fwd:cloudsec North America 2025
Call for Participation (CFP)
CLOSED: The CFP is closed
fwd:cloudsec 2025: Living on the Edge
After decades of cloud infrastructure, we’re starting to find stable footing. Thanks in part to the contributions made by independent cloud security practitioners, cloud platforms have smoothed off the sharpest edges and even the risk-averse are finding ways to use them.
But progress doesn’t stop, and once again we’re forced to leave the paved path and start living on the edge: integrating AI architectures into our apps that have more data, and more diverse data, along with more varied access patterns. We may have mapped out the big three clouds, but having an impact means exploring new patterns and new clouds, with faster-evolving and more abundant threats.
For fwd:cloudsec 2025, we’re looking for first ascents and new paths while gathering to admire the view from atop the mile-high city. Come with stories of surprising edge cases and double-edged swords. Update us on what practices from five years ago are no longer relevant. Help us sand off the rough edges of all the new cloud services we keep encountering in our day-to-day lives.
Who should submit
As an independent conference specifically focused on the needs of the cloud practitioner community, we’re particularly interested in hearing things that wouldn’t make the stage at another cloud or security conference.
We especially want to hear from practitioners directly — those responsible for building and maintaining secure cloud services. The definition of “practitioner” here is deliberately broad – and definitely encompasses more than just “engineer”.
We know presenting is intimidating, and while we’re proud that cutting-edge researchers and founders want to speak at fwd:cloudsec, the heart of our community is bringing together speakers of different backgrounds and experience levels. We reserve time during reviews to provide feedback, develop and support emerging work - even if that means helping people go to bat with their own PR teams to make sure interesting lessons see the light of day. If you’re concerned that your employer may not support your submission, reach out to us!
From the beginning, fwd:cloudsec has always prioritized being accessible to as many members of our community as possible, especially those who are presenting at our conference. Continuing our commitment, and thanks to our generous sponsors, this year we’re offering honoraria alongside hotel rooms and/or reimbursements for speakers who don’t have an employer paying for their conference expenses. We have always believed it’s critical that all who contribute to fwd:cloudsec in this way are able to do so regardless of ability to pay, and this is an important way we’re enabling this.
For more information on speaker compensation and early-speaker support, see below.
Conference format
We keep fwd:cloudsec small and approachable to encourage attendees to interact in real-time. All talks will be presented live in Denver. We’re looking for talks that inspire others to ask questions and build together. As in previous years, we will be live-streaming the sessions and hosts will be soliciting questions from the in-person audience, Cloud Security Forum Slack and social media in real-time.
Each year we ask participants to reflect on themes we think are most impactful to our work as independent cloud security practitioners. Talks addressing these themes are more likely to be selected.
Surveying the wilderness: attacks and vulnerabilities, defensive practices
Ransomware and cryptominers are still hiding beyond the perimeter. Infostealer malware and identity compromise aren’t solved problems. In 2025, what do we as cloud security practitioners need to know about these and other attack trends, tools, techniques and practices? For defenders, what practices best map out our territory — or are there new classes of vulnerabilities that we need to know about now, because they’ll be driving the conversation for the next few years? Is this the year deepfakes and spear phishing should be considered a cloud infrastructure threat – not just a corpsec one? (Your organizing committee doubts it — but we’d love to hear a convincing argument.)
Great topics
- real-world attacks targeting security tools, team members and engineers
- cloud infostealer gangs and malware; pivoting from CI/CD and developer environments to broader compromises
- scans and survey data; new offensive research from our community
Packing your gear: tools for operating safely
Safety-minded explorers make sure they have the right gear to survive harsh and changing conditions. What do you make sure is in your pack?
Evolving cloud architectures — and changes to business and global pressures — mean revisiting the defensive approaches that may have worked in the past. What new systems are helping you operate at scale? What have you chosen to build instead of buy — or what old approaches are you walking away from? How are you changing your technical environment to make it easier — and cheaper — to share with teams who might’ve had a different budget line in the past?
Great topics
- sharing observability practices with application teams
- post-CSPM acronym soup, SaaS posture management and its convergence with infrastructure
- new compliance needs
- everything-as-code meets supply chain defenses
Mapping the frontier: supporting new clouds and technology
Before the cloud, infrastructure teams thought primarily about “compute, network and storage”.Then we had infrastructure as a service and software as a service. The concepts are still useful — but they mean new things now:
Compute means more than EC2 and containers; even container orchestration and CI/CD are well understood. But new compute platforms have sprung up, promising WASM everywhere, GPUs when you need them, or your specific application development or AI agent deployment platform, managed in a fully serverless way.
Networking means more than subnet boundaries; every week there’s a new control plane or zero-trust attack surface, with API boundaries that appear internal to your perimeter finding sneaky ways to be exposed to external attackers..
Storage isn’t just about securing your postgres cluster: you have multi-region and edge databases, off-the-shelf datalakes, and notebooks and meshes that consume them using distributed and granular operations.
What are we doing to cope with these changes, when we no longer expect our application teams to deploy entirely — or even primarily — in the kind of cloud that has great CSPM support and a big budget for an annual marketing conference?
Great topics
- AI — you knew it was coming — and security for inference and training on GPU clouds and systems like huggingface
- cross-cloud data architectures, movement tools and data lake and catalog formats
- edge computing and the safe use of compute, storage and networking from CDN providers
- higher-level platform-as-a-service offerings based on WASM, agents, or AI-built applications
Forming a fellowship: organizations and community
It’s dangerous to go alone. Security teams work best when we work together — and when we work with our friends in IT, with infrastructure, with legal and compliance, with finance, and with others that we’re probably forgetting. Meanwhile, our organizations’ relationship with governments across the world are changing rapidly, as we find ourselves needing to consider political and regulatory questions as part of our technical approaches more than ever before.
How are changes in the market, organizational structure, and political landscape influencing what we build?
Great topics
- evolving regulatory frameworks
- dealing with borders and data sovereignty
- blended organizations (hybrid and contractor)
- influencing policy decisions through lobbying
- data sharing through ISACs and other NGOs
What not to submit
All experience levels are welcome, but fwd:cloudsec attendees will typically have a fair amount of hands-on experience with cloud engineering and security. Introductory-level talks on broadly-deployed technologies, vendor presentations, or purely theoretical architecture talks will not be accepted and may not even be referred to the whole team for review.
fwd:cloudsec is specifically targeted at independent cloud security practitioners. There are great generalist Kubernetes and application security conferences out there, and while we welcome talks that touch on these areas, we’re less interested when they’re the sole focus of the talk — can you connect the talk to the type of practitioner, often in a central infrastructure or security team, who is concerned specifically with cloud configuration and defense?
As a smaller conference, the value is in bringing people together. Your talk will get audience questions, so bring something with white space to be filled in, challenges to be responded to and discussions to be started.
Speakers and reviewers are expected to disclose conflicts of interest — if research was paid for by a particular vendor, that’s not disqualifying but the chairs would like to know to ensure we stay neutral.
We want you to be selective in what you submit, so please follow the below restrictions — if you violate them, all your submissions may be denied:
- Talks must be submitted by the author / speaker who performed the work, and not by PR agencies or marketing teams on the speaker’s behalf.
- While cloud security is a team effort, talks may have at most two presenters. We’re happy to credit others in your abstract or posted slides.
- Any speaker may only submit up to two talks. Where multiple presenters are speaking together, this counts any talk on which they are named as a speaker.
Disclosure policy
We support responsible disclosure. As an independent conference, that does not mean giving vendors or sponsors a veto over possible presentation topics. Submitters should inform vendors of any discovered vulnerability as early as possible to give them a chance to patch the issue, and we won’t accept any talks that have not made good-faith efforts to work through their vulnerability disclosure processes. But beyond that, we admire the work Project Zero has done here: 90 days from notification is generally a reasonable time to patch an issue, plus 30 days to coordinate disclosure. After that time has elapsed, it may be more important to let the public know than to continue to keep the issue under wraps. If you still have disagreements as to whether a vulnerability should be presented, let’s talk through options.
Support for diverse and first-time speakers
We especially encourage first-time speakers, women, and members of other groups less represented at security conferences to present at fwd:cloudsec — first pass reviews by our committee members are performed “blind” (without author information attached), though as we approach final selections we strive to build a balanced program and are proud to have a review committee comprised of many different backgrounds.
And if you’re interested in feedback or partnership on ideas before you submit, join us on the Cloud Security Forum slack — many of the review panelists and past speakers are active in #fwdcloudsec and will gladly talk through an idea. Some of our best past talks were developed through side channels and DMs.
And finally, if you’ve never spoken at a national conference before (something where most attendees do not live within a day’s drive), we’re especially interested in hearing from you and want to provide formal support to help you find the best fit talks. If you submit by Friday, February 28, we’ll share review committee feedback in depth and provide you a point of contact on the review committee who can offer suggestions to hone your talk for the fwd:cloudsec audience.
How to submit
Most talks are expected to be 20-minute lightning talks on a single topic. There are a limited number of 40-minute slots available, so when proposing a 40-minute talk, please be sure to include an agenda that explains how you will use the additional time. We may (and probably will) ask you to shorten your talk before it can be accepted.
Submissions must include:
- Speaker name(s) and contact information
- Presentation title
- Preferred talk length — 20-minute or 40-minute
- Abstract (will be shown on the schedule); please do not include identifying information in your abstract. Your abstract should focus on your content, not your bio, to support blind reviews
- Speaker bio(s), limited to 100 words; this will be shown on the schedule but not used during selection.
- A detailed description of the talk: explain what you are presenting, and how you intend to cover the topic. Do you intend to include a demo or release code? Here is a good place to include that information. In particular your detailed description should answer:
- What is already known about this topic?
- What is added by this talk?
- What are the implications for Cloudsec practitioners?
- How can the audience benefit from watching your talk live? Will there be Q&A, live demos, or cans of Milo for great questions?
- Other venues this talk has been presented or submitted. If the talk was given previously, what new information will be presented?
- Any special presentation facilities that may be required (aside from power, projector, sound and Internet connectivity)
- Any concerns with having your talk recorded for future open access
- If your topic relates to a tool or code you’ve written, is that tool or code open-source, or will it be made open-source by the end of the conference?
Remember: The detailed description is for the review committee only. The more detail you include, the better the committee can judge your submission. An abstract is fine to tease the audience, but the detailed description needs to include the punchline.
Schedule
- Feb 3rd - Call for participation opens
- Friday, Feb 28 - ROUND ONE SUBMISSIONS CLOSE at 11:59 pm Mountain Standard Time (GMT-7)
- Monday, Mar 17 - Participants who submit by the Round One deadline will hear back from the program committee. First time speakers who requested feedback and met the submission criteria will receive feedback on how to improve during the second round. (We hope to provide feedback sooner — but reviews always take longer than we’d hope.)
- Friday, Apr 11 - FINAL ROUND SUBMISSIONS CLOSE at 11:59 pm Mountain Daylight Time (GMT-6)
- May 1 - Final acceptance, alternate and rejections are sent out
- May 8 - Speakers must confirm attendance and hotel benefits (if applicable) by this date
- May 15 - Schedule published to https://fwdcloudsec.org
- Monday June 30-Tuesday July 1, 2025 - fwd:cloudsec North America held in Denver, CO and virtually
Submit your proposal
Proposals can be submitted via PreTalx.