Insights From Our Quick Vegas Residency

Black Hat USA 2023: Insights From Our Quick Vegas Residency

Black Hat has gone from being RSAC’s smaller tech and practitioner-focused cousin to being a industrial showcase for cybersecurity distributors. A tightly packed, noisy Enterprise Corridor included over 300 distributors and 400 organizations with cubicles, which was nice for swag however unhealthy for anybody with even the mildest case of claustrophobia.

Our band of Forrester analysts — Joseph Blankenship, Jess Burn, Allie Mellen, Tope Olufon, and Jeff Pollard — spent the week in Las Vegas with temperatures properly over 100 levels Fahrenheit …. exterior …. which is why we stayed inside as a lot as attainable. As Tope famous upon touchdown, “42 degrees Celsius should be illegal.”

Collectively, we logged over 160,000 steps, attending 80 consumer conferences and 20 observe periods. We left the occasion with these takeaways:

Safety Companies And SaaS Stood Out In The Enterprise Corridor

Everybody has a taste of managed detection and response (MDR), MXDR (it is a unhealthy time period; don’t use it), or a variant of *DR. We’ve mentioned the security services flywheel and “everything-eventually-becomes-a-service”; the cubicles at Black Hat 2023 confirmed this phenomenon in actual time. However only a few knew find out how to stand out and supply worth apart from claiming, “We’re the best.” Distributors and not using a higher solution to describe what they provide resurrected “single pane of glass (SPOG),” and “the everything everywhere dashboard” can be alive and kicking, however few distributors might articulate the precise worth that their dashboards displayed. Demos have been closely scripted with an outsized give attention to detection, conveniently forgetting that an “R” exists in MDR for a purpose. Response issues.

Some distributors demonstrated actual worth additions with just a few AI functions, however a well-written python script might deal with a lot of the use circumstances. As a ultimate tip for vendor sales space workers, be certain that the folks speaking about your product supply extra data than what will be discovered on Wikipedia.

The Cybersecurity Trade Stays Sturdy

After a yr of RIFs — in an business with an oft-mentioned expertise scarcity — and with distributors like Rapid7 saying one in the course of the occasion and Secureworks following on quickly after, the business is as wholesome as ever primarily based on the variety of distributors, cubicles, and attendees. Throughout the occasion, Rubrik and Verify Level introduced acquisitions, and Endor Labs introduced a $70 million sequence A. Whereas capital flowing into cybersecurity has slowed, innovation nonetheless occurs, and firms with robust enterprise fashions are conserving the eye of traders and prospects.

Generative AI Transitioned From Advertising To Demos

Distributors marketed generative AI at RSA. Distributors demonstrated it at Black Hat. Precise manufacturing deployments stay … laborious to seek out. Don’t count on common availability of those releases till the brand new yr for the overwhelming majority of distributors (if not all). Purposes have gotten extra numerous, now not restricted to safety operations use circumstances and broadening into utility safety and vulnerability administration.

Generative AI Fatigue Is Actual … And Irrelevant

Everybody — that’s safety leaders and distributors — is bored with generative AI. However that received’t make it go away. Enterprise adoption will improve, distributors might want to embed generative AI capabilities into their services and products, and we’ll all spend the following few years pondering and reacting to generative AI’s safety implications. The error to keep away from right here is letting that fatigue trick you into pondering these issues disappeared. Don’t get desensitized by the hype round this matter. In case you do, you’ll wind up enjoying catch-up, and that’s not an enviable place to be in for any senior govt.

Cyber Insurance coverage And You, Excellent Collectively?

Black Hat hosted a “cyber insurance microsummit” with 4 briefing periods discussing the subject from totally different angles — CISO, insurtech, authorized, and managed safety providers — however the identical message got here via. Your program and your coverage are actually inextricably linked. Continued insurability hinges on the way you reply to the more and more prescriptive necessities carriers place in your controls, processes, and your tech, primarily based on their digestion of their — now plentiful — claims information. Whereas ransomware stays a spotlight, the benefit and profitability of enterprise e-mail compromise and fraudulent funds switch can be on the rise and is much much less noisy than ransomware.

The Feds Swarmed The Stage, The Enterprise Corridor, And The Occasion

The times of “Spot the Fed” at Black Hat are over. They’re in every single place. The US authorities was out in power at Black Hat, nabbing two keynotes on the convention, one briefing session, and lots of sq. footage within the enterprise corridor. Representatives from six authorities or government-affiliated companies had spectacular sales space area, together with the Air Pressure Civilian Service, Cybersecurity and Infrastructure Safety Company (CISA), Los Alamos Nationwide Laboratory, NSA Cybersecurity Collaboration Middle, Sandia Nationwide Laboratories, and the USA Division of Justice.

DARPA took to the principle stage to announce its AI Cyber Challenge — a two-year competitors with the aim of making a brand new set of cybersecurity instruments designed to defend important software program and methods — and CISA and White Home leaders made the rounds at Defcon and SquadCon whereas in Vegas. This love-bombing at scale is a big a part of the administration’s need for and give attention to the tight public-private partnership wanted to guard the nation — and if somewhat recruiting occurred for stated federal companies, particularly with practitioners who might even see a authorities job as a safer guess than one within the risky safety tech business, properly, that might be a bonus.

Startup Competitors: Appsec All The Issues

The 4 finalists within the Black Hat Startup Highlight — Binarly, Endor Labs, Gomboc AI, and Mobb — all featured a barely totally different (however appsec- and DevSecOps-heavy) message. Regardless of every vendor working someplace totally different within the tech stack for potential shoppers, every centered on serving to builders discover and remediate software program, configuration, and coverage flaws inside the DevOps pipeline.

Regardless of All The Conferences, We Nonetheless Noticed Some Of The Briefings

Despite all of the consumer conferences, we nonetheless managed to attend among the Black Hat keynotes and briefings. For essentially the most half, we agreed that most of the periods have been extra “RSA-like” than we’ve come to count on for Black Hat briefings. As you would possibly count on, most of the periods centered closely on AI — its advantages in addition to methods it may be exploited for evil. See beneath for our favourite periods:

However Wait, There’s Extra!

These are just some of our Black Hat USA 2023 insights. To listen to extra about our collective Black Hat experiences, please be a part of us for a client-exclusive webinar, Get Insights From Black Hat Without Going To Vegason Tuesday, August 29, at 11 a.m. Japanese time. Forrester shoppers can register now!