I gave a talk at DEF CON Singapore 1's creator stage this year about building communities. Leadership frameworks, team structure, the principles I'd hand to anyone starting from scratch. That version is clean and structured and, frankly, quite sensible.

This is not that version.

This is the unabridged version about bubble tea and shared cabs home and why I started insisting on After Action Reviews (AARs) even when I was the only one who thought they were exciting. Think of it as the director's cut. The extended lore. The lore so extended it has its own lore. The version that only makes sense if you've ever looked around at your team after an event, completely cooked, and thought: I would do this all over again, which is either a sign that you built something meaningful, or that the bubble tea has done irreversible things to your brain. Possibly both.

I'm stepping down after two-ish years as Community Lead of N0H4TS. These are the things I want to say before I go.

The people you build with define the community you build.

Not the branding. Not the event format. Not the very organised Kanban board you made at the start and then slowly stopped updating. (It's fine. We've all got a graveyard Kanban. We don't talk about the graveyard Kanban.)

The people.

Volunteers are not employees. You cannot manage them the same way because they are not showing up for a pay cheque. They are showing up because they believe in something. The moment they stop believing, they leave. Often quietly, and without telling you why. Which is somehow worse than if they'd just said something. You'd have preferred they said something.

This took me longer than I'd like to admit to understand: volunteering is about friendships. People do not stay because the mission is compelling. People stay because their friends are there. And when those friends leave, they follow. It is not disloyal; it is human. We are wired to go where our people are. Your team is, at its core, a group chat that got out of hand.

This changes how you think about team culture entirely. It is not enough to just keep people engaged in the work. You have to build an environment where real friendships form. Where people actually want to be in the group chat.

When we got that right, the team became self-sustaining in a way that no amount of good management could replicate. People were not staying for N0H4TS in the abstract; they were staying for each other.

That's the dream. That's also, very frankly, the only version that actually works.

Bubble tea is a statement.

Running an event is exhausting. You arrive early, spend the whole session managing a hundred things at once, and then you break down the room, help clear up, and leave the venue at 10.30pm on a good night. Sometimes later. Usually later. The "good night" scenario is more of a theoretical construct at this point.

N0H4TS provides the occasional bubble tea for the team at meetups and the occasional shared cabs home after late events. When the team is holding a booth, we have a lunch budget. None of this is complicated or very expensive. All of it matters enormously.

These small things tell your team what you actually think of them. You can say "we value you" in a dozen different ways, and none of them land as clearly as a cup of bubble tea handed to someone who has been on their feet for four hours. It says: I see what you just did. I know it was a lot. Here.

Volunteers give their time and their energy to something that gives them no salary in return. The least we can do is make sure they are not paying out of pocket and taking the train home alone at 11.30pm.

If you are running a community and you are not thinking about this, start thinking about it. Like right now. I mean it.

The AAR nobody asked for but everyone needed.

After every significant event, we run an After Action Review. And yes, I know… AAR sounds like something from a military briefing, and maybe it is. My experience in the civil service probably has something to do with why I took to it so naturally. Either way, I genuinely do not care how it sounds because it is one of the most valuable things we do. You can make fun of the name. You will still benefit from the debrief.

The structure is simple. What went well. What did not. What we do differently next time. That's it. No blame, no lengthy post-mortem (unless we're just yapping, in which case, settle in), just a honest look at the event while it is still fresh.

The reason I pushed hard for this: communities that do not debrief are communities that repeat their mistakes. And in an all-volunteer setup where institutional knowledge lives almost entirely in people's heads, an AAR is also how you make sure that knowledge does not walk out the door when someone eventually moves on. Knowledge management, but make it fun with friends!

The first few we ran, people weren't sure what to make of it. By now, it is just part of how we close out an event. The team knows that the debrief is where we get to be honest. About what stressed us out, what caught us off guard, what we quietly fixed on the fly and should probably have a proper process for. (I have a ton of random lists in my Telegram saved messages from our AARs.)

Feedback from participants is data you cannot afford to ignore.

We collect feedback after every meetup. Not as a formality, I actually read it, actually act on it, actually let it change what we do.

This sounds obvious. It is apparently not, because a surprising number of community events run on pure vibes and organiser intuition and nothing else. Manifesting, but for events.

In this case, delulu is not the solulu. Participant feedback tells you things your team cannot. They see the event from the outside. They notice when the pacing was off, when the content was too advanced or not advanced enough, when the Q&A ran too long, when there wasn't enough time to talk to the speakers. Your team is too close to it, too busy managing logistics in real time, to catch all of that.

The other thing feedback does: it tells your participants that you are paying attention. That their experience is not incidental to the event; it is the point of it. That loop closes something important. People are more invested in a community that listens to them. Turns out humans like being heard. Groundbreaking stuff.

We are not perfect at acting on every piece of feedback we receive. But the discipline of collecting it honestly and sitting with it has shaped N0H4TS Community's meetups significantly.

On being trusted by partners to just get on with it.

There is a version of working with partners and sponsors where every decision requires approval, every event plan goes through three rounds of review, and nothing happens quickly because nothing happens without sign-off. The approval chain as a lifestyle. A spiritual practice, almost.

That is exhausting for everyone, and it is a sign that trust has not been built yet.

When N0H4TS started working with partners and venue providers, we were careful. Detailed, communicative, overly thorough in ways that probably occasionally annoyed people. We documented everything. We followed up proactively. We delivered what we said we would deliver and then flagged it when we did. We were, in short, quite a lot. But reliably quite a lot.

Over time, we realised something shifted. Partners started just saying yes. Not "yes, send us the plan and we'll review it". Just yes. Partners would confirm our bookings without needing to walk through the checklist again. Sponsors would trust us to represent them well at events without wanting to be CC-ed on everything.

That level of trust is not given. It is built, slowly, through consistent follow-through over a long time. And once you have it, it changes everything. You can move faster, be more creative, take on more ambitious events, because you are not waiting for the approval chain every time.

Protect it accordingly. Every time you run a sloppy event or drop communication with a partner or overpromise and underdeliver, you are spending down that trust. It takes a long time to earn back. And your partners have long memories.

Specialists on the team, generalist at the helm.

Early stage, everyone does everything. That is fine and also unavoidable. One person is simultaneously the attendance taker, the emcee, the venue liaison, the person who remembered to bring the extension cord. This is called "scrappy". It is also called "a situation you should plan to grow out of".

Build specialists. Give people a lane they own and are accountable for. Marketing, writing medium articles, secretarial: each function with someone who can say "that's mine." It gives people identity and a real stake in the work. People work harder on things they feel ownership over. This is not a hot take. This is just how humans operate.

The person at the top, though, cannot be precious about their own lane. I have chased sponsor emails, sourced venues, drafted captions, edited articles, and sorted last-minute logistics at a frankly unreasonable hour. Not because those were my job, but because that is what leadership in a scrappy community actually looks like. You are not above bringing the extension cord from home. Nobody is above the extension cord.

And more importantly, you cannot advocate for people you do not understand. If you have never touched procurement, you cannot appreciate what your team is dealing with when a vendor goes quiet two days before an event. Being fluent in everything is not about doing everything. It is about understanding enough to lead properly. And occasionally being the one who remembered to bring the six extension cords from home.

Culture is built in the small moments.

Not the milestone events. Not the posts celebrating how far you've come. The small moments.

How you handle a complaint from someone being unfair about it. How you respond when something goes wrong in front of an audience. Whether you introduce the quietest person in the room to someone, or let them stand there alone scrolling their phone while pretending to look busy.

These accumulate. They become what people say about N0H4TS when we are not there. You cannot write a document that programmes culture into existence. Trust me, people have tried. The document always looks great. The culture does whatever it wants anyway.

You can only show up the same way, repeatedly, in moments that feel too small to matter.

Sustainability over hype, every time.

Early momentum is exciting. It is also a trap.

The first few months of a community when energy is high and everything is new and the group chat is buzzing can make you feel like the hard part is over. It is not. The hard part comes way later. When the novelty has worn off, the team is quietly tired, and there is nothing particularly exciting to announce.

What keeps a community alive past the first year is boring, consistent care. Regular check-ins with the team. Not overpromising to members. Choosing to pace deliberately rather than sprint until someone breaks. Saying "let's maybe not do four meetups back to back" and actually meaning it. (We did not always mean it. See: the four meetups incident. More on that later.)

The communities that last are the ones that chose sustainability over hype when they had a choice. A lot of them don't make it to that choice because they burn out before they get there. The hype is fun while it lasts but sustainable is what lets you still be there in year two.

The community never fully leaves your head. And that's part of the job description.

I spent six months on exchange in Sweden. 10,000km away, six or seven hours behind Singapore depending on the time of year, surrounded by an entirely different life. N0H4TS was always there. Not in an unhealthy, cannot-switch-off way. More like background processing. A browser tab you never quite close.

Keeping up with what was happening at home. Thinking through a problem on a long walk. Coming up with an idea on a train and firing off a message to the team at what was probably a deeply unreasonable hour for them. But knowing my team, they were very likely awake. We are not a well-rested group.

I think this is just part of the job when you genuinely care about what you have built. You are always, on some level, planning. Figuring out what to fix, what to try next, what that thing you just saw could mean for your community back home. It does not feel like a burden. It just feels like your little brain child.

Go to bat for your people. Loudly, and often.

There is a version of leadership where you celebrate what the team produced. The event went well, the numbers were good, the feedback was positive. Great, well done everyone. That matters.

But there is another version, rarer and more important, where you celebrate who your team is. Where you walk into a room with a partner or a stakeholder and you advocate for your people not because it is convenient but because they deserve it. Where you correct the record when someone does not get the credit they earned. Where your team knows, without having to wonder, that you will say something when it counts. Not eventually. When it counts.

Any competent person can get things done. Tasks get completed, events get run, content goes out. That is table stakes. What separates a good community leader from someone who is merely organised is the cheerleading. The genuine, loud, unambiguous enthusiasm for the people doing the work and not just the work itself. Your team needs to feel it. Not once in a while, not only when something goes exceptionally well, but consistently, as a baseline. That energy is contagious in a way that no project management tool ever will be. Asana cannot hype your team up. That's your job.

I think about this in terms of Kantian ethics. The idea that people should always be treated as ends in themselves, never merely as means to an end. In a community context, that means your volunteers are not just a resource you deploy to run events. They are the point. The event is the means. The people are the end. When you lead from that principle, a lot of decisions become clearer. Do you push the exhausted team member to stay late to hit a milestone, or do you find another way? Do you take the shortcut that gets results but makes someone feel disposable? The answers are usually obvious once you are asking the right question: am I treating this person as an end, or as a tool?

That is what builds real loyalty. Not the perks, not the recognition posts. The knowledge that someone in front of them actually sees them and goes to bat for them accordingly.

I became a walking advertisement. Unashamedly.

Everyone I met in the cybersecurity space, I told them about N0H4TS. Every conference, every networking session, every conversation that lasted more than five minutes with someone in the industry.

And everyone outside the industry too. Friends, family members, people I met at completely unrelated events who showed even the faintest flicker of curiosity about tech or security or just learning something new. I would find the angle. I would make the pitch. I was not embarrassed about it. Some people found this charming. Others found it a lot. Both groups now know what N0H4TS community is and what we do, so it worked.

If you believe in what you have built, you should be its loudest advocate. Nobody is going to care about your community more than you do, and nobody is going to tell its story better. So tell it. Constantly. To everyone.

Find your Brandon. Then let them actually do their job.

My deputy is Brandon. And I want to be straightforward about this: having Brandon is one of the best things that happened to N0H4TS community, and I mean that in a very concrete way. We are different in a deliberate way.

I am wired towards tasks like delivery, milestones, getting things done. Brandon's focus is the human side of things. Team bonding. Making sure we actually celebrate after a big event instead of immediately moving on to the next one. The small injections of fun that nobody put on a task list but that make being part of N0H4TS genuinely enjoyable and not just meaningful.

He built a custom spin-the-wheel for our meetup giveaways because it would be more fun than drawing names from a hat. Nobody asked him to. That is exactly the point.

Between the two of us, nothing important falls through the cracks. Not the operational things, not the human things. When you are looking for your deputy, do not look for someone who thinks like you. Look for someone who covers what you miss. The spin-the-wheel guy.

Listening is a leadership skill. Treat it like one.

The best leaders I have encountered are, almost without exception, the best listeners. They create space for people to say what is actually going on. They do not rush to fix or reassure or redirect. They sit with it.

And because they do that, their team trusts them enough to be honest, which means they actually know what is happening in their community, rather than getting a carefully curated version of it. Leaders who do listen get the full picture, which is messier and also infinitely more useful, with LOADS more tea.

If multiple people are raising the same concern, that is not noise. That is your community telling you something. A good leader hears it, and does not confuse stubbornness with conviction. There is a difference between holding the line and simply not listening. One of them is a leadership quality. The other one is just being difficult.

Almost half my team are women. Nobody planned it that way.

I will be very honest about something: I have a complicated relationship with women in cyber events. Not the idea behind them. The execution. Too often they end up being rooms full of people in non-technical functions at tech companies, which is lovely, but is not quite the same thing as women actually doing the technical work. The intent is right. The outcome frequently misses. I am glad that is changing, and there are genuinely good events now that get it right, with real practitioners, real technical conversations, no tokenism.

Which is why I find it meaningful that almost half the N0H4TS community team are women, and it happened without a quota or a push or a deliberate initiative. Nobody sat down and said we should have more women on the team. What we did do was build an environment where people felt safe, where the culture was welcoming without being performative about it, where contribution was what mattered and not who you were or what you looked like.

And the women who joined did so because N0H4TS felt like a place they actually wanted to be, not because they were invited as a demographic. That distinction matters enormously and is felt immediately by the people on the receiving end of it. (Source: Trust me I am a woman)

That is the beautiful thing about representation. You can force the numbers, or you can build something worth showing up to and let the numbers follow. The second way is slower and less legible on a slide deck. It is also the only way that actually works. When the environment is right, people come. When they come, others like them follow.

You have to try things to know if they work. Obviously.

This sounds self-evident. It is apparently not, because the alternative of deciding in advance what will and will not work, based on intuition and inertia is what most communities default to after their first year. They find a format that works, and they run it on loop forever, quietly wondering why growth has plateaued. I consider this to be the algorithm of community building.

We experimented constantly. Event formats, content difficulty, venues, how much we packed into a single session. Some of it worked brilliantly. Some of it did not. And then there was the four meetups incident (#15 to #19 if you're wondering, with #20 occurring two weeks after).

Once, in what I can only describe as a moment of collective ambition that briefly overrode our collective common sense, we ran four meetups in a row. Four. Back to back. The team was running on fumes by the end, the organisers were held together by sheer willpower and an unreasonable amount of bubble tea, and we looked at each other afterwards and said: right, we are never doing that again. And we meant it. It is documented. It is law now.

But here is the thing. We needed to do it to know that. You cannot theorise your way to the answer. The only way to find out if something works is to try it, survive it, debrief honestly about it in the AAR, and carry that knowledge forward. Some experiments will be great. Some will teach you your limits. Some will become cautionary tales you reference for the next two years. All are useful.

Try things. Not recklessly, but genuinely. And when something almost kills you, at least try to remember to write it down so you do not do it again.

So…

Two plus years. 2,300+ members. More late nights than I can count, more bubble tea than I probably should have consumed, and somewhere in the middle of it all, a team of people who became genuinely good friends with each other and with me.

That last part is the thing I am most proud of. Not the numbers. Not the events. The fact that we built something where the friendships were real.

Take care of your people. Make it easy to stay. Listen when they talk and harder when they don't. And for goodness' sake, get them home safely after a late event.

That's the whole job, really.

And to end off, to everyone who has ever shown up to a meetup, shared a post, asked a question, stuck around after for the networking bit even when you were tired: thank you so much. Genuinely. N0H4TS community exists because you kept coming back, and that is not something we take lightly, not even for a second. It has been the quiet privilege of these two years to be the ones who got to serve you. We hope we earned it.

Acknowledgements

None of this would exist without Pengfei, Hong Xuan, and Jerry, who saw something worth investing in before I had done anything to earn it. You brought me in, gave me room to contribute, and trusted me with something that mattered. I have thought about that often over these two years, and I do not take it lightly. Thank you.

To my team (Brandon, Deon, Wei Heng, Cheryl, Hsu Hwee, Charlene, Wei Feng, Zavier, Coco, Ivan, Eddy, Axel, and Sim Yee) I genuinely do not have the words, which is saying something for someone who just wrote several thousand of them. You joined not because there was anything in it for you, but because you believed in what we were building. You gave the community everything you had, consistently put the community ahead of your own interests, and showed up even when it was inconvenient, exhausting, and occasionally involved staying until well past a reasonable hour. You are the reason N0H4TS community is what it is today. It has been an extraordinarily good run, and that is entirely because of you.

To my friends Xinyang, Jing Hui, Glendon, and Jia Xin: thank you for saying yes. In the early days, when we were still figuring out what N0H4TS community was and what it could be, you believed in it enough to stand up and share your experience and expertise with our members. That meant more than you probably realise. You helped give the community its footing when we needed it most.

To our partners, sponsors, and the many new friends made along the way (there are too many of you to name individually, and I mean that as a genuine compliment). Thank you for trusting us, for working with us, and for being so generous with your time, your advice, and your honest feedback. It made us better. We hope the collaboration was worth it for you too.

To my family and friends: thank you for listening. Patiently, repeatedly, and often at length. You heard about N0H4TS at the dinner table, on the way to things, in the middle of conversations that started out being about something else entirely. You gave advice when I asked for it and talked me through things when I needed that instead. You did not always know exactly what I was going on about, but you listened anyway, and that mattered more than I probably said at the time.