Black Hat USA 2026 | Aaron Sant-Miller, Booz Allen Hamilton

Clips
More from Black Hat USA 2026

Aaron Sant-Miller

Booz Allen Hamilton

play_circle_outline Adversarial AI Threats and Brittle Model Guardrails Undermining Security Operations

play_circle_outline Counter-AI Deception: Exploiting Attacker Model Brittleness to Slow AI-Driven Kill Chains

play_circle_outline Adversarial machine learning examples and attacks

play_circle_outline Agent Councils Amplify Human Expertise and Stimulate Critical Thinking

Info
Transcript

Aaron Sant-Miller, Booz Allen Hamilton

Aaron Sant-Miller

Booz Allen Hamilton

In this interview from Black Hat 2026, Aaron Sant-Miller, vice president of AI at Booz Allen Hamilton Holding Corp., joins theCUBE's Krista Case to discuss how adversarial AI is reshaping the pace and economics of security operations. Sant-Miller explains why fully automated attacks now outrun traditional reactive detection models, giving attackers a first-mover advantage at machine speed. He details how Booz Allen is countering this with adversarial AI and deception techniques that confuse and degrade an attacker's reasoning engine, driving up their costs wh... Read more

explore Keep Exploring

How have recent advances in AI affected cybersecurity, and what vulnerabilities arise from current model guardrails and their adoption by defenders and attackers? add

How should organizations evolve their detection and response strategies to defend against AI-enabled attackers, and how can defenders use “counter‑AI” and deception techniques to disrupt attackers’ AI? add

What is adversarial machine learning, and how can defenders use it to disrupt or mitigate AI-driven attacks on their networks? add

How can AI and machine learning be effectively integrated into cybersecurity operations, and what role should humans play in validation, oversight, and decision-making? add

bolt Powered by CUBE AI

Aaron Sant-Miller, Booz Allen Hamilton

search

Krista Case

>> Hey, welcome back to theCUBE. This is our ongoing coverage of Black Hat 2026 live from the Mandalay Bay in Las Vegas. I'm Krista Case, and we've been having a lot of conversations over the last couple of days around this concept of adversarial AI and how security operations are really grappling with their ability to keep pace when it comes to moving from detection to response. they're potentially using AI to do things like accelerate their ability to analyze and investigate breaches and then also to accelerate their ability to respond. And in that conversation, the human element, that human expertise becomes really critical. We've got a really interesting conversation for you right now because we're going to get some perspective on sort of public sector entities and private sector companies and how they're kind of grappling with these decisions. Here to help me with that is Aaron Sant-Miller, VP and Cyber AI Lead for Booz Allen. Aaron, thanks so much for joining theCUBE.

Aaron Sant-Miller

>> Yeah, absolutely. Thanks for having me.

Krista Case

>> Absolutely. So Aaron, Booz Allen works with some of the largest both public and private sector companies. Where do you see their current security operations programs potentially beginning to fall behind when it comes to keeping pace with these adversarial AI threats?

Aaron Sant-Miller

>> Yeah, it's interesting. We've seen a truly massive amount of disruption over the last year. My background is more on the AI side, developed algorithms, trained models for most of my career, and I was maybe a little more skeptical of how AI would change things. And maybe 9 months ago, the way that things have changed now is pretty significant. At this point, everything feels a little upside down every day. I think when I compare both the private sector and the public sector, you get two separate sides of the coin. Everyone is trying to adopt new technology, figure out the ways to add it to existing workflows, improve their defenses. On the private sector side, there's much more agility in bringing in new technology. There's more flexibility in how things can be piloted. That's been really exciting. The pace at which we can go from a new idea to having something fielded to support the operations is very short. But on the other side, in the public sector, there's a lot more structure to the way that they think about cybersecurity. There's a lot more rigor to documentation and process. So in that way, it's a little bit easier to understand where we are today, what needs to change, where the bottlenecks are, how much information we can either distill or not distill. So it's been very interesting. There's a question of a little bit of the tortoise and the hare who wins the race. your takeaway is, if you always take the right step, but you don't move as fast, sometimes you end up, in a better place as a result.

Krista Case

>> Absolutely. I couldn't agree more, Aaron. And we're hearing a lot in terms of security operations teams, no matter what sector they operate in, they're trying to find this balance between having enough detection and guardrails in place, but then at the same time, not slow their organization's ability to adopt AI. So I'm curious if you're seeing that as

Aaron Sant-Miller

>> well.Yeah, it's a really interesting question. I would say over the last year we have seen a significant uptick in the capability of AI, not necessarily the same uptick in the security of AI. At the end of the day, a lot of the guardrails that are employed within a model and within a workflow, they look for specific content. They'll use a simpler method, a classifier that will say, I'm not supposed to talk about this content, or I am supposed to talk about that content. And that is a fairly robust process, but easy to break through. So we end up in this world that there are these guardrails, but they're fairly brittle. I think what we have seen on our side is that AI in and of itself, as both offensive and defensive folks increasingly rely on it, if the right guardrails aren't in place, it actually becomes a vulnerability for both sides of the equation, which makes for some really interesting questions around how cybersecurity is going to evolve over the next year.

Krista Case

>> That's interesting. So a vulnerability in terms of how our defenders are adopting, is that because it could potentially slow the pace of AI adoption?

Aaron Sant-Miller

>> Yeah,

Krista Case

>> it's—yeah.

Aaron Sant-Miller

>> Your AI models become an additional attack surface. And so if I'm an attacker, sometimes if I'm targeting an organization and they have everything hooked up to some big agentic workflows, I don't need to compromise every individual point. I can just compromise the model, get the model to do what I want. On the flip side, what we are seeing from a defensive perspective is as attackers adopt more AI, some of our best defenses actually exploit the fact that their use of AI introduces some vulnerability, it makes their methods and approach a little bit more vulnerable and brittle, which allows us defensively to buy more time for automated operations.

Krista Case

>> That makes sense. So Aaron, can you break down for us in a little bit more detail how organizations need to evolve the way they're detecting and responding to these attacks these days?

Aaron Sant-Miller

>> Yeah. Across cybersecurity for years, we've implemented a defensive workflow that is inherently reactive. I see an action, I see an alert, I investigate the alert, I automate response actions and that works really well when the attacker is a human that takes a significant amount of time to move through the kill chain and deliver an effect. The issue that we are running into now is that attackers have adopted AI throughout their entire process. They're using it to find new vulnerabilities, they're using it to develop exploits, and then they're using it to execute the full kill chain. That window of time that a traditional reactive method could deal with is no longer applicable. And so while we are seeing some significant gains in adding AI to the security operations center, to automated response, it's a losing battle if both sides are fully automated because the attacker chooses the time and the place of the attack. They have a first-mover advantage so they can deliver an effect at machine speed. And even if we're responding at machine speed, we're still behind. And so from the Booz Allen side, one of the things that we're thinking about is we need to buy more time in this ecosystem. We need to degrade the AI capability the attacker is using so that when we automate detection, we automate response, now we are able to move faster. And so we've been spending a lot of time researching various counter AI methods where when you combine counter AI methods and technology with deception technology, you actually can exploit the fact that AI models that are used by attackers are very literal. They're susceptible to running down a rabbit hole that you leave for them. And actually you can employ specific methods to disrupt the underlying reasoning engine. You can get the model confused. It won't know what is its infrastructure versus what's your infrastructure. And that opens a ton of doors for defenders and most importantly buys us time so that when we automate response, we now can move faster than they can because their AI capability is unreliable at this point.

Krista Case

>> That's really interesting, Aaron. So when you describe counter-AI, it's sort of the defenders using AI to potentially, influence or disrupt the attacker. Can you break this down a little bit more for us?

Aaron Sant-Miller

>> Exactly. So, writ large, there is this research area that's been around for a while called adversarial machine learning or adversarial AI. And really what that focuses on is how can I employ specific methods to make a machine learning or AI model tip over, fail at what it tries to do. Some of these have been highly publicized over the years. I think a few years ago everyone was talking about I can put a sticker on a stop sign and then computer vision algorithms will think it's a 45-mile-an-hour speed limit sign. So that type of thing, those still work from a cybersecurity perspective. So there are a lot of ways that we can exploit the underlying way that a mathematical model works to achieve certain objectives and goals that we want. And so in this case, what we are actually doing is we're using AI to research and optimize specific methods that we can employ on our network, the methods themselves are not actually AI-based, which is great for organizations because it's very cheap to run. But it can, when deployed out across your network, when somebody tries to attack you with an AI algorithm, the algorithm either ends up, burning up its tokens, or it gets lost and keeps going in a never-ending cycle, which drives up cost on the attacker, which is a great outcome if it's too expensive for them to continue to attack us. And then secondarily, we can do some really interesting things where based off the content it picks up, you actually manipulate the way the model thinks, the way the model perceives the environment it is in, and that allows you to redirect it in different ways, extract information about it. We can get fingerprints from the model that are really, really useful for cyber defenders moving forward.

Krista Case

>> And Aaron, you mentioned that this is not an AI capability itself. Can you talk about how Booz Allen is keeping pace with how the adversarial techniques are evolving? Because that's gonna be, I think, very dynamic and kind of just that speed and scale is unprecedented.

Aaron Sant-Miller

>> So yeah, if you build a good solution today, it is probably nearly irrelevant by tomorrow at the pace that things are moving. So what we do is we are constantly injecting best in class, the newest breakthroughs into our research environment. So a new model comes out, we add it in, a new harness comes out, we add it in, and then we are continuously using AI to auto-loop through that process and test different defenses against those models. So when there's a new breakthrough in the tools that an adversary can use, we have an automated process that will match that breakthrough with an update to our defenses. So when we think about the way that we want to employ counter-AI and deception technology and some of these methods, we want to get away from this idea that we are building a static product and providing a static product. We want to move toward this idea that you are getting a subscription to the new best-in-breed, best-in-class methods that we are continuously developing and producing, because the way that things are moving and the pace that things are moving right now, that's the only way to keep up with the adversary's capabilities.

Krista Case

>> Yep, yep, that makes sense, Aaron. Thank you. And I guess continuing to pull on this thread of defenders' use of AI, I know we started off the conversation talking about public versus private, and you were talking about public sector. Naturally, there's more guardrails, kind of red tape, right, in place. So when we think about strategically integrating pieces of AI into especially security operations and our ability to respond to these attacks, are you finding that, maybe private sector is a little bit ahead of public sector, or are you seeing any differences on that topic in particular?

Aaron Sant-Miller

>> Yeah, it's just different. I have worked in the public sector for a long time. I appreciate the structure that they bring to things. I may have one engagement where I go out and I say, where do you have gaps in your detection coverage? Where do you have blind spots? And a lot of our public sector customers have that answer ready. They have applied so much rigor to the way that they think about the process and documentation. That when I come in and I want to add AI in or I want to update the way that they defend their networks, that's all mapped out. It's well structured. In the private sector, because things move faster and because maybe there's a little bit less structure, you don't always have that clear line of sight into where you want to make enhancements. So both are adopting AI in really great ways. I think we're seeing some really interesting challenges as we just, I think, naively adopt AI into the security operations center. And so, each is kind of confronting their own challenges with that.

Krista Case

>> Yeah, yeah, no, that makes sense. And another question that I had, so you talked, Aaron, about the fact that because of this rigor, public sector organizations already sort of have a level of understanding and visibility. So I guess, could you talk to, is that driven largely by compliance? My thinking would be so, or is it kind of a natural byproduct of the fact that there is so much more scrutiny today on our security and resilience, strategies regardless of the industry that we're in.

Aaron Sant-Miller

>> Yeah, it's funny, the same thing that might slow the adoption of new technology because we have to do a full compliance review and a full security review also ensures you have good line of sight on the actual systems that you have employed. So I think everything is a little bit of a double-edged sword, but that's been very beneficial for us because we come in and we generally know what software is running where. A lot of what we are doing now is figuring out how we can update those processes to be more dynamic. So we might approve a certain system for deployment, but you're going to see drift in that system over time. Patches are going to roll out, new capabilities are going to be rolled out. So I can't rely on documentation that was created a year ago. I need to have some continuous way to monitor how that system has evolved organically over time to understand what the current state of vulnerability is. And as folks adopt more mature DevSecOps practices and we have some interesting capabilities that monitor what is running on the system, we can get a better, line of sight into what is running at any given point in time.

Krista Case

>> And that's an interesting point because one thing I'm trying to suss out is especially when you think about the visibility and the intelligence piece of things and then being able to act on that. Aaron, where do you think humans are going to really add expertise that's very critical moving, not just today, but moving forward? What are going to be some of the areas that humans are going to really have to bring that expertise to bear, even though they're still using these AI tools.

Aaron Sant-Miller

>> I've been doing AI for cyber for 11 years at Booz Allen, and I think we started using a phrase years ago that is still as relevant today as it was then, which is AI and machine learning, they're force multipliers for humans if you do it right. And so whether it's I'm going to use AI to scan for vulnerabilities and I need a human to validate that the identified vulnerabilities are actually relevant. Or do I need a human to construct the way that a model scans for vulnerabilities so that the right context is provided to the model so that it's not blindly operating through an ecosystem? From an alerting perspective, we're seeing huge gains in using agents and AI for initial alert triage. But then there's a question as to, I want the agent to triage some alerts, reduce false positives, but for the higher fidelity alerts and potentially worthwhile investigations, that's where we want a human to come in and actually drive some of that validation. Also, there are some really interesting ways that you can construct some of these AI deployments. We spend a lot of time implementing what we would describe as an agent council, where I have one AI model that's executing the process, then I have another AI model that's working in concert with it as a skeptic. So when model 1 comes to a conclusion, the other model presents all the things that disagree with that first model. And so the human, when they go and look at a result, they can say, Okay, you think this alert was a false positive, but why might it not be? And that actually ends up being a very effective process because it ensures the human is thinking about things the right way and getting a full picture of information.

Krista Case

>> That's really interesting, Aaron. So using AI, like you say, to kind of sense check and play devil's advocate there and almost be— so if I'm a human trying to make sense of this, I can also use AI as almost another peer to kind of bounce ideas off of.

Aaron Sant-Miller

>> Yeah, we need to use AI as a tool to facilitate critical thinking for the human.

Krista Case

>> Yes.

Aaron Sant-Miller

>> Not as a means of shrinking their cognitive analysis. And so I think a lot of folks are drawn to AI because I can ask a simple question and I can get a very direct response. And some people will say, that's great, I don't need to think about it further. But that's not always going to be the best outcome for operations, for the mission, for cybersecurity. And so we need to ensure when we implement AI capabilities, they're stimulants for human thinking, human reasoning, and they're useful tools and context for them to execute that investigation and operation.

Krista Case

>> I couldn't agree more, Aaron. So, if I'm a CISO here at Black Hat trying to navigate the deluge of not only all the vendor messaging, but just kind of what's happening internally in my organization to not only improve my detection, but improve my resilience, where might you recommend that they begin, maybe even starting next week?

Aaron Sant-Miller

>> Yeah, no, it's an interesting question. I think the first thing that I would encourage folks to think about is we are still to some degree dealing with the same problems that we've seen in the past with AI. Garbage in results in garbage out.

Krista Case

>> Yes.

Aaron Sant-Miller

>> And so a lot of folks are turning on AI capabilities within their security operations center without necessarily thinking through what data is going into the model. How can I filter that data to the right information? How can I enrich that data so I have the right behaviors already extracted? What ends up happening then, if I rely on the model to do all of the work, the net operating costs can be very high. And for some of the products and technologies they're adopting, the licensing price may seem cheap, but the token cost is a totally separate element. And so the total operating cost of the organization can be very high. That doesn't mean AI is bad. It just means we need to think about the right way that we are enabling AI. So I would encourage folks to go in and understand how the AI-based tool that somebody wants to add into their ecosystem and employ, how it's thinking about keeping costs low, how it's thinking about getting the right information to the model so you're not putting a disproportionate amount of burden on it. I've seen huge value in using AI as an enabler for a build process. So in many cases, I don't need agents to automate everything. Maybe I want agents to help me build automated workflows, and then those automated workflows can be deterministic. When they're deterministic, they're much cheaper, they're more efficient. the AI is a tool to enable the construction of those and the management of those over time., but the actual execution can be lighter weight and cheaper. So I think when you interact, when CISOs go in and they interact with some of these technologies, asking those types of questions can ensure they're making the right investments early as the ecosystem evolves over the next year or

Krista Case

>> two.So it's about getting my telemetry house in order from a data perspective, and then it's about really understanding these, cost versus benefit trade-offs in terms of how I'm using AI, if I might summarize that.

Aaron Sant-Miller

>> Exactly. we've seen a lot of folks start to add agents to the security operations center. Some of those organizations have done a really good job taking their data, deduplicating it, adding enrichments to ensure that the right behaviors are extracted from raw data. And then when I present really good behavioral analysis and alerting to agents in the SOC, I can get very significant gains at a much lower cost. If I'm just dumping all of my raw data into an AI model and saying, make sense of this, that's going to be more expensive. I'm going to have to run multiple models to sense-make. I'm going to have multiple agents working concurrently. And that can be very expensive to get the same outcome if I had just spent a little bit more time upfront fixing some of my data and analytics pipeline.

Krista Case

>> I agree. Well, thank you so much for sitting down with us here at theCUBE. Really appreciate it and hope you enjoy the rest of the

Aaron Sant-Miller

>> show.Yeah, absolutely. No, it's been a blast here. It's been busy, but it's a really exciting time to be in

Krista Case

>> cybersecurity.Yeah, there's a lot going on upstairs on the show floor, that's for sure.

Aaron Sant-Miller

>> 100%.Yeah.

Aaron Sant-Miller

>> Excellent.

Aaron Sant-Miller

>> Thank you very much.

Krista Case

>> Thank you. And thank you for joining us. Don't go away. We're going to be right back in just a couple of minutes here in theCUBE, live from Black Hat 2026.