Metamorphosis - Becoming
Emil Tan on community, transformation, and the story behind SINCON 2026’s theme.
Founder
Metamorphosis: Becoming
Hackers, communities, and our capacity to become something we weren't before.
There is something almost violent about metamorphosis. We tend to romanticise it: a caterpillar disappears into a chrysalis, some time passes, and a butterfly emerges. Transformation. Beauty. New beginnings.
The biology is considerably stranger. A caterpillar doesn't simply grow wings. Its body undergoes an extraordinary reconstruction. Structures that made sense for a creature built to crawl across leaves and consume them give way to structures belonging to something that flies, drinks nectar, reproduces differently, and occupies an entirely different ecological world. It isn't merely a change in appearance. It is a change in capability, behaviour and way of life. The organism becomes capable of doing things its previous form could not.
I've been fascinated by this for 10+ years, ever since I first watched the BBC documentary Metamorphosis: The Science of Change. Back then, my interest was mostly scientific. Metamorphosis is one of those things we learn when we're young that we somehow stop appreciating how bizarre it actually is. Caterpillar, chrysalis, butterfly. Tadpole, frog. We memorise the sequence and move on.
But the documentary went somewhere I hadn't expected. It moved beyond the biology of metamorphosis into our centuries-old fascination with transformation in mythology, literature, philosophy and, eventually, ourselves.
The Ancient Greeks associated the butterfly with psyche (ψυχή) — the soul / spirit. Literature has repeatedly returned to metamorphosis to explore identity and change. Franz Kafka's Gregor Samsa wakes to find himself transformed into an insect, with his place in society transformed alongside him. Dr Jekyll deliberately pursues transformation and discovers another version of himself. And then there is that ironic, yet poetic, question posed by the Caterpillar in Alice's Adventures in Wonderland: "Who are YOU?"
One idea from the documentary stayed with me more than any other: perhaps humans metamorphose too, just not in the way a butterfly does.
If a caterpillar needs to fly, biology transforms its body. Humans don't grow wings. We observe birds, imagine flight, study the physical world, develop mathematics and engineering, experiment, fail, learn and eventually build an aircraft. We don't grow gills to explore the ocean, we build submarines. We don't evolve bodies capable of surviving space, we build technologies that take our environment with us.
Our metamorphosis happens through the mind.
That thought sat somewhere at the back of mine for 10+ years. I found it fascinating, but I never really had a reason to do anything with it. Until earlier this year.
Are We Developing Skills, or Developing People?
I was speaking with a senior leader from the Intelligence Community (IC) about cybersecurity talent — what kinds of capabilities they needed, how those capabilities were developed, and what role the wider cybersecurity community could play.
He observed that people who developed certain cybersecurity capabilities within IC could often take those capabilities into civilian or commercial environments and transfer them effectively. The reverse was much harder. Even someone who was, by conventional industry measures, a very good analyst or penetration tester might not necessarily have the breadth of capability, thinking or adaptability needed for IC missions.
That led us into a conversation about transferable skills, and I spoke about cybersecurity talent becoming too industrialised.
We define job roles and write job descriptions. We create competency frameworks around them, develop courses against those frameworks, certify people against the courses, and construct career pathways that tell someone what they need to acquire to move from one box to the next.
There is nothing inherently wrong with this. Cybersecurity needed professionalisation, and structured learning, competency frameworks and certifications all have important roles to play.
But they answer a particular question very well: What does someone need to know to perform a role we already understand?
The harder question is what happens when we don't yet understand the role.
What happens when a mission requires a combination of capabilities that doesn't fit neatly into an existing job description? What happens when the technology changes faster than our competency frameworks? What happens when someone encounters a problem for which there is no certification, no established methodology and no playbook?
In those situations, knowing more is useful. But knowing how to become capable of something you were not previously capable of is much more important.
That requires something beyond the transfer of hard skills. It requires curiosity, adaptability, judgement, confidence, imagination, and the willingness to be a beginner again. It requires the ability to learn how to learn.
Somewhere in that conversation, I started talking about the role of community.
For years, I've described Division Zero (Div0) as, amongst other things, an incubator — not in the startup sense, but an incubator of skills, ideas, people and eventually new pockets of community. We don't exist simply to transfer knowledge from someone who knows something to someone who doesn't. If that were the objective, there are far more efficient mechanisms. Take a course. Read a book. Watch a video. Get certified.
Community does something much messier.
It creates exposure.
Community-as-an-Incubator
You meet someone working on something you didn't know existed. You join a competition despite not really knowing what you're doing. Someone shows you a technique that sends you down a rabbit hole. You discover that another discipline has already solved the problem you've been struggling with. You build something mostly because it sounds fun. You fail. Someone helps you. You try again.
Sometimes you teach someone else and discover, in the process, that you don't understand your own subject nearly as well as you thought.
Sometimes someone's enthusiasm for an obscure topic is so infectious that 3 months later you've somehow bought specialised hardware and are reading papers at 2am.
I've always been an advocate of non-linear learning, and forms of learning that feel less like formal education and more like play. Things like Div0's Meetups, workshops, SHELLgym, our competitions, and the many slightly chaotic things that emerge organically from the community. Some of it has structure underneath, but it doesn't always feel structured. It is learning through curiosity, challenge, experimentation and social interaction — almost a soft form of gamification where the objective isn't simply to complete a syllabus, but to get people to keep going.
I've watched what that environment can do.
Eugene Lim, a.k.a. Spaceraccoon, came into our orbit through HackSmith. He and his brother built an npm package vulnerability scanner. There wasn't some carefully designed workforce-development pathway behind it. They were building, experimenting and having fun. One thing led to another. Interest became capability, capability exposed new possibilities, those possibilities created more interest. Today, Eugene is a brilliant bug and vulnerability hunter.
Our Div0 Car Security Quarter (CSQ) is another interesting example. It didn't begin with automotive cybersecurity experts. It began largely with novices: cybersecurity folks, mechanical engineers, electrical engineers, physicists and others who didn't necessarily know very much about hacking cars. What they had was interest. So they came together.
The cybersecurity folks knew things the engineers didn't. The engineers understood physical systems the cybersecurity folks didn't. Different disciplines brought different fragments of knowledge, and those fragments began colliding. People experimented, taught one another, broke things, figured things out, developed a shared language and became increasingly capable together.
Over time, a group of interested novices became an established part of the international car hacking scene. From this community, a company eventually emerged: HE&T Security Labs.
Nobody designed that final outcome.
There was no curriculum with a learning outcome of: become internationally recognised automotive security practitioners and start a company.
We created the conditions. The people did the rest.
In my conversation with the IC leader, I used the word incubation for this process.
A week later I began wondering whether there was another word for it.
Then I Walked into an Art Gallery
I happened to be in Adelaide, Australia, and visited the Art Gallery of South Australia.
I loved its curation. Each room explored an idea, bringing together works across different periods, cultures and artforms. Those themes connected to one another as you moved through the gallery, so the experience became less about viewing isolated objects and more about seeing relationships between ideas.
Towards the end, I walked into a room titled Metamorphosis.
The curatorial description talked about how metamorphosis has been an enduring source of inspiration to artists across centuries, countries and artforms. Some forms of change are predictable — day becoming night, the shifting of seasons. Others are surprising and non-linear: the butterfly emerging from its chrysalis, the phoenix rising from the ashes.
Across more than 3,000 years of art and design, humans have explored transformation through nature, materials, bodies, identity, folklore, mythology and experimentation. Through those transformations, the works invite us into new imaginative spaces and new ways of seeing and thinking.
I stood there thinking about the conversation I'd had a week earlier.
About cybersecurity skills and communities as incubators. And then I remembered the BBC documentary.
10+ years after I first watched it, 3 previously unrelated threads suddenly collided:
- My scientific fascination with metamorphosis
- My conversation about how we develop cybersecurity people
- Thousands of years of art about humanity's fascination with transformation
I went back and rewatched the documentary.
And then, as my fellow SINCON Co-Founder — Adrian — and the SINCON team can probably attest, I went a little nuts.
From Incubation to Metamorphosis
What struck me on rewatching the documentary was that metamorphosis isn't simply about physical form. A caterpillar and butterfly don't merely look different. They live differently.
A caterpillar consumes leaves and crawls. A butterfly drinks nectar and flies. Different stages of the same organism specialise for different things. Transformation changes what the organism is capable of doing and, consequently, its relationship with the world around it.
That brought me back to what I had been trying to articulate about community.
Maybe our role isn't simply to make someone a more knowledgeable version of the person they already are.
Maybe the outcome is becoming capable of something their previous self wasn't.
That might happen through acquiring a hard skill, but the skill itself isn't necessarily the transformation. The transformation may be in how they see problems, what they believe they can attempt, how they respond when they don't know something, or the kinds of questions they begin to ask.
An experienced practitioner doesn't simply possess more facts than a beginner. They perceive the environment differently. Patterns that are invisible to the beginner become obvious. An anomaly means something. An intuition has formed from thousands of previous encounters. Their mental model of the system has changed.
The same person can, through experience and exposure, inhabit a very different intellectual world.
This is why I've become increasingly uncomfortable calling things like systems thinking, critical thinking, curiosity, creativity, resilience, humility and judgement soft skills. There is nothing particularly soft about them. They are adaptive capabilities. They determine what happens when the hard skill you were trained for is no longer enough.
In cybersecurity, that moment comes rather frequently.
Tools change. Attack surfaces change. Adversaries change. Entire areas of expertise can emerge, mature and transform within a few years.
I have no idea exactly what a good cybersecurity practitioner will need to know in 2036.
Hence, the most durable capability we can develop isn't mastery of any skills. It is the ability to metamorphose.
The Environment Changes Us. We Change the Environment.
Nature complicates the metaphor further.
We tend to imagine metamorphosis as biological clockwork. The caterpillar becomes a butterfly because that is simply what a caterpillar does.
But transformation in nature doesn't occur independently of the environment. Environmental conditions can affect developmental timing in animals such as tadpoles. Other creatures undergo dramatic behavioural and physiological changes in response to their surroundings.
The environment participates in transformation.
Humans know this intimately. Our circumstances change us. The people around us change us. Technology changes us. Success changes us. Failure changes us. War changes us. Communities change us.
Sometimes transformation is something we seek. Sometimes it is imposed upon us. Often, we don't even realise how much we've changed until we look backwards.
But humans add another layer to this relationship: we transform the environment in return.
Our minds produce ideas. Ideas become tools. Tools become technologies. Ideas also become institutions, communities, cultures and systems. Those things change the environment in which other humans develop, and those humans eventually produce ideas and environments of their own.
Society shapes the individual. The individual reshapes society. The transformed society shapes the next individual. It is a loop.
That, to me, is where the idea becomes especially important for community builders. A community isn't simply a container in which learning happens. The environment itself affects what people become.
What we celebrate gets repeated. What we make accessible determines who gets to participate. What we tolerate becomes normal. Who we put on stage signals who matters. How we respond to failure determines whether someone experiments again. Whether we create opportunities to participate or merely opportunities to watch changes the relationship people have with the community.
Communities are not neutral.
If they can help shape people, then those of us who build them have a responsibility to think about what kinds of transformation our environments make possible.
Agency
But there is one point where I think human metamorphosis diverges fundamentally from the butterfly.
A caterpillar has a destination. However extraordinary its transformation, its biology constrains what comes next. It doesn't enter the chrysalis wondering what it would like to be when it grows up.
We don't have that certainty. That is where I keep returning to the idea of agency. I think of agency as the capacity to participate deliberately in our own becoming.
We can recognise that our current form is insufficient. We can seek unfamiliar experiences. We can expose ourselves to different people and disciplines. We can acquire knowledge, challenge assumptions and unlearn things that were once useful. We can deliberately put ourselves into environments that make us uncomfortable. We can become beginners again.
We can imagine versions of ourselves that do not yet exist and then take steps towards them.
That doesn't mean we are entirely the authors of ourselves. That would be far too neat. Biology constrains us. Circumstances constrain us. Society shapes us. Luck plays a part. Transformation can be forced upon us as readily as it can be chosen.
Kafka understood that. Gregor Samsa doesn't choose his metamorphosis. It happens to him, and the world around him decides what his new form means.
And transformation is not necessarily improvement. People can become worse. Communities can create conformity rather than curiosity. Technology expands destructive capability just as readily as constructive capability. The same forces that help someone develop extraordinary abilities can reshape them in ways they never intended.
The question therefore isn't simply whether we change.
We will.
The more interesting question is how much agency we possess over what we become.
Perhaps that is the real difference between learning and transformation. Learning adds something to us. Transformation can change the person doing the learning.
The Mind That Changes Is Also the Mind That Remembers
There is another part of human metamorphosis that fascinates me.
We remember our previous forms.
The butterfly doesn't appear to sit on a flower reminiscing about its days eating leaves. Humans do. We look backwards. We regret. We miss previous versions of ourselves. We wonder whether becoming something new required us to lose something important.
The same mind that gives us the ability to imagine change also gives us the ability to fear it.
As Gregor's physical form becomes less human, the people around him increasingly treat him as something other than human. Yet when he hears his sister playing the violin, something deeply human in him responds to the music.
His transformation raises a question: when so much about us changes, what remains?
I think about that in cybersecurity too.
As cybersecurity professionalised, we gained enormously. We've built careers, disciplines, qualifications, institutions and an industry.
But we risk losing our hacker culture as we professionalise.
The curiosity to take something apart simply because we want to know what's inside. The playfulness. The irreverence. The willingness to investigate questions whose commercial value is approximately zero. The joy of making something work that absolutely shouldn't. The instinct to share something interesting simply because someone else might find it interesting too.
Perhaps becoming doesn't require abandoning everything about our previous form.
Perhaps part of metamorphosis is figuring out what should change, and what is essential enough to carry forward.
Metamorphosis: Becoming
This is how a conversation about cybersecurity talent, a BBC documentary I first watched 10+ years ago, and an afternoon in an art gallery somehow became the theme for SINCON 2026.
It also reflects how I've evolved in my thinking about SINCON — and, more broadly, the role of community.
Our earlier themes were deliberately direct. Discover Your New Limit. Breaking Barriers, Setting New Paradigms. They reflected what we wanted people to do at SINCON: push themselves, explore, learn, challenge assumptions, try something new.
Last year, we went broader with #BornToHack, something rooted in the Div0 manifesto. #BornToHack isn't about an innate ability to hack. It is about a mindset and an identity: curiosity, creativity, exploration, questioning how things work, building, breaking, sharing, and continually advancing our craft.
I still believe deeply in that.
But increasingly, I think community needs something beyond activities and even identity.
Community needs philosophy.
Why do we gather? Why do volunteers spend time building spaces for other people to learn? Why do we need talks, workshops, competitions, Kampungs, parties and hallway conversations when almost every piece of technical information imaginable is already somewhere on the internet?
Because information isn't the most important thing being exchanged.
A conference can give you knowledge. A community can change the space of possibilities you see for yourself.
Someone shows you something and suddenly you know it exists. Someone challenges you and you realise you aren't as good as you thought. Someone believes you can do something before you believe it yourself. Someone asks a question you can't answer and it bothers you for the next 6 months.
You encounter !!! moments that suddenly make something click, and ??? moments that send you down entirely new rabbit holes.
That is why I've always cared about SINCON being an experience, not simply a conference.
We don't know what that experience will turn you into. We shouldn't. It would contradict the entire philosophy if we decided what you ought to be.
Our role is to create the conditions: exposure to people, ideas, disciplines, problems, opportunities, challenges, failure, play and possibility.
What happens after that belongs to you.
That is why this year's theme isn't Metamorphosis: Transformed. "Transformed" sounds complete.
It isn't Metamorphosis: Better, because who gets to decide what better means?
It is: Metamorphosis: Becoming. Becoming is unfinished.
Becoming a practitioner. Becoming a builder. Becoming a researcher. Becoming a leader. Becoming a founder. Becoming a hacker. Becoming something that sits between 3 disciplines and doesn't have a job title yet. Or becoming something none of us has imagined.
There is no object after the word because the destination isn't ours to prescribe.
The caterpillar's biology already knows what it will become.
We have no such certainty.
That uncertainty is our greatest gift.
We can imagine. We can learn. We can invent. We can change our minds. We can change one another. We can build communities that change the environments around us, and those environments can create possibilities for people we may never meet.
We don't grow wings.
We imagine them, and then we figure out how to fly.
We get to become.