Black Hat

Byron Acohido · Networks can enforce AI agent boundaries

Black Hat Fireside Chat: As AI agents spread, the network shifts from traffic mover to policy enforcer

By Byron V. Acohido

The network’s job has always been simple: watch the traffic. Authority stopped there.

For decades, network traffic came from something physical: a server, a laptop, a badge reader, a printer, each with a fixed address. An AI agent isn’t physical, and it has no fixed home on the network. It appears, acts and disappears, with no device to hang a policy on. Watching isn’t enough anymore.

Across the networking industry, vendors are moving to meet that shift. HPE Networking, Palo Alto Networks, Cisco and others are folding security enforcement directly into the network itself, and integrating their own governed AI agents into that work.

David Hughes leads HPE’s piece of that work as senior vice president for SASE and security. We talked at Black Hat USA in Las Vegas about what folding AI into network enforcement actually looks like in practice. The full conversation is available on the accompanying Last Watchdog podcast.

Byron Acohido · 260921_HERE_Fireside Chat podcast-enhanced-v2

BLACK HAT FIRESIDE CHAT: Nobody picked the web browser to run work — now pick a boundary

By Byron V. Acohido

Nobody picked the browser to run the workplace. It just happened.

HTML5 matured. SaaS spread. One business application after another moved into a tool designed to browse the public internet. Security and privacy problems followed. AI has made the arrangement harder to govern.

The cybersecurity industry is now scrambling in different directions. Some vendors replace Chrome or Edge with a hardened enterprise browser. Others add extensions or runtime controls to the browsers employees already use. A third approach treats the browser as the workplace itself.

The numbers show why the choice has become urgent. Verizon’s 2026 Data Breach Investigations Report found regular AI use on corporate devices jumped from 15 percent to 45 percent in one year; 67 percent of those users accessed AI through noncorporate accounts. An Omdia survey sponsored in part by Parallels found 55 percent of 400 North American IT and security professionals said their organizations experienced a browser-related attack or security incident in the preceding year.

Byron Acohido · 260825_Command Zero Fireside Chat podcast

BLACK HAT FIRESIDE CHAT: How linking SOC alerts cuts noise, reveals attacks taking shape

By Byron V. Acohido

The modern SOC is getting better at closing alerts. It is still bad at remembering them.

Alerts are multiplying. Innovation has been focused on machines that can triage, correlate, and recommend a response at a much elevated scale. The queue indeed is moving faster than ever. Alert in, verdict out, case closed.

Attackers do not work case by case. A scan on Tuesday, an exploit attempt on Thursday and an unfamiliar login the following week may, in fact, be pieces of the same campaign. But once the SOC closes a case, what it learned does not carry forward to the next investigation.

That gap is becoming more consequential as attackers blend into legitimate activity. CrowdStrike found that 82 percent of detections in 2025 were malware-free, with adversaries relying on valid credentials, trusted identity flows and approved SaaS integrations. In that environment, history is not background. It is evidence.

What is absent is not more detection or faster triage. It is a way to keep an investigation alive—to carry its subjects, evidence and reasoning forward so that what arrives tomorrow can change what yesterday meant.

That is the argument Command Zero brought to Black Hat USA 2026. I sat down in Las Vegas with CEO Dov Yoran and CTO Dean De Beer to talk about Throughline, the capability the Austin company launched at the show. For a full drill-down, please give the accompanying podcast a listen. Here is what I took away from it.

Five alerts, one attack

It starts routinely enough. Five phishing emails arrive at one company over five days. Each targets a different employee. Each is tailored to the department where it lands.

Handled one at a time, each message opens its own investigation. No single case carries enough evidence to change the verdict, so the analyst closes it and moves on.

The SOC does its job five times and still misses what happened once.

Read together, … more

MY TAKE: Black Hat 2026 Part 3 — Agentic AI can do the work, but somebody has to prove it

By Byron V. Acohido

Security work used to leave a trail without anyone trying. A developer who wanted an open source library went and got it, and the license came along. An analyst who closed a case wrote down why. The record was a byproduct of a person doing the work.

Related: Part 2 — Deciding what an AI agent may reach

An AI agent produces no such byproduct. It works out its own steps, moves faster than anyone watching, and finishes without leaving behind the paper trail a person would have.

Companies have caught on to what is missing, and they are no longer satisfied with a tool that reports a result. They want to see what the result rests on. Vendors have heard that, and a group of them arrived at Mandalay Bay in Las Vegas selling the proof rather than the finding. Ten of the companies I looked at closely are working that ground, and they close out my three-part Black Hat USA 2026 wrap-up.

MY TAKE: Black Hat 2026 Part 2 — Security shifts to deciding in advance what an AI agent may reach

By Byron V. Acohido

Humans get identity. That is what MFA and single sign-on are for, and we all understand the bargain: prove you are who you say, then go do your work. Machines get predictability. That is what monitoring is for. A script does the same thing every day. If it deviates, somebody notices.

Agentic AI upsets that arrangement. An agent logs in like a human, with an identity that says who it is. Then it goes to work without a script. It figures out its own steps as it goes. There never is a script. No baseline. Nothing ever amiss.

In part two of my three-part Black Hat USA 2026 wrap-up, the eight vendors I looked at closely are all trying to insert permission where predictability used to be. Predictability was something you watched for after the fact. Permission is something you set in advance. Somebody decides what the agent may reach and what it may not, and the agent runs inside that. Permission can be set in several places.

MY TAKE: Black Hat 2026 Wrap-up Part 1 — AI is forcing security and operations to merge in the SOC

By Byron V. Acohido

Companies have kept security in one silo and operations in another for as long as both have existed.

Agentic AI is collapsing the divide. That is what a week at Black Hat USA 2026 made plain to me.

Here’s what I’m driving at: Network security and IT operations grew up in separate silos. Security watched for intruders and cleaned up after them. Operations provisioned the accounts, pushed the updates and kept the systems running.

Now both sides are absorbing hits from the same technology. Adversaries are using AI agents to intensify everything they already do, which lands on security. At the same time, companies are deploying AI agents into production faster than anyone can track what those agents can reach, creating unprecedented exposures, which lands on operations.

BLACK HAT ROUNDTABLE: Security pros dissect fallout from Hugging Face’s double guardrail failure

By Byron V Acohido

LAS VEGAS – It’s come to this. A cyberattack carried out by a machine.

Worse, a machine that picked its own victim. Whether that counts as agency is where the experts below part company.

Related: Huggy Face break-in explained

Hugging Face disclosed July 16 that intruders had moved through its production infrastructure over more than four days, harvesting internal credentials and reaching a production database. Responders logged more than 17,000 actions. The company attributed the intrusion to an external AI agent and had no idea whose.

Its own investigation then hit a wall. The commercial models the incident response team reached for refused to analyze the attack logs, unable to tell a defender examining an exploit from an attacker running one. The forensics ran instead on GLM-5.2, a Chinese-made open-weight model distributed by Nvidia, hosted on Hugging Face’s own hardware.

Older Articles »

The Last Watchdog

Black Hat

Black Hat Fireside Chat: As AI agents spread, the network shifts from traffic mover to policy enforcer

By Byron V. Acohido

BLACK HAT FIRESIDE CHAT: Nobody picked the web browser to run work — now pick a boundary

By Byron V. Acohido

BLACK HAT FIRESIDE CHAT: How linking SOC alerts cuts noise, reveals attacks taking shape

By Byron V. Acohido

MY TAKE: Black Hat 2026 Part 3 — Agentic AI can do the work, but somebody has to prove it

By Byron V. Acohido

MY TAKE: Black Hat 2026 Part 2 — Security shifts to deciding in advance what an AI agent may reach

By Byron V. Acohido

MY TAKE: Black Hat 2026 Wrap-up Part 1 — AI is forcing security and operations to merge in the SOC

By Byron V. Acohido

BLACK HAT ROUNDTABLE: Security pros dissect fallout from Hugging Face’s double guardrail failure

By Byron V Acohido