DEF CON just made its position on the AI era very clear. The theme for 2027 is "The Age of Experimentation," and its message to hackers everywhere is blunt: "resist cognitive surrender."
In other words: AI can write your code, summarize your logs, and answer anything with total confidence, and that's exactly why you need to know how things really work. DEF CON announced the theme on Instagram and posted the full theme document as a PDF on its media server. The 2027 conference is DEF CON's 35th, so you'll also see it called DEF CON 35.
New to DEF CON? This guide starts with what it actually is, then breaks down the theme, its surprisingly nerdy font and color choices, the villages people talk about most, and what "The Age of Experimentation" means for AI and cybersecurity.
First: what is DEF CON?
DEF CON is one of the world's biggest and longest-running hacker conferences. It started in 1993, founded by Jeff Moss (known as "The Dark Tangent"), and takes place every summer in Las Vegas. Today it draws tens of thousands of people: security professionals, students, researchers, government officials, artists, tinkerers, and the endlessly curious.
What makes it different from a typical tech conference:
- It's hands-on. Beyond talks, most of DEF CON happens in rooms where you can pick locks, solder hardware, hack a car's network, or try to trick an AI, all in a legal, supervised setting.
- It's community-run. Much of the event is organized by volunteers and community groups. The volunteer staff are famously called "goons."
- It's playful. Contests, puzzles, music, and art are part of the culture, as much as the serious research.
- It has a badge culture. DEF CON badges are often electronic, hackable works of art, and badge hacking is a sport in itself.
- It's part of "hacker summer camp." DEF CON shares Las Vegas week with other security events, most famously Black Hat and BSides Las Vegas, so many people go to several.
DEF CON's website lists DEF CON 35 for August 5 to 8, 2027, at the Las Vegas Convention Center. Confirm on defcon.org before you book anything.
The theme: "The Age of Experimentation"
Every year, DEF CON picks a theme that shapes its badges, artwork, talks, and community projects. Here's what the 2027 theme document says.
It opens with a big claim: we're in an age where the world five years from now "will be unrecognizable" from the vantage point of five years ago. In times like these, "we can't use the shore to navigate and it's hard to see the stars." The old landmarks don't work.
The answer is to return to "the basics of knowledge acquisition," the tools that led hackers "out of darkness and into hacking enlightenment":
- Trial and error.
- Poking and prodding.
- Hypothesizing and diligent analysis.
- Experimentation.
Then comes the line everyone will be quoting: DEF CON wants "to encourage hackers everywhere to resist cognitive surrender and sharpen our onboard reasoning abilities. Vibes have their place, but when the stakes are high there's no substitute for knowing how things work, and making accountable human decisions."
And it ends on the best one-sentence description of hacking you'll read this year: "At its heart hacking is experimentation, where the frustration and resolve meets the joy of discovery."
DEF CON's announcement post sums it up even more briefly: "When things get too 'vibey' there's no substitute for knowing how things really work, and having the tools to move things forward."
Key terms, in plain English
| Term | What it means here |
|---|---|
| Experimentation | Learning by testing: form an idea, try it, see what really happens, adjust |
| Cognitive surrender | Letting a tool do your thinking: accepting an answer you don't understand and haven't checked |
| Onboard reasoning | Your own brain's ability to analyze and judge, as opposed to outsourced reasoning |
| "Vibey" | Working on gut feel and impressions, as in "vibe coding," where you accept AI-generated code without really reading it |
| Accountable human decisions | A person who understands the situation makes the call, and owns the result |
Yes, DEF CON has a font and colors
If you didn't know DEF CON has an official typeface and color palette, you're not alone. Each year's theme comes with a design kit, so the community's badges, posters, websites, and art can share a look. The 2027 kit is a small lesson in the theme itself.
The font: Science Gothic
The main typeface for 2027 is Science Gothic, designed by Thomas Phinney, Vassil Kateliev, and Brandon Buerkle. Two things make it a perfect fit:
- It's libre. It's free and open-licensed, so anyone can use it for their own DEF CON projects. The download link is in DEF CON's theme PDF.
- It's a variable font with four axes. Most fonts come in a fixed set of styles, like regular, bold, and italic. A variable font lets you set the values yourself. Science Gothic has four dials, weight, slant, width, and contrast, which you can tune "until you have precisely the look you want," as the theme document puts it.
In other words, even the font is built for experimentation.
The colors
The 2027 palette mixes a bright green and a hot red-orange with a range of aquas and blues:
| Color | Hex code |
|---|---|
| Fresh green | #97d451 |
| Red-orange | #ff4013 |
| Pale aqua | (a light blue-green; check the PDF for the exact code) |
| Bright aqua | #00d1d6 |
| Deep blue | #0080b1 |
The style: fundamentals and living connections
The theme document describes two threads running through the design:
- Ground yourself in the fundamentals. When the world "gets too vibey," focus on "what we know and how we know it." That means clean, readable text, and symbols that stand for basic, unambiguous ideas, from logic gates (the building blocks of digital circuits) to alchemical symbols (the notation of the original experimenters).
- Communities are organic. Hacker communities "can't only be represented by straight lines and right angles." Many of the 2027 visuals have a hand-made, organic look, and elements that usually stand alone are connected. In DEF CON's words: "The points of connection are everywhere."
Rigorous fundamentals, practiced by a living, connected community. That's the whole theme in one design system.
Villages: where the experimenting happens
If the theme is about poking, prodding, and testing, the villages are where that happens. A village is a themed space run by a community group, with its own talks, workshops, and hands-on challenges. Villages change from year to year, and DEF CON hasn't announced the 2027 lineup yet, but these are some of the best-known from recent DEF CONs:
| Village | What you'll find there |
|---|---|
| Lockpick Village | Learn to pick locks on practice locks. It's a classic first stop and shows how physical security really works |
| AI Village | Talks and challenges on attacking and defending AI. It hosted a large public red-teaming exercise of AI models at DEF CON 31 in 2023 |
| Voting Village | Researchers examine real voting machines and election equipment to find weaknesses before attackers do |
| Car Hacking Village | Hands-on work with vehicle networks and components, from dashboards to full cars |
| Social Engineering Community | The human side of hacking, including live phone-based social engineering contests |
| Aerospace Village | Aviation and space security, from airport systems to satellites |
| Biohacking Village | Medical device security and the intersection of biology and tech |
| Hardware and IoT villages | Soldering, chip-level hacking, and testing smart devices |
| Red Team and Blue Team villages | Offense and defense: attack techniques on one side, detection and incident response on the other |
| Packet Hacking Village | Network traffic analysis, home of the famous "Wall of Sheep," which shows how much data travels unencrypted |
Beyond villages, look for contests, including DEF CON's long-running Capture the Flag (CTF) competition, one of the most prestigious hacking contests in the world, plus dozens of smaller puzzles and challenges.
What the theme means for AI
The theme doesn't name any product, but it's clearly written for the AI moment. Here's how we read it.
Treat AI answers as hypotheses
AI systems state wrong answers as confidently as right ones. Experimentation means treating an AI's answer as a hypothesis: something to check by running the code, reading the source, or testing the claim another way. Our OODA loop guide for AI workflows turns this into a habit: observe real outputs, not the AI's summary of them.
Vibe coding has a place, and limits
"Vibes have their place" is a fair concession. Prototypes, game jams, and throwaway scripts are great places to move fast; our vibe coding guide is all about that. But for code that touches money, health, personal data, or security, someone has to understand what it does. The theme draws the line exactly there: when the stakes are high.
Keep humans on the decisions that matter
"Accountable human decisions" matches how careful teams use AI agents: let AI take small, reversible, checkable steps, and keep people on the irreversible ones like deploying, deleting, sending, or paying. A recent example: when Anthropic's scientists used Claude to investigate vault particles, Claude sped up the work dramatically but also skipped a standard step and produced a flawed result. The researchers' response could be the theme's unofficial motto: "Please let's do normal things unless they don't work."
AI security is experimentation
Testing AI for weaknesses is experimentation by definition. Red-teaming (deliberately trying to make a system misbehave), evals (structured tests of how a model behaves), and probing for prompt injection (text crafted to hijack an AI) all follow the same loop: hypothesis, test, observe. It's no accident that AI red-teaming has become one of DEF CON's most talked-about activities.
What the theme means for cybersecurity
Hacking is the scientific method
Strip away the movie cliches, and hacking is careful experimentation:
- Observe how a system behaves.
- Hypothesize why: "This input probably isn't being checked."
- Test the idea in a controlled way.
- Analyze what actually happened, not what you expected.
- Repeat, refining your understanding.
Defenders work the same way: forming hypotheses about what an attacker did, testing them against logs, and verifying that a fix really works.
Fundamentals over tools
A scanner's output, like an AI's, is only useful if you understand it. The theme's push toward fundamentals is great advice for anyone learning: networking, operating systems, how the web works, and how authentication works. Our cybersecurity learning path starts there, and our CompTIA Security+ and CCNA reviews cover the foundations in depth.
Experiment safely and legally
The theme celebrates poking and prodding, but only on systems you're allowed to touch: your own home lab, CTFs, DEF CON village challenges, intentionally vulnerable practice machines, and training platforms. Testing someone else's systems without permission can be illegal and can cause real harm. Good places to start:
- Guided labs: TryHackMe Cyber Security 101 for beginners.
- Harder challenges: Hack The Box, or see TryHackMe vs Hack The Box to choose.
- Defensive practice: TryHackMe SOC Level 1 for the blue-team side.
Use AI without surrendering to it
AI can speed up security work: explaining logs, drafting detection rules, and reviewing code. The theme's lesson is to use it as a lab partner, not an oracle. Check its output, understand its suggestions, and keep the final call yours. Our guides to AI tools for cybersecurity professionals and Claude Code security workflows show how.
How to live the theme now
You don't need a badge to start experimenting:
- Build a small home lab. Two virtual machines on your own computer are enough to practice networking and basic security safely.
- Keep an experiment log. For each thing you try, write down your hypothesis, what you did, what happened, and what you learned.
- Do one "no-AI" pass. Solve a challenge or read a piece of code without AI first, then compare your reasoning with the AI's.
- Check one AI answer a day. Pick a confident AI answer and verify it against a primary source.
- Join a CTF. Many are free and beginner-friendly: experimentation in its purest form.
- Make something with the design kit. Download Science Gothic, play with its four axes, and try the palette. It's a low-stakes way to join the community.
- Follow DEF CON's announcements at defcon.org for talks, villages, contests, and the badge.
The bottom line
"The Age of Experimentation" might be DEF CON's most timely theme in years. As AI makes it easy to get answers without understanding, DEF CON is asking its community to do the opposite: test, understand, and decide for themselves. That doesn't mean rejecting AI. It means using it the way a good experimenter uses any tool: with curiosity, skepticism, and your own judgment in charge.
Check your understanding
Answer each question from memory before opening it. Recalling, not rereading, is what makes learning stick (here's why).
1 What is DEF CON's theme for 2027?
The Age of Experimentation. It asks hackers to get back to fundamentals: trial and error, hypothesizing, careful analysis, and experimentation.
2 What does 'cognitive surrender' mean in the context of the theme?
Handing your thinking over to tools, such as accepting an AI's answer or a scanner's output without understanding or checking it. The theme asks people to resist it and sharpen their own reasoning.
3 What is a DEF CON village?
A themed hands-on space run by a community group, focused on one area such as lockpicking, cars, voting machines, AI, or social engineering, with its own talks, workshops, and challenges.
4 What's special about the 2027 typeface, Science Gothic?
It's a free, open-licensed variable font with four adjustable axes (weight, slant, width, and contrast), so you can tune it yourself instead of choosing from fixed styles. Even the font is an experiment.
5 According to the theme, when are 'vibes' not enough?
When the stakes are high. Then there's no substitute for knowing how things work and making accountable human decisions.
6 What's the most important limit on experimenting in security?
Permission. Only test systems you own or are explicitly authorized to test, such as your own lab, a CTF, a DEF CON village challenge, or a training platform. Experimenting on systems without permission can be illegal and harmful.