Cybersecurity

Black Hat 2026: what the keynotes argued

Black Hat USA 2026 argued economics, not exploits: when offence is nearly free, the only lever left is to make whole classes of bugs impossible rather than findable.

— Nodal Studio

Weston’s argument, formalised

Weston’s claim is that security controls are priced against an implicit cost-of-attack curve, and the curve has moved. Restated:

  • Let c be the attacker’s marginal cost to find and weaponise a vulnerability, and d the defender’s marginal cost to patch one.
  • Patch-and-detect is rational when c ≫ d: attackers find few bugs, defenders keep up.
  • Agentic discovery collapses c. Microsoft’s figure: $3.61 per PoC. Anthropic’s OpenBSD finding: <$20K total. d has not moved — it still needs a human to understand, fix, test and ship.
  • When c < d, patching faster cannot win. The only moves that change the equation reduce the number of patchable bugs rather than the time to patch: eliminate bug classes (memory safety), prove absence (formal verification), or collapse d toward c (automated remediation).

The MSRC volume figures — 9× March, doubling every six weeks — are consistent with that. So is the Glasswing ledger’s 202 fixes against 26,153 findings (see Twenty-six thousand findings, two hundred fixes): the same bottleneck, observed from the finder’s side rather than the defender’s. Weston’s own image for patch-and-detect under these conditions: bailing out a sinking boat with a thimble.

The economic case for memory safety when discovery cost → 0

The historical objection to rewriting in memory-safe languages has been cost: the rewrite is expensive, the bugs it prevents are rare, patching them is cheaper. Weston’s argument removes the second and third premises:

  • If memory-safety bugs are found at industrial rates, “rare” no longer holds.
  • If each one costs a full patch cycle while an attacker’s PoC costs $3.61, patching is not cheaper.
  • The rewrite cost is unchanged; what changed is the cost of not rewriting.

Two honest caveats:

  1. Memory safety eliminates one bug class. The wolfSSL certificate-validation flaw (see What Mythos actually found) is a logic error a memory-safe language would not have prevented. The share of severe bugs that are memory-safety bugs is historically high (≈60–70%) in C/C++ systems software, much lower in application code.
  2. Rewrites introduce new bugs. The transition period is a net increase in attack surface — and an agentic finder will find those too.

Does formal verification scale outside a kernel?

Formal verification has a track record in small, high-value components: seL4, CompCert, verified crypto primitives (HACL*, Fiat Crypto), parts of the AWS and Azure control planes. The common properties: a stable specification, a bounded codebase, and an owner willing to fund proof engineering at many times the cost of the code.

Arguments it is changing:

  • The same agentic capability that finds bugs can, in principle, write proofs; several labs have shown models producing machine-checked Lean or Coq proofs for non-trivial properties. If proof cost tracks discovery cost downward, the economics shift.
  • Property-based and bounded verification (model checking, bounded symbolic execution) sit between testing and full proof and apply more widely.

Arguments it does not:

  • Most software has no specification, stable or otherwise. Verifying a web app against a spec that changes weekly is a specification problem, not a proof problem.
  • Verified components are only as strong as the unverified code that calls them and the assumptions the proof makes about the environment. The Hugging Face agents broke no verified component — they used Artifactory as designed.

Realistic near-term scope: verified kernels, hypervisors, crypto, parsers for hostile input, and — the newest entry — the harness code between an agent and its tools (see Your agent framework is the attack surface). Everything else: memory safety and containment.

Shoshitaishvili’s contribution

Less quotable than Weston, arguably more useful for practitioners:

  • Skill relocation. The scarce human skill is no longer “can you find the bug” but “can you design the pipeline that finds, validates and ranks bugs without generating noise.” His three named factors distinguishing agents that increase impact from agents that increase volume: threat-model understanding, dataset judgment, and evaluation design.
  • Vulnerability-property-aware workflows. The kernel example: adding knowledge of what makes a finding a local privilege escalation (not just a crash) took the workflow from hundreds of candidates to well over a thousand actionable LPEs — an order-of-magnitude jump. Directional, not controlled; he said so explicitly.
  • Responsible handling as the limiting factor. The same observation as Twenty-six thousand findings, two hundred fixes, from the discovery side: the system’s capacity to absorb findings, not to produce them, sets the useful rate.

The WhoisXML API conference write-up captured the synthesis well: across the keynotes, “speed kept returning as a problem, while judgment kept returning as part of the answer.”

Conference statistics and context

  • 121 briefings; 35 directly relevant to AI security, red teaming or LLM-assisted offence.
  • Opening session (Tue 4 Aug), “Cyber Power in the Age of AI”: Sean Cairncross (National Cyber Director), Nick Andersen (CISA, acting), Brett Leatherman (FBI Cyber Division), Katherine Sutton (Department of War). Four senior US officials on the opening stage is itself a signal about where the agenda is set.
  • Also on the schedule and covered in this series: OpenAI’s Hugging Face debrief (see What happened at Hugging Face, and why OpenAI called it a warning shot); Novee’s coding-agent disclosure and the agent-framework talk (see Your agent framework is the attack surface); the CVE Program on automation (see Twenty-six thousand findings, two hundred fixes); a Rowhammer result against NVIDIA GPUs; a Forrester session on AI regulation (the subject of our 20 October article).

Sources

Back to the light read (2 min).

Related articles