TL;DR. The European security-con CFP calendar is at a seasonal low. Two verified-open CFPs right now: NDC Security Oslo (deadline 18 Oct 2026, closes soonest, best fit — developer audience, explicit AI-assisted-security topics, full travel/lodging covered) and 40C3 in Hamburg (deadline 9 Oct 2026, huge reach, weaker appsec fit, unpaid). Everything else in the OWASP/BruCON/Troopers/DeepSec/BSides tier closed its 2026 CFP between March and August [9] [10] [21] — that’s expected, since most of them run their events in autumn and close CFP months ahead. The next wave (Troopers 2027, OWASP Global AppSec EU 2027) should open within the next 4–10 weeks based on prior-year timing [5] [7]. No dedicated AI-security-only European conference with an open CFP was found — the closest fits are the AI/LLM topic areas inside NDC Security (open) and several now-closed CFPs (German OWASP Day, Nordic Software Security Summit, Insomni’hack) worth targeting next cycle.
1. Open now
Sorted by CFP deadline, ascending. Verified by fetching each CFP page directly, not inferred from search snippets.
| Conference | Dates / City | CFP deadline | Submit | Compensation | Formats | Platform | Fit |
|---|---|---|---|---|---|---|---|
| 40C3 – Chaos Communication Congress | 27–30 Dec 2026, Hamburg, DE | 9 Oct 2026, 23:59 UTC [3] | cfp.cccv.de/40c3/cfp [4] | Free admission + limited travel funding; unpaid [3] | 60-min lecture, lecture-performance, workshop, research report [4] | pretalx | Rail-reachable from Ghent (~7h). Broad hacker-culture congress, not appsec-specific — AI/agent talks fit if framed for a general hacker audience, not a corporate pitch. |
| NDC Security | 15–18 Feb 2027, Oslo, NO | 18 Oct 2026, 23:59 CEST [2] | sessionize.com/ndc-security-2027 [1] | Full travel + accommodation + event fee covered [2] | Session (60min), Lightning (10min), Workshop (60–120min), 2-day pre-conf workshop [1] | Sessionize | Best fit. Developer-conference audience (NDC’s own crowd — .NET/TS-adjacent), suggested topics explicitly list “Securing AI,” “AI-Assisted Security,” “Agentic AI,” “Secure AI-assisted development” [1]. Short flight from Belgium, not rail. |
2. Opening soon / expected
CFPs not yet open but with a known or historically-patterned open/close window in the next few months. Watch these; none is confirmed open today.
| Conference | Dates / City | Status | Expected CFP window | Fit note |
|---|---|---|---|---|
| Troopers | 23–24 Jun 2027, Heidelberg, DE | “CfP opens soon,” deadline pre-announced [5] | Deadline set at 31 Mar 2027; opening not yet dated, but the 2026 cycle’s CFP portal (tr26-cfp) implies a similar multi-month-ahead open, likely autumn 2026 |
Defense & Management / Attack & Research tracks; strong technical bar, live-demo requirement for offensive track [5]. Travel comp up to €750 (Europe) [5]. |
| OWASP Global AppSec EU (2027 edition) | Not yet announced | Not announced | 2026 Vienna edition opened CFP 17 Nov 2025, closed 3 Feb 2026 [7] — a 2027 edition, if it follows pattern, opens mid-to-late Nov 2026, just past the 8-week window from today but worth calendaring now | Top-tier appsec fit if/when it lands — the flagship OWASP event. |
| OWASP BeNeLux Days | 26–27 Nov 2026, Utrecht, NL | CFP not yet announced; site says “stay tuned” [6] | Event is only ~2 months out with no public CFP yet — may be invite/track-chair curated rather than open submission this cycle | Rail-reachable from Ghent (~2.5h). Worth a direct email to organizers given the short runway. |
| Pass the SALT | Likely ~Jun–Jul 2027, Lille, FR | Not yet announced | 2026 cycle opened CFP 15 Jan, closed 31 Mar [28] — 2027 CFP not expected before Jan 2027 | Free/open-source security conference, rail-reachable from Ghent (~1.5h). Good secure-dev/tooling fit historically. |
| SteelCon | Mid-2027, Sheffield, UK | Not yet announced | Historically opens ~1 Mar, closes ~early Apr [29] | Community/hacker con, lighter on corporate appsec; low priority for this profile. |
| Infosecurity Europe | 8–10 Jun 2027, London, UK | No visible open-CFP process | Its programme page describes speaking opportunities but publishes no deadline or submission form [27] — likely curated/sponsor-driven, not a public CFP | Business/CISO-track event; treat as “apply to speak” via contact form, not a dated CFP. |
| Congress@it-sa | 27–29 Oct 2026, Nuremberg, DE | No public CFP found | — | Trade-fair congress with curated/sponsor-driven speaker slots, not an open submission process [26]. Skip unless approached directly. |
| DevSecCon chapter events | Rolling, various EU cities | Continuously open, no single deadline | — | No flagship annual conference anymore — regional meetup-style chapters with an always-open speaker call [30]. Good low-friction option to build a track record before pitching bigger cons. |
3. Already closed
Notable 2026/2027 editions whose CFP has passed — considered and ruled out, no need to re-check before the next cycle.
| Conference | Dates / City | CFP closed | Note |
|---|---|---|---|
| Black Hat Europe | Dec 2026, London, UK | 22 Jul 2026 (Briefings) [8] | All tracks (Briefings, Summits, Arsenal, Trainings) closed. |
| BruCON 0x12 | Sep 2026, Mechelen, BE | 30 Apr 2026 [9] | Closest-to-home option (BE); check again ~March 2027 for 0x13. |
| DeepSec IDSC 2026 | 17–20 Nov 2026, Vienna, AT | 31 Jul 2026 [10] | |
| Hacktivity 2026 | 21 Oct 2026, Budapest, HU | 20 May 2026 [11] | €300 travel + 2 nights covered. |
| SEC-T 2026 | Aug/Sep 2026, Stockholm, SE | 27 Jul 2026 [12] | |
| OffensiveCon 2026 | 2026, Berlin, DE | 1 Mar 2026 [13] | Pure exploitation/offensive focus — low fit for this profile regardless. |
| Hexacon 2026 | 16–17 Oct 2026, Paris, FR | 1 Aug 2026 [14] | Offensive-security focus; €2000 travel + hotel for up to 2 speakers. |
| hack.lu 2026 (20th ed.) | 20–23 Oct 2026, Luxembourg | 7 Jun 2026 [15] | Rail-reachable from Ghent; free entry + 4 nights for speakers. |
| Nullcon Berlin 2026 | 5–6 Nov 2026, Berlin, DE | 12 Jul 2026 [16] | |
| BSides Vienna 2026 | 2026, Vienna, AT | 27 Jun 2026 [17] | |
| BSides Munich 2026 | 2026, Munich, DE | 24 Jul 2026 [18] | |
| BSides Luxembourg 2026 | 6–8 May 2026, Belval, LU | 1 Mar 2026 [19] | |
| 44CON 2026 | 17–18 Sep 2026, London, UK | 31 May 2026 [20] | 2027 edition not yet announced. |
| German OWASP Day 2026 | 23–24 Sep 2026, Karlsruhe, DE | 21 Jun 2026 [21] | Explicitly wanted ML/AI/LLM/MCP security talks — strong template for next cycle. |
| Nordic Software Security Summit Fall 2026 | 4–6 Nov 2026, Stockholm, SE | 15 Aug 2026 [22] | Secure-by-design/DevSecOps/AI-in-secure-dev focus — closest topical match to this profile among closed CFPs. |
| Insomni’hack 2027 | 4–5 Feb 2027, Lausanne, CH | 30 Aug 2026 [23] | Note: event is dated 2027 but its CFP already closed in Aug 2026. |
| OWASP Global AppSec EU 2026 | 25–26 Jun 2026, Vienna, AT | 3 Feb 2026 [7] | 2027 edition not yet announced — see §2. |
| 2026 Paris FIRST TC | 2026, Paris, FR | Closed [24] | CERT/threat-intel audience, narrower fit than appsec tracks. |
| HITB SecConf | — | N/A — discontinued in Europe | Amsterdam edition ended permanently in 2023; series now runs only in Bangkok, Phuket, Singapore, Abu Dhabi [25]. Drop from future EU-CFP checks. |
Notes on scope
- Academic/peer-review CFPs (IEEE EuroS&P, USENIX Security, ACM CCS, NDSS workshops) were deliberately excluded — they require full academic papers on a months-long review cycle, not the industry-talk/workshop format this profile submits.
- CS3STHLM (Stockholm ICS/SCADA security summit) could not be reached for verification (certificate error) and was dropped rather than guessed at.
- SwissCyberStorm and CONFidence (Kraków) turned up no fetchable CFP page in this pass — worth a manual check next cycle.
- Given the AI-security sweet spot in this profile, the strongest near-term move is NDC Security (open, explicit AI-assisted-security topics, developer crowd) — submit the text-to-SQL hardening talk or the AI-security-for-non-technical-audience talk reframed technical. 40C3 is a stretch fit but reaches the largest and most technical hacker audience in Europe if a submission leans into agent-tooling/MCP security rather than a corporate AI-security narrative.