Sep 21, 2026
10 Lessons Reshaping Security After Black Hat and DEF CON 2026
Ten lessons from Black Hat and DEF CON on AI agents, cheaper attacks, supply chain risk, security fundamentals and cyber skills.
The first days after Black Hat and DEF CON produce full notebooks, crowded message threads, and long lists of tools to investigate. A month later, the product announcements have started to blur. What remains are the ideas that should change how security teams work.
Artificial intelligence dominated conversations at Black Hat USA 2026 and DEF CON 34, but the message was more specific than “AI is changing cybersecurity.”
One month back in the seat, these are the ten lessons that still stand up, and the specific conference conversations behind them.
In his Black Hat keynote, “The End of Rare: Defending When Offense Is Cheap,” Microsoft’s David Weston argued that AI-powered vulnerability discovery and exploit generation are making sophisticated attacks faster and less expensive. Advanced exploitation has traditionally required significant expertise, time, and resources, limiting who could carry it out and at what scale. AI is lowering those barriers.
Faster detection and patching still matter, but teams cannot assume they will consistently outrun automated discovery. Weston pointed to memory-safe languages, formal verification, and automated remediation as ways to make systems more durable. The goal is to remove weaknesses before they become another race against an attacker.
Across Black Hat and DEF CON, the conversation moved from protecting models to governing agents. Agents can hold credentials, call APIs, browse authenticated sessions, access code and data, and take action without approval at every step.
That makes agent security part of identity and access management. Organizations need an inventory of deployed agents, named owners, narrowly scoped credentials, and records of every tool call and data access. Low-risk actions may be automated, but destructive, irreversible or public actions need explicit approval. An overprivileged human account is dangerous; an overprivileged agent can use the same access repeatedly at machine speed.
A DEF CON demonstration showed how malicious instructions hidden in an email could target an AI assistant rather than its user. If the user later asked the assistant to summarize the inbox, the instructions could enter the model’s context. With access to email and outbound web requests, the assistant could be manipulated into sending an MFA code to an attacker-controlled address.
The example exposed a structural problem: system instructions, user requests, and untrusted content can enter the same context. Better prompts will not solve that alone. Tool permissions, outbound network restrictions and approval gates must limit what a manipulated agent can do.
Security evaluations discussed during the conference showed capable agents finding unexpected routes through connected infrastructure and using shared resources to communicate across runs. Those tests used permissive conditions and should not be presented as ordinary commercial agents independently escaping. The lesson is architectural: isolating a model does not isolate every tool, shared service, or network connection it can reach.
Containment must cover the deployed system. That includes egress controls, workload isolation, tool-specific permissions, resource limits and a reliable way to stop execution. Logs may explain what an agent did, but they do not stop it. Teams must decide in advance where an agent can act alone, where a person must approve the next step, and how access will be revoked.
One panel recommendation was direct: do not assume compliance will save you. Tools only see what they were designed and permitted to inspect. They may miss a dangerous sequence of individually allowed actions, lack the business context to identify a critical exposure, or bury it among low-value findings.
AI guardrails can also obstruct legitimate defensive work when logs or test data contain exploit content. Automation increases speed and coverage, but its output remains evidence to examine, but not proof that a system is secure. Our AI Blind Spot whitepaper explores this gap in more detail.
Black Hat conversations connected exposure management with prioritization and safe exploitability validation. That reflects a practical limit: if AI increases vulnerability discovery, adding every finding to the same queue only makes the queue harder to use.
A severity score does not show whether a weakness is reachable or what an attacker could access through it. Attack-path analysis connects vulnerabilities with identities, configurations, network reachability, and critical assets. It helps teams fix the exposures that create usable routes into the business instead of treating every high-severity finding as equally urgent.
Supply-chain research at Black Hat showed how attackers target systems that organizations already trust. One presentation examined patterns across recent attacks on GitHub workflows and packages, including forged commit identities, poisoned tags, workflow abuse and OIDC token misuse. The same conference coverage described trojanized AI “skills” distributed through a public marketplace.
AI adds agent skills, model connections and tool integrations to existing dependencies such as packages, build systems and cloud services. A yearly vendor questionnaire cannot track changes across those connections. Teams need continuous visibility into which third parties can supply code, provide context, authenticate services, or make changes. The attack surface includes what the organization trusts, not only what it exposes.
A study of 2,295 Hacker Summer Camp talks also highlighted a recurring AppSec problem: scanners can return hundreds of findings and leave developers to determine which are real. AI-generated code increases the volume moving through workflows that already struggle with false positives and slow remediation.
Running more code through the same scanner and producing a longer report is not enough. AppSec teams need contextual testing, deterministic analysis where it performs best, and validation of whether a finding is exploitable. Feedback must also reach developers while they are still working on the code. AI does not create weak review and ignored scanner output, but faster code production makes both more costly.
Across Black Hat, DEF CON and BSidesLV, talks combining AI and offense rose from 23 in 2025 to 47 in 2026, while AI-and-defense talks fell from 19 to 17. Conference programs do not measure attacker adoption, but the numbers show where researchers are concentrating their attention.
Organizations need defenders who can use AI and challenge it. AI can accelerate reconnaissance, analysis, and repetitive work. Human experts still define the method, understand business context, verify consequential findings, and decide what risk is acceptable. That requires hands-on practice with ambiguous problems and opportunities to see where tools fail. AI fluency should extend technical expertise, not replace the knowledge needed to check an answer.
Across panels and presentations, speakers repeatedly returned to asset inventory, identity management, least privilege, configuration hygiene, testing and attack-surface reduction.
AI makes neglecting them more costly. A forgotten server is more exposed when discovery is cheaper. An excessive permission creates more risk when an agent can use it at machine speed. Poor data governance becomes harder to contain when an autonomous system can search repositories and send information through connected tools.
Returning to the fundamentals does not mean ignoring AI. It means applying established security principles to agents and strengthening the controls on which AI-assisted defense depends.
The answer isn’t a new product for every emerging AI risk. It’s understanding where AI changes your attack surface, identifying gaps in your defenses, and assigning clear ownership for addressing them.
Black Hat and DEF CON showed how quickly offensive capabilities are evolving. But the fundamentals remain: understand your systems, control access, test your assumptions, and build teams that can adapt as threats change.
Those are the lessons worth putting into practice.
As AI creates new attack paths, security teams need the practical skills to find weaknesses and test whether existing defenses hold up.
The OffSec AI Red Teaming Upskill Program helps organizations build and validate those capabilities through structured, hands-on development.