15 Years of BSidesSF (Anniversary Panel)

15 Years of BSidesSF: An Anniversary Panel

Speakers: Reed Loden, Ricky Lawshae, Steve Christey Coley, Tania McClain, Meghan Manfre

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: https://www.youtube.com/watch?v=cw6sqW0FWio

Reading time: 7 minutes

TL;DR

Five core BSidesSF organizers — some with a decade-plus of involvement — gathered for a candid, AMA-style retrospective on 15 years of running one of the Bay Area's most beloved community security conferences. From DNA Lounge basements to a full takeover of the AMC Metreon's movie theaters, the panel covered the logistical realities, personal trade-offs, accidental origin stories, and future ambitions of an all-volunteer operation that has grown to fill three floors of a San Francisco convention complex.

Introduction

BSidesSF 2025 marked the conference's 15th anniversary — a milestone that prompted organizers to step in front of the audience for a rare moment of transparency about what it actually takes to build and sustain a community security conference year after year. The panel, moderated in an AMA format, included Reed Loden (president and lead organizer, 10 years), Meghan Manfre (9 years on staff), Tania McClain (former lead, now advisor), Steve Christey Coley (14 years, safety ops), and Ricky Lawshae (sponsors and operations, since 2017).

What emerged was a portrait of an organization that has genuinely surprised itself: a conference that started in a nightclub and stumbled into a movie theater, that nearly imploded over costs and space constraints, and that has created a self-reinforcing community loop visible in attendees who built entire careers from connections made at the event.

▶ Watch: Introductions and Origins (00:00)

From DNA Lounge to IMAX: A Venue Journey

The conference's physical evolution tracks its growth in miniature. BSidesSF began at DNA Lounge in San Francisco — a dark, hot nightclub that Steve Christey Coley recalled fondly: "OpenDNS was my first volunteer. That place was dark and hot. But we had food trucks." From DNA Lounge, the event expanded to include Buzzworks next door, then relocated entirely to City View at Metreon, then began adding AMC theater screens for overflow, and by 2025 had expanded to occupy all of AMC — essentially the entirety of three floors of the Metreon complex.

Reed Loden described the movie theater expansion as partly accidental: "We kinda lucked into that. We didn't actually start in AMC. We started just with City View. And it just so happened that in this building there's a movie theater." The IMAX screen in particular became a source of organizational pride — the five-year-old child who attended in 2025 was there to watch their parent present a talk on a three-story screen, an image that captured something the panelists clearly valued about what the conference had become.

▶ Watch: Venue Evolution and Growth (10:01)

The question of what comes next remains genuinely open. The panelists debated two models: continue expanding (the "next step" from AMC would represent a significant jump in cost and complexity), or follow ShmooCon's approach of setting a hard attendance cap. Ricky Lawshae regularly floats the idea of a cruise ship, to the audible displeasure of at least three of his co-panelists. The organizers acknowledged they have been looking for years for a venue that matches City View's characteristics — accessible, securable, expandable, close to Moscone — but have not found a clear successor.

The RSA Relationship: Partnership, Not Dependency

A recurring theme in audience questions was the conference's positioning relative to RSA Conference, which runs concurrently in San Francisco. The panelists were candid about the symbiosis: BSidesSF benefits enormously from RSA's gravitational pull, particularly for international attendees and speakers who would not otherwise make the trip to San Francisco specifically for a community event. The comparison to BSides Las Vegas — which benefits from Black Hat and DEF CON in the same way — was made explicitly.

At the same time, Reed Loden noted that the relationship is increasingly bidirectional: "It's always fun to hear that someone came to BSides and decided, 'I'll also do RSA while I'm here,' instead of vice versa." The costs of venue and services around RSA week are higher, and space is constrained, which creates a natural ceiling on growth that might one day make decoupling attractive. For now, the overlap is considered a net positive for reach and diversity of attendees.

▶ Watch: BSidesSF and RSA Relationship (12:04)

The conference's connection to the broader BSides network also came up. BSidesSF is an independent 501(c)(3), not a franchise of the BSides brand — each BSides event is independently organized. The name itself, as the panelists explained to the portion of the audience young enough not to know what a cassette is, refers to the B-side of a vinyl or cassette single: the material the major labels didn't want on the A-side. The analogy to conference talks rejected by mainstream events (BSidesSF's founder is a musician) was intentional and remains apt.

What It Actually Takes: Operations Behind the Scenes

Several audience questions drilled into the unglamorous mechanics of running the conference. The answers were illuminating:

Equipment: Most of what attendees see — furniture, tables, chairs, all AV equipment — is rented. Network gear has been donated by various community groups over the years and is owned by the conference. Cameras are also owned. A dedicated year-round volunteer manages inventory, because the quantity of owned equipment now justifies it.

Safety ops: Steve Christey Coley described the safety operations team's mandate as three concentric priorities: protect the show (keep the conference running), protect attendees (enforce the code of conduct, prevent bad experiences, manage alcohol responsibly), and protect the venue (fire lanes, wall damage, the expensive repainting bills that result when walls are leaned on). Safety ops has grown from Christey Coley and a handful of volunteers into a four-layer organizational structure with leads, sub-leads, and over 100 people on event day.

▶ Watch: Safety Operations and Logistics (30:05)

Staff time commitment: Reed Loden was direct about the personal cost of organizing: "There are certain weeks, especially closer to the event, where I'm spending at least 40 hours on my day job, and then probably at least 30 hours on BSides stuff. I basically have two full-time jobs, and only one of them pays me." Several panelists acknowledged they had been seriously considering stepping back, and that succession planning — building deep enough org structure that the event does not depend on any individual — has been a deliberate priority. Meghan Manfre noted that the staff has grown from roughly five people to a substantially larger team, with documented processes replacing institutional knowledge held in single people's heads.

Community as the Core

The most emotionally resonant moments of the panel came when organizers described why they keep coming back despite the time cost. The consistent theme was the community feedback loop: attendees who got their first jobs at the conference, speakers who launched companies from connections made in the hallway, sponsors who became volunteers who became staff. Reed Loden cited Code Red Partners as a recent example — Tom started as a volunteer, founded a company, sponsored at a lower tier, ran the Career Village, and is now a gold sponsor.

Tania McClain described the contrast between BSidesSF and BSides Las Vegas in terms that explained the conference's unique draw: "You don't have that year-over-year community being built in Vegas. You see the community growing every year here. There's always this positive feedback loop that makes you wanna keep coming back."

▶ Watch: Community Stories and Future Plans (18:04)

The panelists also discussed community groups that have had a consistent presence at the conference: OWASP, EFF, Pacific Hackers, ISC², Girls Who Hack (now Women in Security), WISP, and YCIGS, among others. Giving those organizations a table and visibility at BSidesSF is described as a deliberate form of giving back to the broader Bay Area security community.

What's Next — and What Was Lost

The panel closed with a discussion of things the conference used to do but had to stop. The internship program — which brought students into the conference as working volunteers to help them break into the community and overcome imposter syndrome — was a particular loss that several panelists expressed interest in reviving, noting the parallel with BSides Las Vegas's dedicated first-time-speaker track.

Audience member RoRo asked whether a throwback party at DNA Lounge might happen in a future off-season. Tania McClain endorsed the idea of a mid-year N0 CON-style event. Ricky Lawshae continued to lobby for a cruise ship. Reed Loden appeared unmoved.

The one thing all panelists agreed on: the youngest attendee at BSidesSF 2025 was five years old, and was there to watch their parent present from the IMAX stage. That, they said, is the community they are building.

Notable Quotes

"I basically have two full-time jobs, and only one of them pays me." — Reed Loden, ▶ 22:04

"It's always fun to hear that someone came to BSides and decided, 'I'll also do RSA while I'm here,' instead of vice versa." — Reed Loden, ▶ 12:04

"I keep telling my family this is my last year, and then I come back." — Tania McClain, ▶ 20:04

Key Takeaways

• BSidesSF has grown from a nightclub event to a three-floor conference complex through a combination of deliberate expansion and fortunate proximity to the AMC theater inside the Metreon building.
• The RSA co-scheduling is a strategic asset, bringing in international attendees and speakers who would not otherwise travel specifically for BSidesSF, though venue costs and space constraints keep the relationship worth re-examining annually.
• All-volunteer operation at scale requires organizational depth: safety ops alone is now four layers deep, and the conference's sustainability depends on building processes that outlast any individual organizer.
• The community feedback loop is the conference's most distinctive quality: the year-over-year return of the same Bay Area community — as attendees become speakers, speakers become volunteers, and volunteers become leads — creates the social fabric that distinguishes BSidesSF from one-time visits to larger events.
• Succession and continuity are active priorities: several long-tenured organizers are stepping back from day-to-day roles, making recruitment and knowledge transfer critical to the next 15 years.