Running an internal security tech day that people actually attend
This note sets out a practical format for an internal "tech day", a recurring session where members of a small security team take turns presenting on a topic of their choosing, without attributing the format to any individual.
Why a rotating format works
A tech day run by one fixed presenter tends to run out of material and enthusiasm quickly. Rotating the presenting duty across the whole team keeps the workload light for any one person and, just as importantly, surfaces the different specialisms already present in a group: one week might cover a penetration-testing case study, the next a piece of malware analysis, the next a walkthrough of a CTF problem the team solved together.
A healthy topic mix
Looking back at a year or more of sessions in this format, the most useful mixes balanced offence and defence: red-team techniques such as internal network penetration testing sat alongside blue-team material like log analysis and incident retrospectives, and deep technical topics such as reverse engineering sat alongside softer ones such as information-gathering methodology or lessons from a recent assessment.
Keeping the bar low enough to sustain it
The sessions that sustained a weekly or biweekly cadence tended to keep talks short, closer to twenty or thirty minutes than a full conference slot, and treated a work-in-progress finding or an unfinished CTF writeup as perfectly acceptable material, rather than requiring every talk to be a polished, conference-ready presentation. That lowered the barrier to volunteering enough that the rotation kept moving.
What it is good for
Beyond knowledge transfer, a regular internal tech day gives less experienced members low-stakes practice at presenting technical material to peers, and gives the team a natural forum to discuss planning questions, such as what the group should focus on next or how to run its next external event, without needing a separate meeting.
Takeaway for other teams
A recurring, rotating, deliberately informal tech day is a low-cost way to keep a small technical team's collective knowledge moving, as long as the bar for each talk stays low enough that people keep volunteering.
Key takeaways
- Rotating the presenter keeps a recurring tech day sustainable and surfaces the team's existing range of specialisms.
- A healthy agenda balances offensive and defensive topics rather than favouring one.
- Keeping talks short and accepting unfinished work lowers the barrier to volunteering.
- The format doubles as low-stakes presentation practice and an informal planning forum.
This note has been rewritten and checked for this edition; it is not a copy of the original post.