Black Hat USA 2026 | Benny Czarny, OPSWAT

Clips
More from Black Hat USA 2026

Benny Czarny

CEO and Founder

OPSWAT

play_circle_outline Critical infrastructure risks from increased IT/OT interconnection

play_circle_outline AI-Driven Attacks Threaten OT: 99% Protection Fails When Downtime Is Not an Option

play_circle_outline Deep CDR: Deterministic File Regeneration Preventing AI Threats — Cybersecurity Upside Down

play_circle_outline Data Firewall: Intercepting and Regenerating File Flows with Phased Deployment and Channel Mapping

play_circle_outline Network segmentation and firewall misconfigurations limit OT visibility and protection

Info
Transcript

Benny Czarny, OPSWAT

Benny Czarny

CEO and Founder OPSWAT

This on-camera interview at Black Hat 2026 examines prevention-driven defenses and artificial intelligence, hereafter AI, borne threats to critical infrastructure. Benny Czarny of OPSWAT joins host Krista Case of theCUBE Research to discuss Deep Content Disarm and Reconstruction, hereafter Deep CDR, file regeneration, data-flow interception and strategies for protecting operational technology, hereafter OT, and other mission-critical systems.

Czarny draws on decades of experience protecting mission-critical systems to explain emergent AI-borne threats ... Read more

explore Keep Exploring

What are the security risks and operational challenges associated with increased interconnection and IT/OT integration in critical infrastructure? add

How are AI-driven threats changing the security of critical infrastructure, why is near‑perfect protection required, and how does the Deep CDR approach (described in Cybersecurity Upside Down) address those challenges? add

What is Deep CDR technology and how does it achieve prevention without relying on detection? add

How does the approach of intercepting and regenerating all file/data flows (a "data firewall" or content-disarm-and-reconstruct method) work, and what are the practical considerations and configuration options when implementing it in an organization? add

What is the recommended approach for investigating a potentially compromised workstation and for protecting operational technology/critical infrastructure (e.g., when transferring files or updating PLCs)? add

bolt Powered by CUBE AI

Benny Czarny, OPSWAT

search

Krista Case

>> Welcome back to theCUBE. We're live here at Black Hat 2026 at the Mandalay Bay. And over the next few minutes, we're gonna be talking about critical infrastructure. It's become more interconnected as organizations modernize their operations, think about enabling remote access, and really starting to integrate IT and OT systems. There's a lot of operational benefits to this, but there also is some inherent risk because it extends the attack surface. This is especially challenging when we think about OT systems because they can't be easily taken offline for things like investigation, immediate patching, or even rebooting after an incident. So these disruptions can have a very significant impact on physical operations and even public services and safety. I have the pleasure of sitting down right now with Benny Czarny. The CEO and founder of OPSWAT, and also the author of the USA Today bestseller Cybersecurity Upside Down, which just published in January.

Benny Czarny

>> Yeah. Yes, you got it right.

Krista Case

>> Yes. Thank you so much for joining us today.

Benny Czarny

>> Krista, thank you so much for having

Krista Case

>> me.

Benny Czarny

>> Such a pleasure and honor.

Krista Case

>> Thank you so much. So it's my pleasure because Benny, you've had a really tremendous career working with organizations to protect their critical infrastructure and helping them along this path. So I'd love to maybe start off by getting your take on what you're seeing has changed and maybe why that led you to write this book.

Benny Czarny

>> So, the major thing that is changing in critical infrastructure is AI-borne threats and AI-borne vulnerabilities. So it's like threats, vulnerabilities were always there, though AI makes everything super fast and super targeted.

Krista Case

>> Okay.

Benny Czarny

>> So yeah, so for 20 years I was building OPSWAT. Actually, initially I didn't start with critical infrastructure. The first big deal for OPSWAT was building cybersecurity language. And I would say 6 years ago, the focus was kind of, the book actually is covering some of this journey. Though whenever we look at critical infrastructure and how to protect critical infrastructure, then, critical infrastructures are very complex. The network is extremely complex and you can't really afford to have any downtime. 99% protection is not enough. Think about it, you run a nuclear facility or you run, you are in defense or you are in, you're running a very important financial service. So that 99% is not enough. So the uptime is extremely important here. The network is very, very complex. And one of the reasons that I decided to go and build, write the book Cybersecurity Upside Down, because it's all about a specific technology called Deep CDR that at least I believe is extremely effective to prevent AI-borne threats and AI-borne vulnerabilities. And the timeliness is key. And I think that's some of the reason that so many readers really enjoy reading this book, and I got really great reviews, is the timeliness of releasing this book with everything happening with Mythos and everything happening with AI-borne threats and leveraging LLMs to attack, to create malicious cybersecurity attacks on so many organizations.

Krista Case

>> I've had countless conversations so far here at the show, just in general, which is that, as you mentioned, AI is changing at a speed and scale that the malicious actors can act at. And so from the perspective of our enterprises and our organizations that are trying to defend against these attacks, it really closes that time to respond. So when we think about critical infrastructure, I can certainly see how prevention would be very critical. I also tend to think about the resilience end of things. So I want to maybe get your thought on why you think a prevention-driven approach is especially critical when it comes to these mission critical assets.

Benny Czarny

>> So maybe to provide more meat to what the Deep CDR technology is all about is, imagine that your entire cybersecurity strategy would be without detection. Can you really do that, right? So the answer is yes. The entire technology is Actually pretty simple. You achieve prevention through file regeneration, not through detection. So you assume that all of the files flowing to your organizations, they're all malicious. They either have a zero-day to go and attack your whatever users of whatever application it is, or it has a specific payload like a script or a macro that is there to go and take you down. And the entire technology is pretty much analyzing what type of file it is and then parsing through the file, then regenerating a new file that is malware-free because you are the generator. So it's pretty much, it's prevention through file regeneration. Extremely deterministic. Think about that. Now, as long as you are making sure that this entire process is fast and secure, so it's very deterministic. And that's achieving that goal of prevention and making it very effective to address our AI won't wreck issue.

Krista Case

>> So you're talking about this prevention-driven approach being very deterministic. Is there anything else you'd add concretely in terms of what this looks like in practice, from a practitioner looking at this type of an approach?

Benny Czarny

>> Yeah, I can go over that now. Obviously in the book I'm going way more into the details there. It's more about kind of, Imagine that you're creating more of the firewall of data. So I know that many companies are focusing on the network or focusing on the endpoint. Just think about your data flow to your organization. Imagine that you are intercepting all of your data flow from file downloads, file upload, USB insert, or peripheral media, SD cards, phones, email attachments. Okay, anything, storage, any file flow to your organization. You're intercepting everything. And after that, you are regenerating all of the file flow to and from your organization. Now, if you do that, you can eliminate so many threats. You're kind of increasing your cybersecurity posture. You are increasing your resilience significantly. the thing that in practice, whenever I'm taking it into practice is practicality, then the larger the organization, it takes longer to implement because they have so many data channels, and sometimes mapping the data channels is something key. Or sometimes we go over just intercepting data or files through just the networking, and after that we go to the file upload. Or sometimes we start with peripheral media and we go to other parts of the organization. So that's the practicality here. Another thing in practicality is that It's not an on or off technology. It's not like AVs, malicious or not malicious. You need to configure it. And the configuration, you need to just understand how to configure this file flow and how you want to regenerate the files. You want to regenerate for extreme security or to light security. There is some, I would say, a lever that we provide to IT. Obviously, we provide great defaults, though there's also a lever that we enable for the admins to configure to just further tune their cybersecurity and privacy posture throughout this process.

Krista Case

>> That makes a lot of sense. Thank you for painting that picture, Goldi. So definitely that makes sense, but to return to the threat model and say we probably need to assume that things are malicious. When we think about, I guess, maybe the potential malicious access points, we've spent a lot of time securing networks, But in an OT environment, there's a lot of USB drives, contractor laptops, things of that nature that might actually be the bigger points of exposure or vulnerability in the OT environment. So can you give your take on that? Have we maybe focused in the wrong area in terms of focusing on the network instead of service?

Benny Czarny

>> Yes, I think you mentioned several things and I like to put them in several different groups. So you mentioned peripheral media. So one of the key things, peripheral media, people think that peripheral media is just USBs. It's much more than USBs. It's SD cards, it's your phone, actually it's your laptop. Your laptop here could be considered as peripheral media, external drives. And so there are so many, so many types of peripheral media. And then the risk on peripheral media is far beyond just the content. Actually, there are multiple research papers on that, more than 29 different threats that are peripheral media-based. I'll make it easy for you, two different groups. One is content-based, like different types of, it's not only malware, it's hidden folders, it's autoruns, you have so many different drivers, you have so many content-based attacks that are peripheral media based. And then you have the device-based threats. Device-based threats could be devices that could be disguised as a peripheral media, though it's not. I can give you a charging cable that I can pretty much connect, oh, can you please charge it or send it to a critical network or to an OT environment and people can plug it in. However, it may be used as a networking sniffer device. It can be used as a remote connection. Another issue is USB killers can give 240 volts and then you're looking at a critical infrastructure like a water plant where it can create physical damage to the controller. And shut this facility down. So peripheral media is a very kind of loaded question. Actually, our platform provides a lot of solutions. My book is not about that, it's not about that, it's just about the CDR technology, though for that actually I'm producing a TV show. Actually, I'm right now putting that together on peripheral media. I don't want to lose that piece, though this is peripheral media threats whenever we go into OT network. Now, to truly protect against every attack vector, then we have a combination of both hardware-based solution and software-based solution. And by the way, CDR is a part of that, regenerating the file flow in, although it's not the only thing. So.

Krista Case

>> No, it makes sense. And I think we tend to

Benny Czarny

>> over—Yeah.

Krista Case

>> You know, you said, like you say, focus a lot on software and the things, but it says much on the fact that Your laptop could be a— I say that for inspection, these are the two.

Benny Czarny

>> Yeah, for that specific one, what I would say is that I wouldn't actually trust your operating system to provide the indication. I would actually shut your laptop down and scan it with an external device, actually mount your drive with an external device and analyze your disk when your machine is shut down. We do that too. And whenever we're looking into something, we want to go deep. And then you have definitely the file flow to the OT environment. You have, you're going to update the PLC in the OT or critical infrastructure environments, whether it's a water facility or whether it's an energy company or whether it's a banking. Everybody has ATM machinesin banking systems or they have other secure network, at least I'm aware of that,to do sensitive transactions. So you need to protect those as well. So yeah, and then whenever you're looking into this, what I do find is that many organizations also are segregating this network wrongly with a firewall, right? That is not 100% effective to prevent threats. It has either zero days or they always make mistakes configuring rules. so having that visibility is also a key thing protecting the OT. and on top of that, you have pretty much, you want to make sure that you have a full process to transfer files to and from your OT networks. I can go all day.

Krista Case

>> Well, it's an important topic. Yeah. We need people like you and companies like OPSWAT to be able to do that. So thank you for painting that picture. I'd like to also talk a little bit about the company. Benny, my understanding is that you bootstrapped it. Can you talk a little bit about some of the flexibility that's given you in terms of the investment decisions that you've made, maybe sort of how you've made it talking to a ton of customers and what they're struggling with? Maybe that might be a good place

Benny Czarny

>> to Thanks for the question. So it's a journey. bootstrapping a company is different than raising a lot. you need to be capital efficient all the time and you're building a DNA of the company to grow and to be capital efficient, to be disciplined about every decision that you make. So you need to pretty much, you can't really, you can make mistakes though, any mistake cannot be fatal, right? Because it's like, this is pretty much the lifeblood of the company. So very fortunate because again, the first kind of step to get to kind of the bootstrap was the first model of the company, the first I'd say 4 years of the company was an OEM business, and that's a great way to bootstrap a company because whenever you OEM, you can pretty much control costs. You don't have to invest in a lot of marketing, a lot of support team. You pretty much go with engineering and QA, and QA is pretty much your support layer. And then also your team is much smaller. So that gives you the foundation to go and do something bigger. And that is what I did. Also this leverage and ability to control the company direction and to control what we do is key. And then as we achieve scale, that enabled me to make bigger investments. So although the company is bootstrapped, it's never a— was never an amazing kind of cash flow business. It was always about leveraging and using the capital to grow the company to something much bigger. It's always about, let's make a huge impact on the industry. And I was very fortunate that I met with amazing team members that are still kind of staying with the company for many years. So there are people right now employed in the company that were on W-2 before I put myself on W-2. So, and that was kind of, I take that And so my HR philosophy was kind of like 3 honorable ways to leave the company. Option 1, you die. It's very sad, though it's honorable. Unfortunately, it happened at the company. Option 2, you retire. Honorable, right? Option 3, you open your own company. So you go, you found your own company. It's honorable. Maybe I'll invest in you, it's great. However, any other option, it's my personal failure.

Krista Case

>> That's fair.

Benny Czarny

>> I just want to know. I just want to know. I mean, it happens too. I'm not saying that I had a bunch of failures here and there though. That's my operating philosophy in terms of the HR and I think that the HR and focusing on the team also enable at least me to bootstrap a company. And we also been, we're very international, very fast. So I founded the company in San Francisco, California. And after that, later on, moved HQ to Tampa, Florida. Now we don't really have an HQ. I don't believe in HQ anymore because we have offices in several locations. We have Tampa office, we have a Jersey office, we have a UK office, we have a Hungary office, we have Romania office, we have a Saudi office, we have a UAE office, we have Israel office, Japanese office, Vietnamese office, Taiwanese office. Australian office, Singaporean office, so we have several kind of offices, so I don't want to go and say, oh, you are HQ. It's wrong, it's wrong in a mentality, sort of creating a collective, obviously there is the executive running the company, there is a management team that is very solid, though I don't like to define and say, this is HQ, I think it's not healthy for organizations.

Krista Case

>> So Benny, I guess maybe just if you had some parting words for the practitioners that are there at the show thinking about how to secure that critical infrastructure, I guess maybe where would you recommend they begin?

Benny Czarny

>> So several things. So number one, we have OPSWAT Academy. OPSWAT Academy, we are laser-focused on training IT and security practitioners to protect critical infrastructure. We have 288,000, maybe 289,000 already certified professionals, which is more than the population of Barbados. Very soon we'll exceed the population of Iceland. So think about that. It's a lot.

Krista Case

>> What do you think?

Benny Czarny

>> And the feedback I'm getting is excellent. I'm aware of folks that passed our certification and use that to get jobs at critical infrastructure facilities. That really warms my heart. I feel like I'm so proud of that. The second thing is also, I'm really big on videos and movies in terms of articulating anything. So there is a just launched production company called CyberKing Production. You can go to CyberKing and what we do is we make cybersecurity fun and exciting and visual. So, to a point that anybody can understand what is— Episode 1 is about Breaking the Firewall, but it's airing now on United. August 8th is going to be available on YouTube. Also follow me, you can follow me on my website or on LinkedIn to go and get some more data about it. So Episode 1 is about Breaking the Firewall, which is kind of myth-busting that the firewall is effective. It's not always effective. So we're explaining more than how to hack a firewall, how it happens. We also partnered with New Mexico Tech to make it really cool with fire and explosions and Kari Byron from MythBusters, she's the host and she's making it fun and exciting and interesting and engaging. So I'm doing that now. I'm in the midst of filming episode 2 and you'll see what it's all about. Spoiler alert, it's in episode 1. So. So, that's also happening, which is cool. And if you want, we'll get you some cool videos you can embed for the audience. So the audience can enjoy awesome explosions and fires and not just, so if they're sick of just kind of looking at us kind of talking for 15 minutes, they can watch that. TikTok is not for that. So we have that going as well. So it's a great way to get kind of that or You can also get my book. if you are here at Black Hat, you can get a free copy. It's also available on Amazon. There's also an audiobook available. So, also a Kindle and all of the rest of the versions. And if you attend one of our conferences, you can get a free copy.

Krista Case

>> Well, Benny, this has been a pleasure. Thank you so much. You heard it here first on Cybersecurity Upside Down. And keep an eye out for the videos and all of that. But like I say, thank you so much. We really appreciate you joining theCUBE.

Benny Czarny

>> Thanks so much. Thank you, Krista. Thank you.

Krista Case

>> And thank you all for watching. Don't go away. We'll be right back in just another couple minutes with more from Black Hat 2026.