Home About Black Hat Contact Essays Fireside Chats My Take News Alerts Q&A Reels RSAC Videocasts ☰
 

Fireside Chat

 

FIRESIDE CHAT: In the AI age, your MFA, authentication apps can be compromised in minutes

By Byron V. Acohido

The authentication layer that corporate America spent a decade building is now a liability.

Listen to the podcast:The day MFA became the problem

That’s the blunt assessment of Kevin Surace, chairman of Token, a Rochester, N.Y.-based security company whose biometric hardware is drawing attention from enterprise security teams and federal regulators alike. Surace made the case in a recent LastWatchdog Fireside Chat podcast ahead of RSAC 2026.

The numbers back him up. When Microsoft dismantled the Tycoon 2FA phishing kit last year, investigators confirmed the tool had been used to execute 96,000 successful break-ins — every one of them bypassing a legitimate authentication app.

“All the MFA you’ve been using and all the auth apps you’ve been using are compromisable in minutes,” Surace said. “If someone wants to compromise them, that’s the bottom line.”

The shift accelerated, Surace explained, when major platforms began mandating MFA. Salesforce’s move to enforce its authenticator app across its entire customer base became a flare in the sky for threat actors. Within a week, kits to defeat it were in circulation.

Token’s answer is hardware-bound biometric authentication. The company’s Token Ring and Token BioStick devices store a user’s fingerprint locally, cryptographically bind it to a specific domain, and require physical proximity to complete a login. No credential leaves the device. No remote relay attack can replicate it.

Insurance carriers and the FBI have begun signaling the same direction — pushing organizations toward phishing-proof biometric authentication as a baseline standard.

“Shut the front door,” Surace said. “If the front door was closed and locked and deadbolted, you wouldn’t worry about getting in the network as much.”

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(Editor’s note: I used Claude and ChatGPT to assist with research compilation, source discovery, and early draft structuring. All … more

Comment | Read | March 22nd, 2026 | Fireside Chat | RSAC | Top Stories

FIRESIDE CHAT: Edge AI moves onto the silicon layer, redefining how connected systems run

By Byron V. Acohido

One of the more surprising — and least visible — frontiers of artificial intelligence today is unfolding at the extreme edges of our hyper-connected systems.

Related: AI adoption outpacing controls

Think sensors in forests that detect illegal logging. Smart speakers that recognize the sound of someone falling. Microcontrollers inside doorbells that run face recognition without ever sending data to the cloud.

In each case, AI isn’t happening in a data center or even at the application layer. It’s happening on the chip — embedded directly into the device. And that shift is forcing a rethink of how we design, power, and secure the next wave of connected systems.

At OktoberTech 2025, I sat down with Thomas Rosteck, division president of Connected Secure Systems at Infineon Technologies, to unpack the implications. Infineon sits at the silicon layer, supplying the secured microcontrollers now capable of running machine learning workloads on-device.

Comment | Read | November 19th, 2025 | Fireside Chat | Top Stories

BLACK HAT FIRESIDE CHAT: The case for AI-Native SOCs built to take action, not just observe and alert

By Byron V. Acohido

The raw attack surface isn’t just growing. It’s fragmenting. Logs from SaaS apps, cloud workloads, and third-party services flood security stacks already straining to keep up. Security teams are buried in alerts they can’t triage fast enough. Meanwhile, adversaries probe for gaps that form in the seams.

Related: Using threat intel to boost ROI

This operational sprawl has become the modern SOC’s weakest link — and, increasingly, its most fixable one.

That’s the case made by George Moser, Chief Growth Officer at Anomali,  who I spoke with recently. Moser frames this moment as a necessary reset: one in which AI-native security platforms shift the goal from passive visibility to predictive, autonomous mitigation. And do so in a way that scales across the real-world complexity defenders now face.

“We’re beyond the point where throwing humans at the problem works,” Moser told me. “We need actionable intelligence, and the ability to act on it instantly.”

Comment | Read | September 16th, 2025 | Black Hat | Fireside Chat | Top Stories

Fireside Chat: API sprawl turns SMBs into prime targets — simple flaws invite breaches

By Byron V. Acohido

Cyber attackers don’t always need sophisticated exploits. Too often, they succeed by exploiting the basics.

Related: 51 common SMB cyberattacks

That’s the warning from Chris Wallis, founder and CEO of London-based Intruder, who sat down with Last Watchdog during Black Hat USA 2025. His company has carved out a niche helping small and mid-sized businesses, which remain chronically under-resourced when it comes to cybersecurity.

The 2022 Optus breach — triggered by a single unauthenticated API spilling customer data — prompted Wallis and his team to ask how many similar exposures might be hiding in plain sight. Their answer was Auto Swagger, a tool built to scour company systems for exposed API documentation and probe for weaknesses.

Early trials uncovered unsecured APIs at Microsoft and two other global tech firms, exposing sensitive data to anyone who knew where to look. Intruder released Auto Swagger this summer as a free resource to raise awareness and help organizations confront this overlooked risk.

Findings like these highlight a broader concern: the expanding role of APIs as companies rush to embed generative AI. Each new integration depends on APIs to connect internal systems, creating fresh pathways often deployed with little attention to security.

Comment | Read | September 1st, 2025 | Fireside Chat | Top Stories

BLACK HAT FIRESIDE CHAT: Straiker extends ‘red teaming’ to the AI layer as AI attacks surge

By Byron V. Acohido

The enterprise software model that defined the past two decades — SaaS — is being rapidly eclipsed by a new center of gravity: AI-native systems. These are autonomous agents wired directly into company data, tools, and workflows.

Related: LLMs fuel automated attacks

According to Straiker CEO Ankur Shah, this shift is happening faster than cloud adoption ever did.

In a Fireside Chat at Black Hat 2025, Shah sketched the architecture of the AI-native stack: a reasoning model such as OpenAI’s GPT or Anthropic’s Claude, tool integrations via emerging standards like the Model Context Protocol, and unfettered access to enterprise datasets.

The payoff is unprecedented automation. The trade-off is a different kind of vulnerability altogether. The weak points now sit inside language models, tool connections, and the data they touch — places older defenses were never designed to watch.

Straiker’s answer is to meet AI with AI. Its Ascend Agent acts as a perpetual red team, probing deployed agents for weaknesses such as direct or indirect prompt injections. Its Defend Agent monitors live interactions, blocking malicious behavior in real time.

Comment | Read | August 20th, 2025 | Black Hat | Fireside Chat | Top Stories

Black Hat Fireside Chat: Automation takes center stage as TLS lifespans grow ever shorter

By Byron V. Acohido

The countdown is on for security teams still managing digital certificates with spreadsheets and manual workarounds.

Related: Preparing for the quantum future

Starting in 2026, TLS certificate lifespans will begin dropping sharply — from 398 days to just 47 by 2029. That shift isn’t just a technical nuance. It’s a foundational disruption to how enterprises maintain digital trust.

In this Last Watchdog Fireside Chat, I spoke with DigiCert’s Vice President of Product and Solutions Marketing, Ashley Stevenson, about what this transition means and how companies can prepare.

We unpacked the risks that come with shorter certificate lifecycles — including costly outages, broken workflows, and lost customer confidence — and the growing imperative to automate certificate management from a single platform. Stevenson explained how many organizations still rely on fragmented systems and manual tracking, often leading to gaps that don’t get noticed until services go offline.

Comment | Read | August 13th, 2025 | Black Hat | Black Hat Podcasts | Fireside Chat | Top Stories

BLACK HAT FIRESIDE CHAT: Inside the ‘Mind of a Hacker’ — A10’s plan for unified threat detection

By Byron V. Acohido

In today’s threat landscape, attackers are no longer just exploiting technical flaws — they’re exploiting business logic.

Think gaps in workflows, permissions, and overlooked assumptions in how applications behave. This subtle shift is creating powerful new footholds for cybercriminals and evading traditional defenses.

A10 Networks’ Field CISO Jamison Utter calls this the new front in cybersecurity: stopping attackers who use your own processes against you.

I sat down with Utter to unpack how forward-looking companies are moving beyond static perimeter defenses to more adaptive, behavioral systems. A10’s strategy centers on deploying AI-enhanced observability and automation to detect—and respond to—subtle indicators of attack. This includes analyzing normal vs. anomalous behavior in encrypted web traffic, API interactions, and even traffic flow between legacy systems.

Comment | Read | August 6th, 2025 | Black Hat | Black Hat Podcasts | Fireside Chat | Podcasts | Top Stories | Uncategorized

« Newer Articles
Older Articles »