I provide feedback on a lot of slides for infosec conference presentations. I’ve found myself repeating the same advice over and over again, so I figured I should write it down. Many of these same tips are in Scott J. Roberts’ excellent blog post on Building Better Security Presentations, so you should read that too — but they’re worth repeating, so here’s my take. Not all of this advice will apply every time, so you should always consider your venue and audience, but I hope these general guidelines will help you.
Make Everything Bigger
Your fonts are probably too small. Your images are probably too small. I know, you want people to see your full command-line output, but 90% of your audience won’t be able to read it, so please make it bigger. For font sizes, I recommend a minimum of 20-point, but ideally fonts are even larger than that. For images with a lot of detail, consider including the full image on one slide, and then a zoomed in version of just the part that’s important. Ryan Kovar is a master of this (he uses a tool called Snagit to create the cool torn edges), as you can see from our Black Hat presentation slides:
Create for Presenting, not Reading
Slides are a challenge to create because they serve two purposes: 1.) They help our audience understand our content while we’re speaking, and 2.) They’re something for people to read later. These two purposes are sometimes at odds with each other. When you have to choose, I recommend focusing on the first: the goal of your slides should be to help the audience understand your presentation (it’s a presentation, after all). As my speaking sherpa Ryan suggests, you can write a blog post later that is intended solely for the purpose of reading. Of course, depending on your venue and audience, they may EXPECT slides they can read later, so consider your audience above all else.
What does this mean in practice? Minimize text on your slides. If you’ve made everything in your presentation bigger as I previously suggested, you’ll soon realize that you simply don’t have room for a ton of text, and certainly not for full sentences. That’s a good thing! I recommend using brief bullet points for newer presenters, since this will help you remember what you say, but you won’t be able to read your slides since you don’t have full sentences. (Reading slides is a huge pet peeve of mine — please avoid it.) In addition to not reading your slides, please don’t read your notes. If you practice your presentation, you shouldn’t need to. I often practice new presentations 5+ times before I feel comfortable with them.
As you gain experience as a presenter, I suggest challenging yourself to reduce the amount of text on yours slides (when it makes sense to do that) — it’s tough to brief to an image-only slide, so I recommend easing yourself into that.
Ian Coldwater does an excellent job of creating slides with powerful images and little text, an example of which is below from their talk, “Ship of Fools: Shoring Up Kubernetes Security,” at the SANS Secure DevOps Summit.
If the single image approach feels too scary and you want more text, here’s an example of a slide I like from my teammate Tim Schulz’s recent presentation, “Adaptive Adversary Emulation with MITRE ATT&CK”, at the SANS Purple Team Summit. You’ll note he doesn’t use full sentences, but rather short phrases.
Think About Flow
You can have amazing content in your presentation, but if the audience doesn’t understand it, your presentation won’t be effective. Think carefully about how you communicate your points to the audience. A huge part of this is the presentation flow. Like a good story, a good presentation has a beginning, middle, and end. I go back to the classic approach that Scott Roberts also recommends:
- Tell ’em what you’ll tell ’em
- Tell ’em
- Tell ’em what you’ve told ’em
Remember that your audience is hearing the content for the first time, so they need help following what you’re saying. I highly recommend having an Agenda/Overview slide for longer presentations, or at least voice-tracking an overview of what the audience should expect for shorter presentations. You should carefully consider what the major parts of your presentation are and how you will transition between them. “Transition” slides can help with this. You should also have a Conclusion/Takeaways slide to help the audience remember your key points.
Here’s an example from my teammate Jamie Williams’ presentation, “To Blue with ATT&CK-Flavored Love,” at the SANS Blue Team Summit. He started with an Agenda slide so the audience knew what the plan was:
Now that the audience knew that plan, he then used transition slides between each section. I am a huge fan of this approach because it signals to the audience you’re going to shift to the next topic, which helps them mentally keep up.
He then had a Conclusion slide that reiterated his key points:
Here are a couple of other miscellaneous slide tips, many of which come from my teammate Adam Pennington:
- Don’t put anything important on the bottom third of your slide. In many rooms, this part of your slide will be blocked by the audience.
- Use high contrast colors. Remember a lot of conference screens get washed out. This means no pastels on white/light backgrounds. High contrast can be very tough on black backgrounds — think about the fact that to get high contrast, you’ll have to use pastel colors, so decide if that’s REALLY what you want before committing to a black background. I’ve found black backgrounds to be tougher than white backgrounds.
- Avoid non-standard fonts. Realize that if you use non-standard/paid/proprietary fonts, there’s a chance they may get screwed up if your slides are being presented from the conference’s computer. You can reduce the chance of fonts getting messed up by embedding your fonts in your PowerPoint slide — instructions here: https://support.office.com/en-us/article/embed-fonts-in-word-or-powerpoint-cb3982aa-ea76-4323-b008-86670f222dbc. Again, I recommend asking the conference organizers to review your slides on the conference screen to check your fonts.
- Use a unique file name for your slide deck. Just like you wouldn’t name your resume “Resume.pdf,” don’t name your slides “Conference_name.pptx.” Make sure to use the conference name, your name, and your talk title in your file name. This is big help to conference organizers and they will be grateful!
- Be consistent in your format. Ideally choose 2–3 fonts and stick with those. If you can, use consistent font sizes. Try to use the same colors as well — themes in PowerPoint can help with this. (I’ve driven myself crazy on a LOT of slide decks trying to make sure I only use one shade of red…) Also watch out for “jumps” — slight movements in text or graphics from one slide to another that make your presentation look less polished. This is common in slide titles, since sometimes you might accidentally move the text box.
- Put your Twitter/social media handle on the first and last slides. Having your handle on the first slide increases the likelihood that the audience will tweet with your handle during your talk. I also recommend having your handle, name, and (optionally) contact info and photo on the last slide — this helps the audience remember who you are and lets them know how to contact you. A great way to get Twitter followers is to let them know you’ll tweet a link to your slides! :)
- Be careful with animations. Animations can be awesome to add drama and emphasize your points, but they’re also risky — I’ve seen many presentations go wrong when the animations didn’t work as the presenter expected. Only use animations if you’re sure of them and have practiced!
- Avoid live demos. I know, they’re dramatic, but they rarely work. If you INSIST on a live demo, practice it a ton in advance, and always have a backup video. Videos embedded in slides are a much better option, and as you record them, use a zoom tool (like Magnifier on Windows) so your audience can see what you’re doing.
- Spell out acronyms. Especially if you’re at a “general” infosec con, remember not everyone in your audience has the same background that you do. Be sure to spell out acronyms on your slide when you first use them, and explain them verbally too.
- Cite your sources. If you use someone else’s work, cite it. It is not okay to plagiarize from others in this community. (It IS okay to use someone else’s work, with credit, and build on their idea.) Ideally include the source link on the slide, but if you don’t have room, you can include all your sources at the end of your presentation.
- Test your slides on the conference screen. As I’ve mentioned, you can spot a lot of font and color issues in advance if you can look at your slides on the conference screen before your presentation. Many cons will let you do this before your presentation if you politely ask organizers.
In case it’s helpful, here are those tips in handy checklist form that you can use as you finalize your slides.
☐ Fonts are over 20 point
☐ Images are large and add value to the presentation
☐ No full sentences (unless you have a good reason)
☐ Agenda slide included (or plan to voice-track)
☐ “About me” slide included (or plan to voice-track)
☐ Closing/takeaways slide included
☐ There is a beginning, middle, and end (transition slides if appropriate)
☐ High contrast colors
☐ Nothing critical on the bottom third of your slide (depends on room)
☐ No format jumps (check slide titles in particular)
☐ Non-standard fonts embedded in your file
☐ File named with the conference name, your name, and presentation title
☐ Consistent colors (don’t use 5 different reds)
☐ Consistent fonts (recommend no more than 2–3; consistent font sizes when possible)
☐ Twitter/social media handle on first/last slides (if that’s your thing)
☐ Animations work as expected and your voice track is timed to them
☐ Slides spell-checked
☐ Slides peer-reviewed
☐ Acronyms spelled out on first use
☐ Demo videos embedded (using zoom tools)
☐ Sources cited
☐ Slides tested on conference screen if possible (with the slide clicker you’ll use if you can…and if not, at least on your laptop screen)
Does this seem like a lot? Yeah, it is — making great slides is quite a time commitment, so plan ahead. Good luck on making excellent slides and giving an awesome presentation!
The author’s affiliation with The MITRE Corporation is provided for identification purposes only and is not intended to convey or imply MITRE’s concurrence with, or support for, the positions, opinions, or viewpoints expressed by the author.