Podcasts

Byron Acohido · Networks can enforce AI agent boundaries

Black Hat Fireside Chat: As AI agents spread, the network shifts from traffic mover to policy enforcer

By Byron V. Acohido

The network’s job has always been simple: watch the traffic. Authority stopped there.

For decades, network traffic came from something physical: a server, a laptop, a badge reader, a printer, each with a fixed address. An AI agent isn’t physical, and it has no fixed home on the network. It appears, acts and disappears, with no device to hang a policy on. Watching isn’t enough anymore.

Across the networking industry, vendors are moving to meet that shift. HPE Networking, Palo Alto Networks, Cisco and others are folding security enforcement directly into the network itself, and integrating their own governed AI agents into that work.

David Hughes leads HPE’s piece of that work as senior vice president for SASE and security. We talked at Black Hat USA in Las Vegas about what folding AI into network enforcement actually looks like in practice. The full conversation is available on the accompanying Last Watchdog podcast.

Byron Acohido · 260921_HERE_Fireside Chat podcast-enhanced-v2

BLACK HAT FIRESIDE CHAT: Nobody picked the web browser to run work — now pick a boundary

By Byron V. Acohido

Nobody picked the browser to run the workplace. It just happened.

HTML5 matured. SaaS spread. One business application after another moved into a tool designed to browse the public internet. Security and privacy problems followed. AI has made the arrangement harder to govern.

The cybersecurity industry is now scrambling in different directions. Some vendors replace Chrome or Edge with a hardened enterprise browser. Others add extensions or runtime controls to the browsers employees already use. A third approach treats the browser as the workplace itself.

The numbers show why the choice has become urgent. Verizon’s 2026 Data Breach Investigations Report found regular AI use on corporate devices jumped from 15 percent to 45 percent in one year; 67 percent of those users accessed AI through noncorporate accounts. An Omdia survey sponsored in part by Parallels found 55 percent of 400 North American IT and security professionals said their organizations experienced a browser-related attack or security incident in the preceding year.

Byron Acohido · 260825_Command Zero Fireside Chat podcast

BLACK HAT FIRESIDE CHAT: How linking SOC alerts cuts noise, reveals attacks taking shape

By Byron V. Acohido

The modern SOC is getting better at closing alerts. It is still bad at remembering them.

Alerts are multiplying. Innovation has been focused on machines that can triage, correlate, and recommend a response at a much elevated scale. The queue indeed is moving faster than ever. Alert in, verdict out, case closed.

Attackers do not work case by case. A scan on Tuesday, an exploit attempt on Thursday and an unfamiliar login the following week may, in fact, be pieces of the same campaign. But once the SOC closes a case, what it learned does not carry forward to the next investigation.

That gap is becoming more consequential as attackers blend into legitimate activity. CrowdStrike found that 82 percent of detections in 2025 were malware-free, with adversaries relying on valid credentials, trusted identity flows and approved SaaS integrations. In that environment, history is not background. It is evidence.

What is absent is not more detection or faster triage. It is a way to keep an investigation alive—to carry its subjects, evidence and reasoning forward so that what arrives tomorrow can change what yesterday meant.

That is the argument Command Zero brought to Black Hat USA 2026. I sat down in Las Vegas with CEO Dov Yoran and CTO Dean De Beer to talk about Throughline, the capability the Austin company launched at the show. For a full drill-down, please give the accompanying podcast a listen. Here is what I took away from it.

Five alerts, one attack

It starts routinely enough. Five phishing emails arrive at one company over five days. Each targets a different employee. Each is tailored to the department where it lands.

Handled one at a time, each message opens its own investigation. No single case carries enough evidence to change the verdict, so the analyst closes it and moves on.

The SOC does its job five times and still misses what happened once.

Read together, … more

Byron Acohido · 260717_Jscrambler_Fireside Chat podcast

BLACK HAT FIRESIDE CHAT: Websites now leak sensitive data by design – AI is making it worse

By Byron V. Acohido

Public-facing web pages aren’t built in-house anymore. They’re composed from components supplied by outsiders, and the advertising platforms have had their run of them. The exposure is enormous, and AI is accelerating it all.

Related: No easy fixes for AI risk

The bill for all of it is arriving now. Since 2023, hospitals and health systems have paid more than $100 million to settle claims that tracking pixels on their websites leaked patient data to advertising platforms. A court approved $21.5 million against Sutter Health in February. Inova settled for $3.1 million in April. Atrium settled for $1.8 million this month. In each of these cases the pixels came from Meta or Google, and the health system paid the settlement.

Those numbers have teeth. On July 14 a federal judge refused to dismiss claims against Google and Meta over prescription data collected by pixels on a telehealth site, rejecting the argument that users had consented, and pushing both companies into discovery.

Byron Acohido · Digital passports for AI agents

Fireside Chat: PKI has carried digital trust through every tech advance—now comes the hardest one

By Byron V. Acohido

Public key infrastructure — the authentication and encryption framework that has held digital commerce together through every chaotic leap forward in technology — is facing a double whammy.

Autonomous AI agents are flooding enterprise networks, most without verified identities or any meaningful governance. What’s more, quantum computers are just around the corner — and when they arrive, current encryption becomes obsolete overnight.

I sat down with DigiCert CEO Amit Sinha at RSAC 2026 to discuss this. The identity management and encryption communities are not sitting on their hands. Here is what I learned that you should know.

PKI has been the quiet backbone of digital trust for 30 years. E-commerce needed it to authenticate strangers. The cloud and IoT needed it to manage machine identities at scale.

Byron Acohido · Geopolitics collides with AI risk

FIRESIDE CHAT: Geopolitical turmoil, rising AI risk add a new layer to enterprise cyber defense

By Byron V. Acohido

As if securing the enterprise against a tidal wave of AI tools wasn’t hard enough, it turns out the geopolitical instability of the moment is making things worse.

That wasn’t the headline at RSAC 2026 last week — agentic AI dominated the agenda — but the stress was visible at the ground level if you knew where to look.

Sanjay Castelino, president of Skyhigh Security, knew where to look. While the Trump White House was pulling federal agencies off the conference floor — fracturing the public-private threat intelligence pipeline RSAC had sustained for three decades — Castelino was tracking a pressure building from the other direction.

He had spent time in Europe roughly a month earlier, meeting with customers across the EU and UK. The message was uniform and pointed: enterprises there were reassessing whether US-controlled cloud infrastructure could be trusted as the foundation of their defenses.

The concern wasn’t technical. It was political — an erosion of confidence in US oversight that had accelerated sharply in recent months. What they wanted was the guaranteed ability to control their own defensive perimeter, on-premises or inside sovereign cloud environments their own governments could reach.

The federal boycott playing out a few hundred yards away at Moscone was, if anything, a live demonstration of exactly what they were worried about. Over the prior three to nine months, Castelino said, that conversation had moved well beyond regulated industries into mainstream enterprise.

That pressure is arriving simultaneously with the challenge that did own the conference: the explosion of unsanctioned AI tools inside enterprise environments. Castelino puts the number at 320 AI cloud applications per enterprise on average, most outside existing data protection policy.

The exposure is concrete — employees are copying patient records, financial data and proprietary product plans into AI prompts, with no visibility into what the tool does with that content afterward.

What’s striking is how fast enterprises are moving from paralysis … more

Byron Acohido · Taking a unified approach to network defense

BLACK HAT FIRESIDE CHAT: Inside the ‘Mind of a Hacker’ — A10’s plan for unified threat detection

By Byron V. Acohido

In today’s threat landscape, attackers are no longer just exploiting technical flaws — they’re exploiting business logic.

Think gaps in workflows, permissions, and overlooked assumptions in how applications behave. This subtle shift is creating powerful new footholds for cybercriminals and evading traditional defenses.

A10 Networks’ Field CISO Jamison Utter calls this the new front in cybersecurity: stopping attackers who use your own processes against you.

I sat down with Utter to unpack how forward-looking companies are moving beyond static perimeter defenses to more adaptive, behavioral systems. A10’s strategy centers on deploying AI-enhanced observability and automation to detect—and respond to—subtle indicators of attack. This includes analyzing normal vs. anomalous behavior in encrypted web traffic, API interactions, and even traffic flow between legacy systems.

Older Articles »

The Last Watchdog

Podcasts

Black Hat Fireside Chat: As AI agents spread, the network shifts from traffic mover to policy enforcer

By Byron V. Acohido

BLACK HAT FIRESIDE CHAT: Nobody picked the web browser to run work — now pick a boundary

By Byron V. Acohido

BLACK HAT FIRESIDE CHAT: How linking SOC alerts cuts noise, reveals attacks taking shape

By Byron V. Acohido

BLACK HAT FIRESIDE CHAT: Websites now leak sensitive data by design – AI is making it worse

By Byron V. Acohido

Fireside Chat: PKI has carried digital trust through every tech advance—now comes the hardest one

By Byron V. Acohido

FIRESIDE CHAT: Geopolitical turmoil, rising AI risk add a new layer to enterprise cyber defense

By Byron V. Acohido

BLACK HAT FIRESIDE CHAT: Inside the ‘Mind of a Hacker’ — A10’s plan for unified threat detection

By Byron V. Acohido