Security conference talks fall into two categories
* we designed a distributed entropy siphon to perform a black-box hypervisor side channel escape and chain-load a persistent rootkit into the CPU cache
* we looked behind the sofa and found an entire industry of products/services that have made no attempt at security at all and are therefore vulnerable to the most basic issues that we've been finding in everything for the past 30 years, and no-one else had bothered to look.

@richardstephens

Sometimes there is a subcategory of that second bullet point:

- We saw a talk someone else did... and decided to "pull up the couch cushions and 'dig around for loose change'"

😉