15 Years of AtlSecCon: What Community Taught Me About Security

In 2011, I organized a small security event in Halifax. Forty-two people showed up. I had no idea it would become the most important project of my career — or that it would teach me more about security than any consulting engagement ever could.

Why We Built It

AtlSecCon started from a simple observation: Atlantic Canada had no security conference of its own. If you wanted to attend a serious infosec event, you flew to Ottawa, Toronto, or the United States. The implicit message was that quality security education required a travel budget and organizational backing — which meant it was unavailable to most of the people who needed it most.

We built AtlSecCon to fix that. The mandate was straightforward: quality security education, accessible to everyone, regardless of budget, title, or years of experience. Set the ticket price as low as possible. Accept talks from first-time speakers alongside seasoned practitioners. Create a room where a student sits beside a CISO and both learn something.

What I didn't anticipate was what that room would teach me.

The Community Is the Security Control

Every year at AtlSecCon, I watch something happen that doesn't appear in any maturity framework: security professionals who compete in the market spend two days sharing what they know with each other. Incident responders compare notes on threat actor behavior. Defenders brief each other on techniques that worked. Junior practitioners get mentored by leaders who have no organizational obligation to do it.

This is, I would argue, one of the most effective security controls available. When the security community knows each other, trusts each other, and shares intelligence freely, the entire region's defensive posture improves. Attackers don't care about organizational boundaries. Defenders who refuse to collaborate across those boundaries are fighting at a structural disadvantage.

Community is not a soft benefit of the security industry. It is a force multiplier for every technical control you deploy. An organization whose security team is embedded in a strong community learns about emerging threats faster, recruits better, and retains talent longer.

What 15 Years Proved

When we started, people asked whether Atlantic Canada had enough security talent to sustain an event. The question itself revealed the misconception. The talent was always here. What was missing was a venue for it to surface, connect, and compound.

Fifteen years later, AtlSecCon now draws approximately 1,700 attendees annually. Alumni of the conference lead security programs at major Canadian organizations, have founded companies, and have built careers that started with a talk or a conversation in a Halifax conference hall.

What This Means for Your Organization

The lesson is not specific to Atlantic Canada or non-profit conferences. It applies to every organization building a security culture.

• •Invest in your team's participation in the external security community. The return in knowledge, relationships, and recruitment is measurable.
• •Create internal venues for knowledge sharing. The informal conversation between a senior analyst and a junior hire often transfers more practical knowledge than formal training.
• •Recognize that your security team's network is a security asset. When they know and trust peers at other organizations, your incident response and threat intelligence capabilities improve.
• •Lower the barrier to entry for security education inside your organization. The analyst who couldn't attend the expensive conference will find the knowledge somewhere — make sure you're part of that.

AtlSecCon 2026 runs April 9–10 in Halifax, Nova Scotia. If you're in the Atlantic region — or willing to travel — I hope to see you there. The community is the point.