots available, so when proposing a 40-minute talk, please be sure to include an agenda that explains how you will use the additional time. We may (and probably will) ask you to shorten your talk before it can be accepted.

Submissions must include:

Remember: The detailed description is for the review committee only. The more detail you include, the better the committee can judge your submission. An abstract is fine to tease the audience, but the detailed description needs to include the punchline.

Schedule

Submit your proposal

Proposals can be submitted via PreTalx.