WOOT '27 Preliminary Call for Papers | USENIX

Sponsored by USENIX, the Advanced Computing Systems Association.
The 21st USENIX WOOT Conference on Offensive Technologies (WOOT '27) will take place on August 9–10, 2027, and is co-located with the 36th USENIX Security Symposium in Denver, CO, USA.
The USENIX WOOT Conference on Offensive Technologies brings together both academics and practitioners in the field of offensive security research. Occurring annually since 2007, when it was first founded as the Workshop on Offensive Technologies, WOOT has become the top venue for collaboration between academia, independent hackers, and industry participants on offensive research. As offensive security has changed over the years to become a large-scale operation managed by well-capitalized actors, WOOT has consistently attracted a range of high-quality, peer-reviewed work from academia and industry on novel attacks, state-of-the-art tools, and offensive techniques.
WOOT '27 welcomes submissions from academia, independent researchers, students, hackers, and industry. Papers that have been formally reviewed and accepted will be presented during the WOOT conference and published in the formal proceedings. Authors are also expected to plan to publish research artifacts (such as source code and data sets) wherever possible; see further details below.
By submitting a paper, you agree that if the paper is accepted, at least one of the authors will register to attend the conference at full price (i.e., not the student rate) and to present the paper; USENIX members at the Sustainer level and higher may apply their membership discounts to their registrations. If an author plans to present more than one paper, one full-price registration will still be required for each paper. If the conference registration fee will pose a hardship for the presenter of an accepted paper, please contact conference@usenix.org.
We welcome submissions from researchers of all backgrounds, including academics, independent researchers, and industry practitioners. Submissions should be complete, formal research papers, and should not have significant editorial problems. The contribution needs to be well motivated, clearly exposed, and compared to the state of the art. All paper submissions should be at most 13 pages, excluding the bibliography and any clearly marked appendices. Submissions should be double-blind, i.e., anonymized and avoid obvious self-references. Acceptance of final papers may be subject to shepherd approval.
Papers should be typeset on U.S. letter-sized pages in two-column format in 10-point Times Roman type on 12-point (single-spaced) leading, in a text block 7" x 9" deep. Authors should use USENIX's LaTeX template and style files when preparing the paper for submission. Failure to adhere to the page limit and formatting requirements can be grounds for rejection.
Papers rejected in Cycle 1 may not be resubmitted in Cycle 2 unless they have undergone substantial revisions. Changes limited to writing, presentation, or minor technical improvements are not sufficient.
In exceptional cases, the program co-chairs may explicitly invite authors to submit a major revision in Cycle 2. Such invitations will be communicated as part of the Cycle 1 decisions and will identify the main issues that must be addressed. An invitation for major revision does not guarantee acceptance.
Submissions should reflect the state of the art in offensive computer security technology, exposing poorly understood mechanisms, presenting novel attacks, highlighting the limitations of published attacks and defenses, or surveying the state of offensive operations at scale. WOOT '27 accepts papers in both an academic security context and more applied work that informs the field about the state of security practice in offensive techniques. The goal for these submissions is to produce published works that will guide future work in the field. Submissions will be peer-reviewed and shepherded as appropriate.
Submission topics include, but are not limited to, practical attacks on and offensive research into:
"Systematization of Knowledge" (SoK) papers that evaluate, systematize, and contextualize existing knowledge are also encouraged. Suitable papers include survey papers that provide useful perspectives on major research areas, papers that support or challenge long-held beliefs with compelling evidence, or papers that provide an extensive and realistic evaluation of competing approaches to solving specific problems. Such papers should be clearly labeled as SoK in their title.
We reserve the right to desk reject papers that fall outside the scope of WOOT or for which the program committee cannot secure adequate expert reviewers. Papers with no clear contributions to applied security will be considered out of scope.
The list of topics above is necessarily incomplete and imprecise. In its ongoing effort to adjust scope, the WOOT Steering Committee has identified a list of topics that are explicitly excluded. Papers whose core contributions are on the following topics are likely to be desk rejected for reasons of scope:
The chairs reserve the right to desk reject papers where the topic, contributions, or substance of the paper are not sufficiently clear, particularly those containing incoherent or unintelligible text, hallucinated or fabricated references, unsupported claims, or falsified results.
We expect authors to carefully consider and address the potential harms associated with carrying out their research, as well as the potential negative consequences that could stem from publishing their work. Failure to do so may result in the rejection of a submission regardless of its quality and scientific value.
Where relevant, papers should include a clear statement about why the benefits of the research outweigh the potential harms and how the authors have taken measures and followed best practices to ensure safety and minimize the potential harms caused by their research. This includes, but is not limited t