I spent Saturday, October 24 at Bradley University in Peoria for BSides Peoria 2026. TL;DR it was really good, I learned a bunch, and I left with a goal I can't stop thinking about. I'll get to that at the end. Thankfully, I managed to con Jason Slagle, Matt Lee, and Kat Lee into letting me ride along with them, so a huge thank you to them for that.
What BSides is
If you haven't been to one before, BSides started in 2009 when a group of speakers got turned down by Black Hat's oversubscribed call for papers and decided to put on their own event on the "b side." BSides Peoria is run by the Illinois Cyber Foundation (ICF), and this was its fourth year. It's one day, three talk tracks with villages and competitions going the whole time.
The talks
People Are the Prompt Injection (Jason Slagle and Matt Lee)
This talk is one of the ones that I would definitely encourage people to listen to. Most AI talks are about how attackers are using AI or how we can try to stop them. This one went back to the basics. It set apart AI policy from AI governance. It helped you recognize the patterns that make AI efforts fail, and then reframe AI risk as a people and process problem rather than a tooling problem. The takeaway was pretty straightforward: if the problem is how people and processes handle AI, a new tool isn't gonna do anything. The explanations were clear, and everyone in the room seemed to love it.
The Most Personal Thing You Own (Gabe Roy)
This talk gave an intro to mobile app pentesting that covered Android and iOS side by side, starting from the assumption that the attacker is holding the device. My favorite part was the FRIDA examples, which let you watch an app at runtime and see what it's actually doing. If you've done web pentesting and wondered how mobile differs, this was a good place to start. Gabe is a red team consultant at Google Cloud (Mandiant).
Gen AI Ain't Your Buddy, Neither Is Your Lawnmower (Bill Bernard)
This talk gave a good basic grounding in what generative AI can and can't do. The talk gives a great example about asking an LLM to talk about RFC 1149, the April Fools' spec for IP over Avian Carriers, and whether it can tell it's a joke. My takeaway was to use these tools for what they're good at and not expect them to do everything, the same way you wouldn't slice a roast with a table saw.
Keynote: The Trophy Is Not the Test (Alethe Denis)
Alethe won a DEF CON Black Badge by compromising a Fortune 500 target over the phone in the Social Engineering CTF, so it was a little funny that her keynote was about why the trophy isn't the point. Her argument is that shells and compromised accounts make good stories, but the real value of an engagement is what the organization learns and how it improves. Lots of offensive and physical security, and an engaging talk.
Meeting Jack Rhysider
I got to meet Jack Rhysider, the guy behind Darknet Diaries. He started the show in 2017 because he wanted something like it to listen to and nobody had made it, so he did. At the meet and greet I heard some of his stories and got to chat with him. Great guy. Alethe has been a guest on the show too.
Jack doesn't allow photos of his face, so you get his shoe instead.
Everything else
Villages are mini-conferences inside the conference, each focused on one niche with its own talks, labs and challenges. BSides Peoria had three. The Human Hacking Village covers social engineering, with the Vishing Challenge, the Phish Bowl inbox simulation and a game called Zero Trust. Bradley University's Physical Security Village has lockpicking and bypass practice rigs for every experience level. The Radio Frequency Village covers software-defined radio, signal analysis, Wi-Fi, Bluetooth and RFID.
The villages and competitions ran all day, and I wish I could have split myself into four. A few things from the program:
- The first-ever BSides Peoria CTF, built around a sabotaged airport, a PHP exploit, and a missing director.
- Shade Runner, where you sneak down a sensor-protected hallway and grab a target using an umbrella that blocks infrared.
- The Vishing Challenge, with teams making live calls under names like APT312, [Redacted], and Gender Diversity Hires. APT312's bio says the 312 is geographic, not the number of calls it takes for someone to finally help them.
- Phish Bowl, a simulated inbox where you sort real email from phishing under time pressure.
- Lunch was a baked potato bar, which is the correct answer to what hackers eat.
The badge and the swag
The badge was super cool, and it's a challenge in its own right. It's an electronic badge built on a custom printed circuit board (PCB), pictured at the top of this post, with a QR code, an Illinois outline, Bradley's logo, an 8-pin chip and rows of tiny surface-mount components. Along the bottom edge are gold contact pads labeled COM0 through COM15, which is the kind of hardware that invites poking around. The board is marked Rev 2.0.2. On top of that I came home with a bunch of stickers, notebooks and shirts.
The people
The crowd was a good size, and what surprised me most was the range of experience. There were students, practitioners, business owners, MSPs, and people from companies like Mandiant (Google), Huntress, and Rivian, all in the same hallways and the same talks. The connections I made were great, and a regional one-day event is one of the few places you can just walk up and talk to folks like that.
The best advice I heard came up again and again. Everyone in the industry I spoke to said how important blogs, videos and that kind of content are, and how far they can take you. And here I am, making a blog post. FAANG or MANGO or whatever it is nowadays, here I come!
Thank you
Big thanks to Nick Schroeder and Cody Kretsinger, the executive directors of BSides Peoria and the Illinois Cyber Foundation, for putting this together. A one-day conference with three tracks, three villages, a CTF and a live vishing competition does not run itself. Thanks also to the volunteers, the speakers, Bradley University, and its Center for Cybersecurity for hosting, and the sponsors, including Brackish Security and CyberDrain at the platinum level. And thank you to everyone who took the time to talk shop and share advice.
Verdict
Worth it, easily. Good talks, plenty to do, and for the price I have nothing to complain about. I'm going next year, and if you're in the Midwest and into security, I'd say go.
Now the goal. BSides Peoria gives out Black Badges at its awards, and I need one. It's my life mission. I was dumb and didn't bring my laptop this year so I couldn't compete for one, but next year, I'm going to get one. My training plan starts with remembering the laptop.