SoCraTes 2026 - Managing Energy

It's been my fifth time at SoCraTes Germany this year. It felt like diving into a familiar place where I can experience a proper timeout from everything for a few days, and soak up one variation of how "good" can look like. By far not perfect or without potential for improvement, but truly good. Being there the fifth time, with my communities from various conferences and tech areas overlapping more and more, also meant that I met a lot of wonderful people again that I just enjoy spending time with, be it in deep conversations, sharing our passions, or spending our time on the silliest fun activities. The great thing about SoCraTes is that the organizers intentionally craft the space, so I won't only meet people who I've grown close to, but every year I'm getting to know lots of amazing people I haven't met before. I truly enjoy making new connections. The sad thing is, that I will never be able to do any of my connections justice in how I choose to spend time with them. I'm grateful nonetheless for all of you.

 

Arrival Day 

This year was truly exhausting so far. Which meant that I couldn't start into SoCraTes well rested with my energy levels fully charged - they were rather in the lower parts already. Not a great idea in hindsight, but hey, you have what you have and you choose how to work with that. The travel day went well, I had plenty of time catching up with Martin Schmidt during the train ride, and enjoyed meeting a few first people when arriving at the venue.

The evening was calm, with great conversations at our dinner table about organizing conferences, the conference I co-organize, company culture and what it means for people wanting to go to conferences. Yep, there was a pattern for sure! The evening went longer, topics changed, I could catch up with a few people and then it was time to rest in preparation for the next day.

 

Training Day

This year, Juke Trabold was the facilitator for the conference. I was truly happy to see them again in this role, as for me, Juke is one of the most skilled, considerate, thoughtful and kind persons, facilitators and moderators I know of. They set the space for all of us from the start in a manner that resonated throughout the event.

During the opening, I met Daniel Steinhauer in person again, a former colleague, dear friend and conference co-organizer fellow. It's been his first SoCraTes and I'm still super happy he trusted my (and other folks') recommendation to experience it for himself.

The training day offered less sessions than the last years, and it was still hard for people to make a choice. For me the decision was fortunately straightforward, so one thing less I needed to spend energy on. Another change was that the first training was twice as long as the second slot, an interesting experiment. It worked out for me this year.

For the first session, it was instantly clear to me that I would join Gitte Klitgaard's training "Psychological Safety Awareness" as soon as I read she's going to give a session. I've had the honor to witness her talks and workshops in the past and speak with her personally many times. Every time I'm going to Gitte's workshops I'm gaining new insights about the topic and myself. Even when doing a workshop I've been to already in the past, like this one. It's worth it every single time. Invaluable. This training was once again bringing different aspects to my attention. Gems like: "If you are not failing, it's either not challenging enough or you're not safe enough." or "You can't just follow a guideline to create a safe environment as it's about the fear we have inside." Also on the facilitation of the session itself, like "Ask people to pass explicitly so they used their voice on the room, so it's easier to use it again." or "One reason I sit down here is not to be the teacher, you're not reporting to me." I also made new realizations about myself - which doesn't often happen in training settings. With Gitte, they just show up. She's setting the space in a way that allows that to happen for me. Anyways, I cannot share much deeper insights here as the training rule rightfully was that nothing leaves the room. I can say, however, that I really appreciate my fellow training participants for sharing so openly with each other, giving each other the room to do so as well, and practicing listening to each other.

For the second training I chose Diana Montalion's "From Feature Factory To Forge". I only witnessed Diana on stage before and was curious how her energy would show up in a hands-on session. It did show a lot and I loved it! Perfect for this late afternoon session. Also, I was pleasantly surprised to see Sofia Katsaouni co-facilitating the session, adding another angle on the topic and leading by example with her human skills. What both of them offered us was a fun group exercise in multiple evolutionary steps. We had to design a movie review themed system. Decide what are the core concepts for it. Have another group provide us definitions for those concepts without interaction, so there were plenty of surprises to deal with! We defined our core capabilities. We had the system challenged by people from other groups. We could evolve it further in short time. Our group even checked if the domain name we had in mind was still available! A key phrase that stuck with me was "Agreement on words is not the same as agreement on meaning." Oh my, we've all been through that. Besides that, I really enjoyed Diana's references to improv theater (I really like the "yes, and" to build on each others' ideas). A fun surprise was the mention of "No Vehicles In The Park", a super fun exercise I had the pleasure to have Elizabeth Zagroba facilitate. Best thing: She was at the conference as well and obviously now had to run this session there, too! I heard people loved it just as much as I did a few years back. She's the best in doing these sessions - not only these sessions, obviously, yet they are a true highlight. If you ever have the opportunity, join and witness your brain be tied up in knots (in the best way possible)!

After the training sessions, I met plenty of folks again and then settled for a calm dinner with Elizabeth Zagroba and Joep Schuurkes to catch up a bit with each other. Then it was time for wold café already, where we ran three rounds of finding a random table, sitting down with a bunch of people, and connecting with each other over a few guided questions. Always a nice start to the main part of the conference and I'm usually getting to know new people this way! Just like this time as well. The evening went on, I dove into a deep and long conversation to catch up with Gitte, and suddenly it was again time to go to bed.

 

Open Space Day 1

Juke introduced everyone to the concept of an open space, then the first marketplace of ideas opened. SoCraTes Germany is the largest open space conference I know of, and this year they probably had a new record with way over 200 people joining. It can really be daunting to pitch a raw idea in front of such a big crowd, let alone wait for this pitch while standing in the very long queue, trying to listen to the current presenter. I'm truly glad this wasn't my first time speaking at conferences, and not my first time at SoCraTes. I'm always in awe how many new people and also youngsters dare to do so! That's one of the very special parts of this conference. It's scary, and at the same time many people feel safe to do it nonetheless.

As usual at open space conferences, I make myself a plan which sessions I want to go to - and then things happen differently. Just like this time, when during the first session slot I met Susanne Neunes in the hallway and we basically opened our own session, talking about the Open Security Conference, organizing, ideas, and a lot more. 

• "Threat Modeling" by Martin Schmidt. I knew Martin had revised his talk and wanted to do either a dry run or have a conversation about the topic. I was curious to hear the talk, learn how he presents the topic to the audience, and what worked for them. It was great to see people interested in this, the following conversation and knowledge exchange was great as well. A core message: "Just start. Better do something than do nothing." I can't agree more!
• "All time favorite computer games" by me. At open space conferences, plenty of people host sessions on all kinds of passions, hobbies and more. I had never proposed a session on a non-tech topic before, yet this year I thought, why not? The year was so stressful and I should focus on some pure fun topics anyways. So I pitched it as a lunch session and was pleasantly surprised seeing lots of folks already at the table, eager to share their most favorite games. And we did! You could literally see the people's eyes light up when talking about their highlights. Together, we came up with a really nice list of amazing games to enjoy. This didn't only give energy in the moment, it was a great idea in hindsight as it grew beyond the event. We now have a SoCraTes games channel on Discord and even our own private Steam group (many thanks to Frank Sons for making all of this happen!). Super cool to see what comes out of a simple idea.
• "Supply chain security" by Bertram Vogel. I really appreciate people bringing security topics and raising awareness on certain risks. In this case, Bertram shared the specific supply chain risks for Node and npm. There's been plenty of examples in the last years for sure. He advocated for good options to offer further layers of defense to protect ourselves, while acknowledging that we always need more. I left the session a tad early to prepare for my own upcoming session, yet overall I felt he reached people to look into this topic further which is great for all of us.
• "Capture the Flag Together (Beginners' Edition)" by me. Well, I know, it's not the first session I do to introduce people to security testing and witnessing how people can find and exploit vulnerabilities to see or do what they are not supposed to. And yet, these sessions are usually good fun. Seems there's also always people coming! This time again, I had a huge room, difficult to moderate yet it seems it went okay enough. Sadly, I already noticed during the session I was lacking energy to help steer this group in a better way. At least some folks did come back for more in the evenings. 
• "OpSec" by Eric. This session sounded really interesting as it was focused on personal security which I really wanted to learn more about. But then I had to realize that my energy levels were super low, my brain too tired to focus on the session. So I had to leave early and found myself in the coffee corner just chatting a bit before the evening closing of the first set of sessions. Good time to write some kudos cards as well! Before I experienced this way of appreciating and recognizing someone else, I never understood the concept of physical kudos cards. Now I'm their biggest fan. There's just something special about receiving a written thank you, and even better: giving it to someone else and seeing their face light up.

Dinner time! This evening, I tried to catch up with as many dear community friends as possible, and it worked. Like with Thierry de Pauw and their two kids, and Marc Kalmes. I had a fabulous time at table 19 and I had the impression it worked out for the others just as well. 

Well. And then I continued my self-imposed, now well-established tradition to host an evening session: "Capture the Flag Together (Adventurer's Edition)". This time, I even had it start late to make more time to talk with people beforehand. And still, once again, so many people showed up, curious to explore and learn together. It was a really nice session, while it was also a very frustrating session as we didn't get the flag yet. When we realized it was late in the night already we agreed to tackle this again the next evening with a fresh perspective. 

Open Space Day 2

While the day before I had already realized I'm lacking energy, this day I couldn't deny it anymore. Usually, I manage to get myself out of bed for the second marketplace, even if just barely. This time I just couldn't. Good thing is I wanted to be easy on myself anyway and not propose a session during the day but rather join more from others. And then it happened again, the first time slot I ended up in an impromptu hallway track session. I just talked with folks and enjoying my time while allowing myself to start the day slower.

• "Security card game" by Philipp Zug, Martin Schmidt and me. Oh right, didn't I say no session for me today? Well, no session to pitch today, as Philipp was so kind to take this over for us. And yet, of course I wanted to join our little group that bonded together a few years ago at SoCraTes 2023 and started building a security-themed game as a little relaxed side project. Every year since we hosted a playtest session at SoCraTes, so obviously we were eager to see how people interacted with the game in its current state. It didn't evolve as much as we planned to since last year, and yet there were some significant improvements. This time, it showed! For the very first time, people in the room really played the game as is. They chose a scenario to play. They went slowly, card by card, making thoughtful decisions together. They introduced a group voting. They pondered back and forth about potential outcomes of their decisions. It was such a joy to observe! Also, this group had wonderful feedback once again that will help us in the coming year to improve the game further. Definitely an energy-giving session.
• "Photography" by Camille de Pauw. I love art. Especially visual art. Whenever I interact with art, it makes me connect with a part of myself that I don't often have the capacity to connect to and it re-energizes me. This session was just beautiful. Camille dared to showcase favorite pieces of a photography project she worked on, with the theme of feminism, capturing women resting in themselves and showcasing strength in doing what they're doing. Camille prepared the room in a way that when you entered the session, you instantly dove into a different world. Not the conference session you'd expect! Suddenly you're confronted and engaging with her pieces, alongside many others who do the same in their own way. Some people just looked intensely at the photos. Others discussed their origin and making. Some found details others missed. Some evaluated what they liked and what they would change. It was just beautiful. I admire Camille's courage to do this. For me, my heart and soul was full after this session and I really wouldn't have missed it. 
• "How to delete stuff" by Elizabeth Zagroba. So many people joined to exchange their experiences on a very crucial topic that is far from easy but all of us face sooner or later: the topic on how to get rid of software. Features, services, you name it. Decommissioning and sunsetting things is hard. Deleting even lines of codes can be hard for people (personally, I usually really enjoy this). I loved how this session truly engaged people, how they listened to each other sharing advice and hardships, how we all took note on ideas that might help us delete more stuff that most definitely should be deleted. A few gems I took with me were "Get people moving, just moving alone helps", and the idea of ADRs as "Any decision record" to take away the pressure, make it everyone's job, be clear it doesn't have to be perfect and lower barrier. Ingenious.
• "Cat Hicks' 'Psychology of software teams'" by Simon Görtzen. I've been following Cat Hicks for a while on social media and was inspired by many takes from her researcher point of view on software team dynamics. As soon as I heard she wrote a book, I had to get it. Well, I truly lack capacity this year and I have not read her book yet. Even better that Simon did and gave a session to review the core points as well as comment them with what parts resonated with him. Really insightful session that strengthened my resolution to read this book. A core topic here was the message to recognize "culture and psychological safety as core infrastructure of a learning organization". Hear, hear.

The open space was nearly over by now. We did a retrospective, gave further kudos cards, thanked the hotel staff and childcare folks. With that, the open space was officially closed by Juke. That didn't mean we couldn't propose evening sessions and also longer workshop slots for the next day. And even promote partner conferences, like, who would have guessed, the Open Security Conference that has its origin at SoCraTes 2023 as well. Super cool to have four organizers represented at SoCraTes this year.

Dinner time, conversation time, play time. Finally I had a chance to catch up a bit with Janina Nemec and play our traditional round of SET together. Time flew by and - guess what? - another round of "Capture the Flag Together (Eventually)" started. We continued on the same machine as the day before and hurray, we found the flag! It was fun and we all learned a bunch with this as well. The evening (shall I say night?) closed for me with yet another tradition: long nighttime walks together with Tobias Goeschel, talking about - well, everything. It's an honor, a pleasure, and not taken for granted we can do this, at least once a year.

 

Workshop Day

Last day of the conference, reserved for longer hands-on interactive sessions. I've joined a few of them in the last years, I've given my own workshops, or just gave myself more time to connect with folks. All of that has value. This time I tried again something new. Martin Schmidt and I had considered to propose a threat modeling workshop to conferences next year, so what better opportunity to try ourselves at SoCraTes to introduce people to the topic and give them first-hand experience? It really helped we had talked about the topic multiple times this year already. It also helped I had just been at his talk during the open space. For the workshop day, we had briefly aligned on what we intended to do. Yet the final concept? Due to so many things going on, we created it only half an hour before the workshop. Usually, that would be my horror scenario. Yet as we know each other well, we managed to quickly draft out the structure and exercises and we were indeed ready to go, and calm on top. Super grateful for Martin's trust! Both of us were happy to see all the people who showed up, we had way more participants than expected. We ran the workshop and we saw people were really engaged. They didn't only have fun, they also had insightful discussions and feedback in the end. I can't reveal too much here, yet it seems this workshop idea is truly taking shape for next year. Lots of things went well, we have some tangible improvements, the proof of concept provides value. What a cool insight to take with us.

As we had just spent a lot of energy it was great that the afternoon was calm and I had some time to catch up with things before we headed for dinner. At dinner, how else could it be, people schemed plans for the evening. Lightning talks, conference session summaries, board games. I shared I'd offer another round of Capture the Flag Together as that's my kind of fun - and people instantly signed up for it. So this happened once again! Truth be told, I shouldn't have done it the way I did, as my energy levels were way too low and I didn't manage to facilitate and moderate the room in a way I should have when hosting a session. Lesson learned for the next time.

In the late evening, there were surprisingly few people left. We grouped together and had a really relaxed end of the day. One of my highlights were to playtest a puzzle game - details not to be revealed yet, I'll leave that to the authors! It was super fun, it had everything I need from such a game. A nice way to discover the rules. Just the right level of difficulty, not too easy and difficult enough it's doable but an achievement to solve the puzzle. And a perfectly weird theme you can be playful with. Special shoutout to Claudia Bischoff for fully diving into this together with me!

 

Departure Day 

This late night session would have been the perfect ending. But of course it wasn't, there was still the journey home and that starts with whoever has to leave the venue at the same time. For me it was a perfect opportunity to catch up with Jana Fuerchtenicht on the first leg of the train ride. Thank you so much for keeping my spirits up while my energy levels were crashing, I really appreciate it!

Martin Schmidt and I continued on and chatted for a while until I was on my own. I arrived home and I realized I was completely exhausted. While some of the sessions refilled my batteries, a lot of other happenings had drained me. I had definitely overexerted myself, this time worse than ever as I had already come to the event with a clear deficit. Another reminder that I need to manage my energy levels way more actively than I did this time. Don't get me wrong: this conference is absolutely worth being at and investing energy in. At this event, people care - not only for themselves, but also for each other. Some situations will give a lot of energy, some will drain a lot of energy (and be still invaluable). Sometimes we manage to find a balance, sometimes we don't. This time, I just clearly didn't. A stark reminder for myself and I'm glad I had it. Sometimes we need those reminders to change the way we do things. During the coming year and also at SoCraTes 2027 - I hope to be back!

 

AskAppSec - Capturing Flags

Deliberate practice proved being invaluable in my own career. The last months showed me once again that this applies to the field of security just as well.

As we can't practice security related skills on just any system without causing harm, we need dedicated spaces to practice safely. Fortunately, there are lots of options readily available out there, way too many to list them all. Hence, here are just a few sites that provide not only great starting points yet also the opportunity to go as deep as you can.

• OWASP Juice Shop: This is an intentionally vulnerable web app, mimicking a quite common e-commerce scenario. Based on this, you get a set of challenges presented that allow you to try out techniques to find and exploit the present vulnerabilities. It's been my own entry point into practice apps for security and the gamification behind this app in particular really drew me in further.
• OWASP WebGoat: Another commonly cited OWASP project that offers you a place to practice. In this case, you go through dedicated lessons to learn about vulnerabilities, to see how they work and how they can be mitigated.
• Hack The Box: This service offers you a huge amount of prepared virtual machines aka "boxes" to practice on safely. I really like their starting point machines that guide you towards the secret aka flag you're trying to find and introduce you to commonly used tools to identify and exploit vulnerabilities.
• TryHackMe: Another service offering lots and lots of machines to practice on. You have plenty of themed learning paths to learn on with a lot of detailed information to guide you on the way. Both Hack The Box and TryHackMe have big communities active on Discord offering a great support network.
• PortSwigger's Web Security Academy: The developers of BurpSuite provide a great resource with lots of challenges to solve in order to learn more about web security in general.
• PentesterLab: The courses offered on this platform include lots of explanation and guide you step by step to learn skills needed for penetration testing. My thanks go to Yianna Paris for introducing me to this service!

Besides these dedicated apps and labs available around the clock, you can also watch out for hosted public capture the flag (CTF) events. I've recently joined one from Huntress and I see several being announced for the upcoming holiday season, like TryHackMe's Advent of Cyber or the SANS Holiday Hack Challenge. Being in security-focused communities and following more security folks on social media really helps to learn about these CTFs. Alternatively, you can check dedicated sites like CTFtime to look out for the next ones coming up.

When practicing in these kinds of spaces on such kinds of challenges, I've experienced the following benefits.

• Reduce scariness. Dipping your toes into security can by scary indeed. You might not know where to even start, so having these kinds of practice spaces can serve as just the starting point you need. More often than not, they include challenges designed for beginners that offer further explanation and guidance to get you introduced into the space.
• Grow knowledge. Through these practice apps I usually got introduced to something I didn't know before, be it a concept, a tool, or anything. For example, they also provide a great reason to get to know security focused Unix systems like Kali Linux, Parrot Security or Mobexler and their respective tool boxes.
• Hone skills. The more we practice, the better our skills get, and the more we can make connections between things we know. More pieces to complete the puzzle, or in our case the next challenge. Creative problem solving is definitely a skill we're practicing here!
• Build confidence. The more touchpoints we get and the more we seize practice opportunities, the more we can grow our own confidence that we can also figure out the next challenge.
• Spread awareness. We can use the gained knowledge and skills to raise awareness about vulnerabilities with others. Even better, by practicing together we can increase awareness in real time. These kinds of challenges can help people see what's possible and why we need to defend our systems, protect value and keep harm away.
• Find joy. Security can be perceived as such a dour and tedious topic. Finding solutions to security challenges, however, can feel very rewarding in itself. Doing challenges together can further help with connecting security with fun and make it more interesting for people to engage with. It can also help to find community and like-minded people to learn and grow with.

All of these advantages I've experienced myself as I've been trying out various vulnerable apps, a bunch of labs offering dedicated challenges, as well as dipping my toes into my first public CTFs. I've also seen them over and over again with conference participants, joining me for many sessions of "capturing flags together" at SoCraTes, FroGS Conf and Agile Testing Days. It's been just the same when hosting practice sessions with colleagues in the past - something I'd like to pick up again in coordination with our current InfoSec team.

So, just practicing within these spaces gives us everything we need, right? Well, unfortunately that sounds too good to be true. There are also downsides to these kinds of challenges. Kudos to Dave van Stein for making me think more about this!

• Artificial challenges. All these spaces are crafted with a specific goal in mind, usually to educate and provide a safe place to practice. Therefore, challenges are inherently artificial and can't fully represent real-life scenarios.
• Mindsets differ. Attackers tend to think differently. I mean, they usually don't have the one clear flag to find in a constrained environment to announce their win. Instead, they might gather all kinds of information over a period of time, and based on that build their strategy on whether to exploit identified paths into a system, what to gain from it, and so on. It highly depends on their motivation and goals as well.
• Uncertainty instead of solutions. For labs and CTFs you'll know when you made the right move, you get a reward. In real life, there's no cheat sheet, there's no walkthrough. Just potential and ambiguity and never being completely sure that whatever you've found (if you've found any at all) is all there is to find.
• Overly focused on penetration testing. All the sites listed above are mainly offered to practice penetration testing. It's the one hot topic that probably attracts most people, but how often do you actually need those skills? How many jobs are in this area compared to all the others? There are so many more skills needed in the field of security. So where are the challenges on secure coding, or secret storing, or vulnerability evaluation, or threat identification, or incident response, and so on? Well, more practice apps are being built all the time, so some of these do exist already while not always being in the spotlight. And of course, there's official formal training to have as well (though it can come at high costs).

Weighing benefits and downsides against each other, I consider deliberate practice opportunities like the ones listed above still invaluable. We do have to be cautious, though, to put them into perspective and be clear about their goals and limitations.

That leaves me with yet another question: can we practice closer to reality? Here are a few approaches I think we could experiment with. I'd be happy to hear about further options to add to the list.

• Replay past real incidents. I'm thinking of actual security issues that your own company faced. We could replay these very real scenarios both from an attacker and a defender point of view and hence learn what we can do better - very concretely for our specific situation.
• Run open thinking exercises. Deliberately practice approaches like threat modelling, attack trees and similar to improve our thinking, within our actual work context to make it as applicable as possible.
• Host custom-tailored CTFs. Have one person hide a custom flag on your own system for people to find. It might still be an artificial scenario, yet placed in your very real context. This requires quite some preparation of course, like a dedicated environment to practice on and, as usual, explicit consent from all involved parties. The gained insights might still be worth the effort.

Personally, I'm sure I'll continue making good use of the various practice opportunities there are. I'm also considering joining or starting a CTF team to make practice even more deliberate. If anyone's interested or has recommendations for good places to find a welcoming, inclusive and diverse team please let me know.

Now let's bring this question back to the community: what do you do to practice your security skills?