ShmooCon to take its final bow in 2025

This year’s annual ShmooCon in Washington, DC, got off the ground with some surprising news: Next year will be the last for this popular and beloved hacker conference.

Or, as the event’s organizers, husband and wife Bruce and Heidi Potter, heads of conference owner Shmoo Group, put it during the opening session of the conference, ShmooCon 2025 will be a “commencement ceremony,” a graduation of sorts rather than a sad occasion marking the last time the gathering will be held. The first ShmooCon was held in February 2005 and attracted 400 attendees.

Over the past 20 years, ShmooCon has become a must-attend hacker event and has grown to about 2,200 attendees each year, attracting attendees from around the world, including government and intel agency employees, contractors, hackers, security professionals, and students. Shmoocon features dozens of talks on mostly original security research, alongside lockpick workshops, parties, and other activities related to cybersecurity and hacker culture.

Every ShmooCon has sold out since 2007, with the Shmoo Group releasing tickets in tranches, only to have each batch sell out in seconds. The conference sponsorships likewise sell out. During the opening session, Heidi Potter said that organizations perpetually lobby Shmoo for more sponsorships but that Shmoo likes keeping the exhibition space and sponsorships at their current size.

The event’s popularity stems from its chill, welcoming atmosphere and its focus on unique and original content. “There’s something special about Shmoo,” Andy Piazza, operations lead for BSidesNOVA and the global head of threat intelligence at IBM X-Force, tells CSO. “We’ve talked about it, and I’ve tried to explain it to other people who haven’t been. Shmoo has that local vibe, even though people travel from all over the world,” he says. “You don’t get that at DEFCON. I love DEFCON, but Shmoo has a local family tribe vibe. And I think that’s the thing that’s the most special. The biggest draw is just randomly having coffee with people that we consider rock stars in our field. Or having the NSA cybersecurity directors here.”

ShmooCon going out on a high note

The high level of success and appreciation that ShmooCon has garnered makes news of its final event next year even more surprising, but the decision is based on a personal time clock that the Potters had established for themselves. Heidi Potter tells CSO: “A number of years ago, I had kind of maybe jokingly said, ‘Yeah, this is great, we’re going to keep doing it.’ But maybe offhandedly, I said I was not going to do this past the age of 50. It’s a weird thing I’ve done in my life where I’ve set markers for myself. Then, as we approached that time and we were looking at where the con was going with the nature of the event and the momentum of the event, it really started to make sense. And, so, we just made it a thing.”

“I’ll be 51 at the last ShmooCon, not 50. It will be the twentieth ShmooCon because [they didn’t host ShmooCon for one year during the COVID-19 pandemic]. I may or may not have grandchildren by then, but we knew we wanted to just end when it was good. We wanted to go out on a high note,” Potter says.

“I think that we accomplished what we set out to do with the event, to really get people engaged, help bring more people into the industry, the community, give them the opportunity to learn and set an example that others can learn from and follow and build upon,” Bruce Potter tells CSO. “I think we’ve done a lot of good work, and we keep hearing stories now that we’ve announced this of the impact we’ve had on people’s lives and their personal lives and their careers. And so, when you had that kind of impact, I think we could be comfortable saying, okay, it’s time to let go, time to let everybody move on into the next things that they’re going to do. That’s a great feeling.”

As anyone who has attended ShmooCon knows, the conference is a family affair, with the Potters’ children pitching in to help run things. “Honestly, it is so much work for us and our family,” Bruce Potter says. “We run it out of our house. And so, the weeks before the holidays every year for decades now, it’s been like the house builds up with boxes, and the kids are all working, and we are making badges and banners and all this kind of stuff. I think even on a personal level, it’ll be nice to have a holiday to relax and not have all this over our head.”

The conference has a dedicated staff of about 90 volunteers, many of whom show up year after year. “You’ve got to build your team first because without a team, without a good team, nothing else happens. You spend so much time fighting those fires, and those aren’t the fires we want to fight. When I show up here, the amount of support that they give me just makes this fun.

ShmooCon “the most amazing journey to be on”

The Potters have no plans to sell the event. “I would say from the very beginning, we always knew we wouldn’t sell the event,” Heidi Potter says. “We wouldn’t hand it over. We always knew it would come to an end at a time of our choosing. This has been just, I think, the most amazing journey to be on.”

However, an end to ShmooCon is a beginning to a new career for the Potters, who will work together at a new venture they’ve founded, Turngate.io, which plans to release a visual interface that makes understanding logs easy. “We still got a few years of work out of us,” Bruce Potter says. “Well, even if we stop working, we’ll get bored and do it again.”

Although most of the attendees said they were sad to see ShmooCon come to an end, most accepted the Potters’ decision. One attendee who goes by the name Almost Human has attended every ShmooCon since the beginning tells CSO, “I’m sad to hear [it’s ending], but I also understand that when you plan a major conference like ShmooCon, especially a very well-regarded conference, it takes a lot of work. It takes a lot of resources, and I understand why they might feel that they’ve got to walk away.”