Ignore the people saying 1 hour won’t cut it. You have to keep it to an hour or you lose your audience.

I did a security talk at my last job and realized all I was creating was a bunch of scary slides. Went back to focus on actionable responses; What can the user do to defend themselves?