Opening Words – Research conferences aren't effective.

Opening Words: Research Conferences Aren't Effective

Speaker: Gadi Evron, CEO, Knostic

Conference: [un]prompted 2026 — The AI Security Practitioner Conference

Date: March 3–4, 2026, San Francisco

Watch on YouTube: https://www.youtube.com/watch?v=uH-UggR2Txg

Reading time: ~7 minutes

TL;DR

Gadi Evron opened [un]prompted 2026 not with a keynote but with a provocation: most security conferences are bad at creating the informal peer connections that actually matter. Drawing on a classic talk by Joe Stewart and closing with a Dan Hubbard poem that skewered "vibe coding" culture, Evron set the tone for a community-first event built around action over theater.

Introduction

When the CEO of an AI security startup takes the stage to open a conference, the audience typically braces for a polished keynote with optimistic market projections. Gadi Evron delivered something deliberately different: a candid ten-minute manifesto about what conferences get wrong, what this one was trying to fix, and four philosophical points for navigating a moment in security that feels impossible to keep up with.

[un]prompted 2026 was, by Evron's own description, a community thing that grew well beyond its original design. What started as a 120- to 200-person event kept expanding because the community kept showing up — the venue moved, the organizers ran a deficit out of pocket, and the conference swelled to roughly 800 to 850 online attendees alongside the in-person crowd. Nearly 500 talks were submitted for a program that had room for 70 to 120. The late-submission crunch was real: about 40% of proposals came in during the final two to three days.

▶ Watch: Opening Welcome and Logistics (00:00)

Four Points for an Era That Feels Impossible

Evron opened his philosophical section by admitting he had no smart thoughts prepared, then promptly delivered four that landed.

From deterministic to non-deterministic. The first point came from Sounil Yu, Evron's co-founder at Knostic: we are moving from deterministic to non-deterministic configuration. This framing, Evron argued, is genuinely useful for focusing thinking on what security looks like in the AI era. Traditional security was built on predictability — known inputs, known outputs, defined attack surfaces. Agentic systems break all of that.

The anti-startup era. For the entrepreneurs in the room, Evron was blunt: everything he learned about startups — focus, product-market fit in three months, the standard playbook — is broken. How do you build in a world that shifts faster than your roadmap?

Everyone feels outmoded. Evron described talking to CISOs and CEOs across the industry, all expressing the same anxiety. "I don't feel on top of technology the way I used to. Everyone just feels outmoded all the time." It didn't matter if the person was a PhD deep in math, a security operations analyst, or a finance executive — the feeling was universal.

You are not outmoded. Just try. The fourth point was the one Evron said he really meant. The gap between the state of the art and where most practitioners operate is not fixed. Using ChatGPT or Claude the way you used to use Google is fine as a starting point, but learning to conduct real multi-turn conversations, understanding the agentic loop, experimenting with tools like Claude Code or Cursor — each step moves you meaningfully forward. "If instead of investing so many dollars in foundational labs and models, we just tried to teach people how to use these tools right, we would be everywhere right now."

▶ Watch: Four Philosophical Points (02:00)

The Problem with Conference Networking

The second section of Evron's opening adapted slides from a talk that researcher Joe Stewart originally gave at a conference called ACoD. Stewart's thesis: researcher conferences aren't effective because they're structurally bad at creating the informal connections that generate real value.

Stewart's complaints are recognizable to anyone who has attended a large security conference:

• Name tags are impossible to read without being awkward about it
• Putting faces to names is genuinely hard, even when you've seen someone's profile photo
• Social time is usually a noisy bar — the least effective environment for substantive conversation
• There's no easy way to find out who does similar work, what tools people actually use, or how to establish the informal sharing relationships that make the threat intel community function

What Stewart actually wanted, Evron explained, was essentially a Tinder or Facebook for conference attendees — see a photo, understand who someone is, know what they can offer and what they need.

▶ Watch: Joe Stewart's Conference Problem (06:00)

The solution they built for [un]prompted: "baseball card" slides. Each card shows a photo, a LinkedIn link, what the person can offer, and what they need. Stewart's card and Evron's own card appear in the shared deck. Anyone who wants to be added can email the conference organizers. The goal is simple: make it easier to actually talk to people.

Conference Mechanics Built Around Connection

Evron outlined the specific structural choices made to counter the usual conference dynamic:

Slack-first engagement. Most conferences actively discourage attendees from being on their phones. [un]prompted did the opposite: every talk got its own Slack thread, slide decks were shared in those threads after sessions, and speakers committed to answering questions there if time ran out during Q&A. "We are owning Gen Z. Go to your phone, get on the Slack, talk to people."

TurboTalks. An easel in the back of the room accepted unconference-style talk proposals, voted on by attendees using sticky notes with smiley faces and stars. The winning proposals got time the next day.

Forced awkward greeting. In what Evron called an "HR moment" (declared with obvious reluctance), attendees were asked to look left, look right, and say hi out loud to the person beside them. The joke worked. The point was real: one more person you've said hi to is one more person whose conversation you can join.

▶ Watch: Conference Format and Mechanics (08:01)

Question discipline. Borrowed from journalist Jelani Cobb: "A question is an interrogative sentence generally denoted by an inflection at the end." Questions request information; statements provide it. The conference preference was for questions, framed in 30 seconds or fewer. Anyone making a statement instead of asking a question was warned that Evron would find them.

Dan Hubbard's Poem: "Secure the Path Where Vibes Explode"

The session closed with a poem by Dan Hubbard, written specifically for [un]prompted and prompted — literally — using an AI system. Hubbard's prompt: he's a 50-plus-year-old who has written 35 apps in the last nine months using AI tools with minimal formal programming background. What are the risks?

The poem that resulted was a pointed, technically literate indictment of the vibe coding era:

When every employee codes by feel and prompts to replace the change control seal, the org chart bends, the backlog breaks, as product ships, and coffee breaks.

A breach no longer kicks the door, it forks a repo, and asks for more.

Zero-day is vibe at scale, where governance arrives by credit card mail.

The poem ran through a complete taxonomy of emerging risks: agents calling agents with scopes too broad and guards asleep; prompt injection dressed as help that makes your agent hand out wealth; service accounts with "God mode in"; test credentials left behind; libraries six months out of date in CI/CD pipelines. It closed on a message that captured the conference's ethos: "Build boldly, let the builders play, let innovation light the way. But in this world of instant code, secure the path where vibes explode."

▶ Watch: Dan Hubbard's Poem (10:01)

Notable Quotes

"We are moving from deterministic to non-deterministic configuration." — Sounil Yu, as quoted by Gadi Evron (02:00)

"If instead of investing in so many foundational labs and models, we just try to teach people how to use these tools right, we would be everywhere right now." — Gadi Evron (04:00)

"If a CEO isn't spending time in tools like Claude Code or Cursor or whatever it is you're using, I genuinely don't believe that company survives." — Gadi Evron (04:00)

"Zero-day is vibe at scale, where governance arrives by credit card mail." — Dan Hubbard (10:01)

Key Takeaways

• The shift from deterministic to non-deterministic configuration is the most useful framing for rethinking security in the AI era — not AI as a tool, but as a fundamental change to the nature of systems.
• Professional obsolescence is a feeling, not a fact. Every security practitioner currently feels behind. The antidote is experimentation, not expertise: use agents, play with agentic loops, and accept that movement matters more than mastery.
• Conferences are structurally bad at networking, but specific structural interventions — baseball card slides, Slack-first engagement, dedicated unconference slots — can meaningfully improve the outcomes.
• Vibe coding is a real and specific attack surface. Speed-to-production without governance creates prompt-injectable agents, over-privileged service accounts, stale dependencies, and missing audit logs.
• Leadership must model AI tool adoption. Evron's view: organizations whose executives aren't actively using AI coding tools will not survive the transition.

Slides Reference

Slides from this session are available as part of the [un]prompted 2026 slide deck (PDF: 2026-04-04-D1-S1-9-01-Opening-Words-Research-conferences-aren.pdf). Key slide topics include: the four philosophical points for the AI era, the Joe Stewart "baseball cards" networking approach, and Dan Hubbard's vibe coding poem.