The charter

01

What this is, and what it is not

VULN-ESC is a standing circle for security executives who are accountable for defending an operating organisation. It exists to do one thing: put those people in a room where they can describe an incident as it actually went, and get a straight answer from someone who has been there.

It is not a conference, a mailing list, a certification, a lead-generation channel, or a body that speaks for its members. When the circle takes a public position, it says so and names the position, never a member.

02

Confidentiality

Every session runs under Chatham House rules. You may use anything you hear. You may not repeat who said it, where they work, or which incident it was: not to your team, not to your board, not to another member outside the session, not to a journalist, not in a talk.

Nothing is recorded. There are no transcripts and no screenshots. Attendance lists are not circulated, and slides, when there are any, stay in the room.

03

The no-vendor rule

Membership tracks accountability, not expertise. If you sell security products or services, or advise the people who buy them, you are not eligible while you hold that seat.

Inside the circle there are no pitches, demos, or surveys, and the member list is never used as a prospect list. One warning for a first approach that reads as selling; removal for a second, or for any use of the member list. This is enforced by the circle team, not left to the room to police.

04

Funding

The circle is funded by VULNCON, from conference revenue and conference sponsorship. Membership is free and there is no paid tier.

Sponsors sponsor VULNCON. They receive what the conference sells them: signage, a stand, a slot in the public programme. They do not receive access to a circle session, the member list, attendee names, or an introduction to a member, at any price.

05

Removal

Membership ends for: breaking confidentiality; selling into the circle or working the member list; misrepresenting your role or organisation; bringing a recording device, a proxy, or press into a session without telling us; or conduct that makes the room one people stop being honest in.

Removal is decided by the circle team, the member is told the reason directly, and the decision is not announced to the room.

06

Press

No press attend circle sessions. The circle does not brief journalists on what was discussed and does not confirm whether a named person is a member.

Published circle output, such as surveys, reports, and policy positions, is aggregated and unattributed unless a member has agreed in writing, in that instance, to be named.

Questions about any clause go to the circle team before you apply, not after.