Article Series: So you want to train at Black Hat (or other conferences)?
This is a series of articles about our experiences submitting, preparing and delivering training at Black Hat (and other conferences as well).
It has been quite the journey and it feels like we learnt a lot of things which were not obvious to us at the beginning or were just not documented.
In this series, we will try to set this information out in an organized way to hopefully help people in the future who are interested in going through a similar journey.
This series is ongoing with new posts released every few weeks. If you want to keep up with new posts, follow us on Twitter or LinkedIn.
Posts in this series:
- So, you want to train at Black Hat (or other conferences)? An Introduction
- What is my motivation? What should your motivation be?
-
Working out your financials
- Finding your niche/selling point
Working out your financials
Published on 1 April 2025 by Josh Grossman
Introduction
In my previous post, I briefly touched on the financial realities of delivering training courses. In this post, I’ll explore this topic in greater depth.
Making your millions??
If your goal is a big financial success, training courses will probably not be your golden ticket. That is why I want to tackle this topic up front. You will need to think about this but you also need to be realistic.
Developing a course requires significant upfront investment, and even after launch, it demands ongoing “care and feeding”. Keeping content fresh and relevant is crucial, and that means regularly:
- Updating material to reflect industry changes
- Incorporating new insights and experiences
- Ensuring training exercises still function as intended
- Revising and updating technical components of exercises
- Adapting exercises to maintain relevance
- Applying feedback from previous course sessions
If you can identify a subject that is broad enough to appeal to a large audience, different enough from existing options to generate demand, and also low-maintenance in terms of updates, then you might have a high-profit opportunity.
But let me know if you do manage that as it is pretty tough…
In my case, the course I built falls into a slightly specialized category. While maintenance isn’t overwhelming, I have only delivered it 5–8 times so far.
Non-financial benefits
On the other hand, there are other benefits that may be attractive to you.
The experience of preparing and delivering a course at this level may itself be valuable to your professional development. It may also bring a boost to your public profile and your resume.
Depending on your planned career trajectory, these aspects may be more valuable than money. However, your current employer may not see things this way. 🙃
Recouping your investment
Before you make a profit you are going to need to cover your initial investment.
The most basic investment is any actual money you spend to deliver the course in person. There are a bunch of considerations for this so I will cover it in more detail a little further down.
The real cost however is (or at least should be) the time you spend building the course. You certainly don’t want to spend a lot of time building a course which no one wants to attend.
To try and mitigate this risk for my course, I took a phased approach. I started by delivering a one-hour overview at the Open Security Summit, followed by a one-day version at OWASP Global AppSec.
These smaller commitments helped me gauge audience reception and refine my content. The one-day course also allowed me to test my experimental exercises (more on that later). While this phase didn’t compensate for all the time investment, it provided some validation that the course was worthwhile and effective and therefore I should continue investing in it.
Striking the right balance is key: invest enough to prove the concept and demonstrate viability, but avoid committing excessive resources to an untested idea that might not work out.
Breaking even on an single course session
If you are able to afford to pay expenses to deliver training “for the exposure”, then you don’t need to worry about this. In most cases however, you will need to have a plan.
Virtual training is simpler financially: as long as you cover your time cost, you’re in the clear. In-person training, however, introduces a host of additional expenses and complications and I will try and cover some of these here.
For in-person training, you need to figure out what your break even point is. Specifically, how many people need to register to get the revenue required to break even. Obviously the first thing you need to know is what share of the course income you will receive from the venue which is hosting the training. This might be fixed or flexible depending on the conference.
You can then start building a break even and profit calculator based on your expected expenses. I usually prepare an Excel spreadsheet or Google Doc to work this out and recalculate dynamically.
Key Expenses to Consider
Different conferences handle costs in different ways. Expenses that conferences might cover for you (wholly or partly) include:
- Flight costs
- Hotel costs
- Venue costs including food and beverage.
Examples that I have seen:
- Black Hat publishes information on the public CFT page.
- OWASP covers all venue costs but not hotel and flight.
- Other conferences equally split costs and then equally split the profit as well.
All conferences I have seen also give trainers a free conference ticket which could also be worth a lot.
Beyond travel and accommodation, factor in additional costs such as:
- Airport transfers
- Meals and per diems
- Printed materials or giveaways for participants, (I have a bunch of print-outs I prepare and hand-out over the duration of the course and I often buy and bring snacks as well)
The Hidden Cost: Your Time
If you’re self-employed or consulting, or you are doing this separate to your employer, your time has an opportunity cost. Time spent training is time you could have spent on client work or other revenue-generating activities. Don’t forget to include travel days as well.
Revenue Per Course Day
Different conferences handle pricing and revenue shares in various ways:
- OWASP charges attendees a flat daily rate for training, meaning a three-day course costs three times as much as a one-day course, with no discounts. Trainers receive 40% of net revenue up to $10,000 USD, and 50% of net revenues above $10,000 USD (this is public information).
- As can be seen on the public training page, Black Hat training ticket costs vary between courses and there are also various early-bird stages. Interestingly, a four-day Black Hat course doesn’t necessarily cost attendees twice as much as a two-day course.
- Some conferences pay a fixed rate per course, contingent on meeting a minimum number of registrants.
Note that at Black Hat USA, trainers can deliver the same two-day course twice (Sat-Sun and Mon-Tues).
Set Your minimum up-front
Most conferences will ask what your financial minimum is upfront and you should be able to use the information above, plus the conference’s specific terms, to figure that out. You’ll need to maintain close communication with them to determine when to make a GO/NO-GO decision.
The conference’s minimum
Conferences themselves will generally have financial break-even points, and they won’t run training that doesn’t meet minimum registration numbers. Be clear on these thresholds and when there conference team will make their final decision.
Also, keep in mind that waiting on a conference decision could mean higher flight costs if you delay booking.
Next Post: Figuring out your selling point
The financial aspects are only a small part of the equation. To truly succeed, you need a compelling reason for people to choose your course over others in a crowded market. In the next post, I’ll discuss how to carve out your unique value proposition and attract the right audience.
This post is part of a series: So you want to train at Black Hat (or other conferences)?
Other posts in this series: