In this analysis segment from Black Hat 2026 in Las Vegas, theCUBE Research's Krista Case and Jon Oltsik open theCUBE's coverage to break down how frontier AI models are compressing the response window for defenders and reshaping enterprise security strategy. Case and Oltsik discuss how threat intelligence and virtual patching are becoming essential tools for arming defenders against AI-accelerated attacks. Oltsik highlights cyber resilience as the intersection of technology and business, arguing that chief information security officers must understand core business processes and acceptable risk tradeoffs before resilience can be achieved. The pair also touches on how the crowded security tool market is consolidating into platforms, even as AI threatens to upend that model by turning static products into autonomous, reasoning-driven agents.

The conversation also explores what CISOs should look for when walking the Black Hat show floor, from vendor AI claims to integration and guardrail questions worth asking directly. Oltsik predicts a year of hard lessons ahead, including AI failures and "AI complacency," while stressing that skilled people, not automation alone, remain the differentiator. He identifies emerging roles such as AI penetration testers, red teamers and AI governance specialists as critical hires for security teams navigating this shift. Case and Oltsik also weigh the tension between improving AI security posture and building lasting governance guardrails. From identity's growing role in managing AI agents to the new skill sets defining tomorrow's security teams, the discussion offers a practical lens on where enterprise security is headed next.

In this interview from Black Hat 2026, Eric Foster, chief executive officer of TENEX.AI, joins theCUBE Research's Krista Case to discuss how artificial intelligence is compressing the timeline of cyberattacks and forcing security operations teams to adopt faster, more autonomous defenses. Foster explains why the security operations center has long been one of the most alert-driven and burned-out corners of the industry, and how AI is finally able to deliver outcomes that are faster, better and more cost-effective. He details TENEX.AI's approach to reviewing 100% of a customer's alerts and raw telemetry to a decision in under a minute, a stark contrast to an industry norm where 80% to 90% of alerts historically went uninvestigated. Foster also introduces "TENEX Turnkey," a guarantee that customers can be live and fully agentic within seven days.

The conversation also explores how TENEX.AI earns trust in a skeptical practitioner market by keeping humans firmly in the loop, orchestrating and validating AI-driven decisions rather than removing accountability from the process. Foster draws a comparison to Tesla's self-driving model over a fully autonomous Waymo approach, arguing that human pilots remain essential for verification and trust. He points to the recent Chaindrop supply chain attack as proof, noting TENEX.AI detected the compromised package within two minutes and alerted maintainers within 11 minutes, protecting customers from a breach that affected millions. Pushing back against AI doomerism, Foster argues the technology will create more security jobs, not fewer, as AI-augmented practitioners become dramatically more productive. From rethinking SOC operations to redefining what enterprise trust in AI looks like, Foster makes the case that human expertise and artificial intelligence together are the only way to keep pace with modern attackers.

In this interview from Black Hat 2026, Suzy Pallett, president at Black Hat, joins theCUBE's Krista Case to discuss how the conference is evolving to keep pace with an accelerating threat landscape shaped by artificial intelligence. Pallett explains why Black Hat has shifted from reacting to periodic vulnerabilities toward fostering real-time collaboration, noting that exploits now surface in seconds rather than weeks. She underscores the value of peer-reviewed research, describing how Black Hat's independent review board ensures that only findings with genuine industry impact reach the stage, sparking further conversations and collective problem-solving among practitioners.

The conversation also explores Black Hat's Global Startup Spotlight competition, a new initiative giving emerging cybersecurity companies a neutral platform for recognition and peer credibility. Pallett highlights how most of these startups are building AI-driven solutions for both defense and offense, reflecting the industry's rapidly compressing innovation cycles. She touches on the networking infrastructure built into the event, from summits to hands-on labs, designed to help practitioners connect beyond formal sessions. Pallett closes with a broader reflection on community, noting that her hope is for attendees to leave Black Hat not just with technical takeaways, but with a peer network they can lean on well after the show ends in Las Vegas.

In this interview from Black Hat 2026, Derek Manky, chief security strategist and global vice president of Threat Intelligence at Fortinet FortiGuard Labs, joins theCUBE's Krista Case to discuss how the fight against cybercrime is evolving as AI accelerates attacks and threat actors collaborate across borders. Manky details Fortinet's new Cybercrime Bounty Program, built with Crime Stoppers International to bring trusted, anonymous human intelligence into threat investigations. He explains how the program's first operation, Operation Silent Vector 1, targets ransomware by fusing crowdsourced tips with Fortinet's own telemetry before handing verified leads to law enforcement.

The conversation also explores how AI is reshaping the threat landscape, with Manky describing "shadow agents" that now blur the line between human and automated attackers, compressing the window of attack to under 20 hours. He highlights the Cybercrime Atlas initiative, a volunteer-driven effort that has contributed to more than 2,000 arrests and about $200 million recovered for victims through partnerships with INTERPOL. Manky warns of "converged crime," where cybercrime increasingly intersects with human trafficking and narcotics, raising the stakes beyond data and ransom. He underscores why accountability must extend beyond kingpins to affiliates profiting from ransomware-as-a-service, arguing that visibility and deterrence are essential to shrinking cybercrime's footprint. From anonymous tip lines to global law enforcement operations, Manky lays out a roadmap for building a more resilient, accountable cybersecurity ecosystem.

In this interview from Black Hat 2026, Robin Braun, vice president of AI business development and hybrid cloud at Hewlett Packard Enterprise, joins Ian Williamson, senior vice president of global alliances and partner sales at BigID, and Patrick Conte, chief revenue officer at Fortanix, to talk with theCUBE's Krista Case about building trusted data foundations for enterprise AI. Braun explains why organizations moving AI from pilot to production need confidence in their data, tracking where it lives, how it's protected and whether it can be trusted. Williamson details how BigID uncovers shadow AI and rogue models by scanning for sensitive data and enforcing access governance across human and non-human users. Conte outlines how Fortanix protects data at rest and in use through encrypted memory, closing the gap between discovery and true end-to-end protection.

The conversation also explores how enterprises are striking a balance between AI innovation and governance, with Braun cautioning against unintended consequences such as runaway token costs or unsanctioned agent actions. Williamson highlights how data lifecycle management reduces redundant and obsolete information, cutting costs while improving model accuracy. Conte breaks down "composite attestation," a method for verifying that CPUs, GPUs and workloads remain untampered throughout an AI job. The panel also details how HPE's Unleash AI program integrates confidential computing, data discovery and orchestration partners into a single validated stack, building on the Private Cloud AI platform developed with NVIDIA. From avoiding do-it-yourself guardrail projects to piloting AI on-premises to keep sensitive data close to models, the group offers practical steps for practitioners looking to move from experimentation to trusted, production-ready AI deployments.

In this interview from Black Hat 2026, Art Gilliland, chief executive officer of Delinea, joins theCUBE's Krista Case to discuss how AI agents are forcing enterprises to rethink identity and privilege management as autonomous systems become operational actors within the business. Gilliland shares findings from Delinea's research of 2,000 IT professionals, revealing a "confidence paradox" where organizations claim readiness for AI while lacking the tools to actually govern agents. He explains why traditional identity models built for humans and machines break down with AI, since agents spin up, act and disappear within minutes. Gilliland outlines Delinea's shift toward runtime authorization, protecting critical assets rather than chasing every ephemeral agent identity.

The conversation explores just-in-time access as a natural fit for AI, eliminating the standing privileges that leave credentials exposed to compromise. Gilliland notes how AI's non-deterministic behavior — willing to chain together vulnerabilities or scan files to elevate access — makes continuous, action-level authorization essential rather than one-time front-door checks. He details the growing importance of traceability and auditability, arguing that logging agent behavior is no longer just a security requirement but a business operations necessity. Gilliland also predicts that AI security will drive renewed focus on human identity, particularly for developers who resist traditional credential workflows. From reducing end-user friction to embedding permissions invisibly into existing workflows, he offers practical guidance for security teams looking to balance speed with control in the AI era.

This on-camera interview at Black Hat 2026 examines prevention-driven defenses and artificial intelligence, hereafter AI, borne threats to critical infrastructure. Benny Czarny of OPSWAT joins host Krista Case of theCUBE Research to discuss Deep Content Disarm and Reconstruction, hereafter Deep CDR, file regeneration, data-flow interception and strategies for protecting operational technology, hereafter OT, and other mission-critical systems.

Czarny draws on decades of experience protecting mission-critical systems to explain emergent AI-borne threats and practical defenses. They describe a prevention-first posture based on deterministic file regeneration that intercepts and regenerates every file flow to mitigate AI-accelerated attacks. Czarny highlights peripheral media risks such as USB devices, phones and chargers and emphasizes the need for combined hardware and software controls. Case guides discussion of OT resilience and visibility challenges and outlines phased deployment strategies and practitioner training via OPSWAT Academy.

Key takeaways include prioritizing prevention through deterministic file regeneration, defending against AI-accelerated attacks, controlling peripheral media exposure and balancing implementation tradeoffs for large organizations. The conversation addresses Deep CDR file-regeneration, data-flow interception, OT exposure points and practical measures to strengthen cybersecurity for critical infrastructure.

Watch to learn technical and organizational factors to consider when securing critical infrastructure, including AI threat modeling, Deep CDR deployment, peripheral media controls and practitioner training pathways.

In this interview from Black Hat 2026, Joe Hladik, head of Zero Labs at Rubrik, joins theCUBE's Krista Case to discuss a newly discovered AI vulnerability that allowed researchers to break out of Microsoft Copilot's sandbox and reach backend Azure infrastructure. Hladik explains why Rubrik Zero Labs prioritizes backup data as an intelligence source, treating it as an untapped signal alongside traditional endpoint and network telemetry. He details how the team discovered the flaw in February, followed responsible disclosure with Microsoft and confirmed a patch by mid-March, while noting the underlying exploit technique could resurface in other AI copilots. Hladik also touches on similar vulnerabilities found in AI orchestration platforms, including Langflow and ChatMate, underscoring how quickly AI tooling is expanding the enterprise attack surface.

The conversation also explores why AI excels at the "science" of a problem but struggles with the tradecraft and creativity attackers bring, making the combination of skilled humans and powerful models the real danger. Hladik breaks down the observability challenge facing defenders, arguing that logs alone aren't enough — security teams must build their own baselines of normal AI agent behavior to spot abnormal activity. He shares a CISO's framework for prioritizing vulnerabilities based on existing security layers rather than treating every finding as critical, and revisits fundamentals like maintaining and actively using a software bill of materials. Hladik provides a practical roadmap for security leaders navigating an AI threat landscape that is evolving faster than detection tools can keep pace.

In this interview from Black Hat 2026, Dev Rishi, general manager of AI at Rubrik, joins theCUBE's Krista Case to discuss the new guardrails enterprises need as AI agents move from experimentation into production. Rishi defines agents as models with access to tools, distinguishing them from earlier chatbots by their ability to take real action inside enterprise systems. He explains why traditional identity stacks fall short, since agents can hold legitimate permissions across multiple systems yet lack the human judgment to avoid combining them into risky outcomes, such as leaking sensitive Salesforce data through an email.

The conversation also explores how Rubrik built SAGE, a Semantic AI Governance Engine, to keep humans in the loop without slowing agents down, using a small language model trained on cybersecurity judgment to approve, block or escalate actions in real time. Rishi shares how observability uncovered concrete risks inside Rubrik's own deployment, including code-exfiltration attempts and runaway spend, where 1% of sessions drove 40% of total cost. He also details Rubrik's Agent Identity capability, which layers fine-grained, deterministic policies on top of that intelligent oversight. Rishi ties this back to the company's resilience roots, arguing that recovery time must now match the speed of AI-driven attacks, with observability data feeding directly into backup and recovery systems. From visibility and control to remediation, he outlines a practical framework practitioners can use to navigate agentic AI security today.

In this interview from Black Hat 2026, Ramin Farassat, chief product officer of Menlo Security, joins theCUBE's Krista Case to discuss how enterprises can secure AI agents as they gain access to sensitive data and take autonomous action. Farassat introduces Menlo Agent Runtime Security (MARS), built to monitor agents end-to-end as they perform tasks. He explains why agents can be "gullible," easily fooled by prompt injection into treating malicious commands as legitimate data, and why orchestration-layer enforcement must happen in real time rather than defensively.

The conversation explores the tension between enterprises racing to adopt AI and security teams needing sufficient guardrails without slowing that pace. Farassat details how MARS applies policy-based controls, real-time data masking and full visibility into agent actions, while preserving a human-in-the-loop for oversight, notifications and intervention when tasks require it. He touches on the emerging concept of "shadow agents," the need for continuous logging to satisfy regulatory demands, and practical starting points for chief information security officers, from securing browser sidebars to development assistants and, ultimately, autonomous agents. From registering agents before they act to applying pre-built policy templates, Farassat outlines a pragmatic path for organizations to scale AI adoption without losing control.

In this interview from Black Hat 2026 in Las Vegas, Christy Wyatt, president and chief executive officer of Absolute Security, joins theCUBE's Krista Case to discuss why cyber resilience is becoming as critical as prevention in an era of AI-accelerated attacks. Wyatt reveals new research surveying 1,000 chief information security officers, finding that the average cost of one hour of downtime reaches $19 million, yet only 4% of practitioners feel truly prepared to recover. She explains how AI is simultaneously accelerating attackers' ability to chain vulnerabilities and expanding the complexity, and therefore fragility, of enterprise environments.

The conversation also explores how the CISO role is evolving beyond prevention and detection to include ownership of recovery and business continuity, requiring closer collaboration with the CFO, CIO and board. Wyatt underscores the importance of rehearsing full recovery scenarios rather than stopping at containment, noting that many organizations never practice the hardest part: restoring operations at scale. She details Absolute Security's Persistence capability, a firmware-embedded resilience layer built into devices from 28 PC manufacturers that enables remote healing and rapid device restoration. From boardroom conversations about worst-case scenarios to the discipline of rehearsing recovery again and again, Wyatt offers a practical framework for organizations seeking genuine cyber resilience rather than simply adding more tools.

In this interview from Black Hat 2026, Anthony James, senior vice president of product marketing at Fortinet, joins theCUBE's Krista Case and Jon Oltsik to discuss how enterprises are consolidating fragmented security architectures to keep pace with AI-driven threats. James, who returned to Fortinet after helping shape its early platform strategy, traces the industry's shift from point products toward unified platforms built for operational simplicity. He details how the Fortinet Security Fabric ties networking and security together through consistent data and policy, and how new tools like FortiSOC help practitioners cut through alert overload to prioritize the threats that matter most to business risk.

The conversation also explores Fortinet's SASE firewall strategy, which extends the same consolidation logic that once unified firewall, VPN and SD-WAN into a single architecture spanning on-premises and cloud environments. James highlights how sovereignty, agentic AI and quantum readiness are reshaping this market into something far broader than SASE and next-generation firewall alone. He unpacks how enterprises moving AI from experimentation into production need governance over internal AI factories, agents and MCP servers, along with strong identity controls to prevent adversaries from exploiting agentic infrastructure. Looking ahead, James outlines a near-term future where internally built AI applications drive productivity gains — and a corresponding surge in security investment to protect them.