Black Hat USA 2026 | Christy Wyatt, Absolute Security

Clips
More from Black Hat USA 2026

Christy Wyatt

President & CEO

Absolute Security

play_circle_outline Resilience vs Security: Snapping Back While AI Speeds Vulnerability Discovery and Chained Attacks

play_circle_outline CISO as Risk Arbiter: Cross-Functional Resilience with IT, CFO, CEO, GC, and Board

play_circle_outline Downtime cost research: average $19 million per hour across surveyed companies

play_circle_outline Investment rebalancing toward resilience, recovery, and agentic AI for faster response

play_circle_outline Endpoint resilience: device persistence, remote rebuilds, restoring users quickly

Info
Transcript

Christy Wyatt, Absolute Security

Christy Wyatt

President & CEO Absolute Security

In this interview from Black Hat 2026 in Las Vegas, Christy Wyatt, president and chief executive officer of Absolute Security, joins theCUBE's Krista Case to discuss why cyber resilience is becoming as critical as prevention in an era of AI-accelerated attacks. Wyatt reveals new research surveying 1,000 chief information security officers, finding that the average cost of one hour of downtime reaches $19 million, yet only 4% of practitioners feel truly prepared to recover. She explains how AI is simultaneously accelerating attackers' ability to chain vulnerab... Read more

explore Keep Exploring

What does "resilience" mean for an organization in cybersecurity, and how should organizations approach it given that defenses—including AI—won't be perfect? add

To what extent are CISOs expected to be responsible for actual recovery and for restoring business operations (business continuity/operational resilience) after a cybersecurity incident? add

What were the most notable findings from your survey of 1,000 CISOs—particularly regarding the cost of an hour of downtime and how ready organizations feel to recover from incidents? add

Will cybersecurity budgets increase or be reallocated because of AI-driven threats, and which areas (prevention, detection, response, resilience/recovery) will see the most investment? add

What is endpoint resilience, why is it important for reducing user downtime, and how can a built‑in Persistence capability on endpoint hardware enable automated healing and rapid recovery (e.g., remote bare‑metal reinstall and on‑device remediation)? add

bolt Powered by CUBE AI

Christy Wyatt, Absolute Security

search

Krista Case

>> Welcome back to theCUBE. This is Krista Case, and we're live here at the Mandalay Bay in Las Vegas for Black Hat 2026. And one thing that's really interesting is this is a cybersecurity show filled with cybersecurity practitioners, but we're hearing a lot about resilience these days. And really it's kind of the other end of the spectrum of security. And we need to have kind of this continuum of security through resilience these days. That's because there's a recognition that even highly mature security programs are going to experience some level of disruption. And from a business perspective, the tolerance to accept things like downtime and operational impact is unfortunately next to nothing these days. We need to get back up and running as quickly as possible. One thing that we're hearing is that that shift is actually changing the role of the CISO. They're becoming these arbiters of decisions around risk, and they're balancing investments across not only prevention and detection and kind of the ability to respond, but also the resilience end of things to be able to keep those critical business services up and running. I'm sitting down here with Christy Wyatt, who's the president and CEO of Absolute Security, to talk a little bit more about that. Christy, welcome to theCUBE. Thanks so much for joining us.

Krista Case

>> Thanks for having me.

Krista Case

>> Yeah, really appreciate it. So again, I really am seeing that— I know we've had conversations about this— cyber resilience is no longer just kind of an outcome of good security practices, and we're seeing that organizations are starting to make deliberate investments to improve their cyber resilience because they recognize that that disruption is inevitable. Can you talk maybe a little bit from your perspective what you've seen change over the last few years that's driving that shift?

Christy Wyatt

>> Well, first of all, it's a shift that we welcome. I think that for a long time, organizations did view overall resilience as a part of cyber security, both from a practitioner's perspective as well as from a funding and investment perspective. And I think that's a pretty critical mistake. I think that, you know, the— what happens when some form of disruption, could be cyber disruption, could be IT disruption, could be natural disaster, is really that the organization can no longer function. And that concept of downtime is really kind of the biggest driver of impact on the organization. We actually just published some research this morning that was talking about the breakout of spend between cybersecurity and cyber resilience. And for the first time, we actually saw them start to get closer together. Now I'm a little cautious because as I walk around the show floor here at Black Hat, I still see a lot of people using the term cyber resilience when what they still really mean is prevention and detection. But I'm optimistic that we're actually seeing it called out. And I think that's a result of just a lot of the disruption that we've all lived through over the past couple of years and the acknowledgement that AI is coming. And it is having a significant impact on our ability and our confidence in our ability to keep the lights on.

Krista Case

>> Absolutely. I know a big headline of the show is the adversarial use of AI and how that's greatly accelerating the speed and scale of attacks and that as a result, organizations have a limited window to respond. So you mentioned kind of the definition of cyber resilience. And Christy, I've run through this and run into this as well. I kind of look at it also as a bit of a spectrum. We have kind of our, you know, pre-attack capabilities that can improve our resilience, but also our post-attack that really dig into the ability to, again, get back up and running and kind of survive that disruption. How would you define cyber resilience?

Christy Wyatt

>> We really think of it as, by definition, the term resilience means to snap back. So I think of it in terms of the organization's ability to snap back. Now, when we think about products, we break it down much more in a fine-grained way, right? We think about how do we keep your applications healthy when they fail? How do we keep your network connection healthy when it becomes compromised? How do we rebuild the device if that becomes compromised? But ultimately the ultimate metric that we're going for is how do we keep business operating, right? How do we get you back up and running as quickly as possible? And I think even here at Black Hat, we hear a lot of conversation about how AI is accelerating the discovery of vulnerabilities and how bad actors can chain these together and come up with novel attacks. And then we hear that the counter to that being using AI in detection and prevention. I still think that we don't acknowledge as broadly that we're not going to get it perfect, right? No matter what organization, and I don't care how well-funded you are, you will not hit 100%. You can't. And I think that while the tools are making us more effective in remediating or sort of shutting down these attacks, you have to assume that for one reason or another, a bad day is going to come. And I think that is the conversation around resilience. So whether it is propping up your security controls or boosting your compliance, your connectivity, or really putting the pieces back together when things have gone completely off the rails, the metric we should be focused on is downtime. How do we get ourselves back up and online?

Krista Case

>> Yeah, I agree, Christy. And it is interesting, like you say, we're here at Black Hat. We have this very heavily practitioner-driven audience. Christy, you and I have been trying to dig into the role of the CISO and how they're thinking about their role as these requirements are starting to change and that need for the business uptime. I actually had the privilege of sitting down with your CISO yesterday, Harold, and we were talking about this and him and a couple others actually, and the common feedback among security leaders has been, it's not so much that we're able to prevent every attack anymore. It's about how can we again recover as quickly as possible? So I'd be curious your perspective on how that's changing the role and expectations for CISOs. I think that would be very relevant to this audience here.

Christy Wyatt

>> I think it's nice to see because I, for a long time when I would talk to CISOs and I would say, let's just assume for a moment the bad thing happened and you've contained it, it's no longer propagating or whatever the behavior was. Now what happens? And there was this kind of hand gesture like the tech people would take care of it, right? So IT or some magical tech fairies would come in and put the pieces back together. We did the same research we published this morning. We were actually asking about 1,000 CISOs whether they were involved in or responsible for actual recovery and putting the organization back together. And I was actually pleasantly surprised to see how many more have said yes, that they are actually responsible for it. So I don't know whether it is a shifting so much as a combining. I think that in order for an organization to really truly look at business continuity and operational resilience, it really has to be a team sport. So the cybersecurity leader absolutely plays a critical role, as does IT, as does the CFO, as does the CEO. I think the GC, I think all around the table, everybody kind of owns their part. And when we think about how do we rehearse for those moments, I think that's equally important is that you bring all of those stakeholders together and you step through who's going to be doing what at what moment in time. It is not a cybersecurity problem. I think part of the confusion is that when the Wall Street Journal or the New York Times or whatever article gets written because your organization was the one that was compromised, it gets labeled as ABC Co. was down for 3 months because of a cyber breach. The detail below the headline is they were down for maybe a day or 2 for a cyber breach, and then they had a really long tail of cleanup and putting their business back together.

Krista Case

>> Absolutely. And that's why these security incidents are actually becoming, business continuity issues, not just security incidents.

Christy Wyatt

>> Right. And so the right conversation at the boardroom and with the senior management team is not, have you rehearsed for a cyber event? But have you rehearsed your overall resilience? Have you asked yourself what would happen if 60% of your endpoint devices got wiped out tomorrow morning? Or if all of a sudden your network could not communicate and you could not connect your people, would they know what to do and would you know how to get back from there?

Krista Case

>> Absolutely. And what role does the CISO play in those conversations? Is the CISO the one that has to sort of advocate for that from your perspective?

Christy Wyatt

>> I think the CISO has to be a champion because while it's not a guarantee that the business disruption will come from a cyber event, there is a high probability that they will experience some kind of a cyber event during their tenure, statistics would say. But I think that they need partners. I wrote an article a few months ago talking about how do we translate this into the language for the CFO? How do we start to quantify the investments we need to make against the financial cost to an organization that hasn't been able to offset that risk? Because I think ultimately it is wrong to think about this as just more cyber protection, and it is wrong to think about this as insurance. Insurance can only go so far. This really is about driving value down to the bottom line.

Krista Case

>> And that's a great segue into your research. And by the way, I completely agree. I think understanding the dollars and cents in terms of the cost of downtime is very important. And I know your latest research, it put a cost to this. You were mentioning it a moment or two ago. Can you talk a little bit about that research, what it found, and maybe what stood out, especially for those who are struggling with navigating how they establish this resilience?

Christy Wyatt

>> Two things jumped off the page. I think the first is the cost of one hour of downtime. If we took across the— we had 1,000 CISOs participate in the survey— $19 million an hour. That's a crazy number. $19 million an hour is what the average was across that community. So if we want to talk about how do we minimize downtime, we can put a dollar amount on it. And I think we've worked with customers to try to put together calculators or estimate. It's going to be different for every business.

Christy Wyatt

>> Yes

Christy Wyatt

>> . That's for companies that can measure the value of downtime. Again, we've talked about small business before. Small business isn't really going to be measuring it in hours. I think small business sometimes fails to recover at all, right? I think the statistic is 1 in 5 small businesses will just not recover when they get hit by an event. I think the other interesting thing that we learned is that while I think it was north of 80% of practitioners said that they had a responsibility for it and were making investments, only 4% felt like they were ready. 4%. So, again, there may be some mixing of terminology, but I think that that's not wildly wrong. I think that we're all feeling a little uncertain with how much is changing in the technology. AI is adding new technology. We're adding new controls to manage, which means the stack is getting higher. with complexity comes fragility. So, I don't think we should be surprised by it, but I think we should pay attention to it.

Krista Case

>> Absolutely. And I think you're hitting on a really important point, which is how fragile enterprise environments are these days. And I do think that eyes are starting to be opened a little bit to that. So you talked about the $19 million an hour in downtime. Are you seeing that that's actually translating into increased appetite to spend? It sounds like yes. you mentioned that companies are spending, but they still realize that there's a ways to go. I'm just curious in terms of if you're seeing correlation.

Christy Wyatt

>> I don't have enough data to know whether it's incremental spend or whether it is a shift of investment. I do think what we will see happening right now is a rebalancing of investment even within prevention and detection to think about traditional approaches to some more modern approaches given the advance of AI. And then the response and remediation. And I think we are very much advocates of pushing that investment onto resilience and recovery as well. Right. So I think that there is a huge argument to be made for how not just sort of embedded capabilities like the kinds of things that we do, but also applying agentic AI and more intelligence to those products allows you to respond. you can't have a dislocation of timing, right? If the bad actors are getting access to real-time vulnerabilities and can chain these together and accelerate their attacks, it cannot take us days, weeks, or months, right, to respond, to shut it down. And I think that's a lot of what the conversation this week is about here at Black Hat. But then equally, we can't take days, weeks, or months to actually put the business back together either. And so we need to be able to think about using these tools in each one of those phases.

Krista Case

>> So tactically speaking, what separates the organizations that are able to recover quickly these days versus the ones that are not able to from your perspective?

Christy Wyatt

>> I just think it's practice. I think that it's, because oftentimes what we see is not the, really sophisticated things that trip folks up. It's that they did their tabletop exercise and they got to the part where the infection was contained and they knew how to remediate it and they knew what the patch was and off they go, right? I don't think that a lot of organizations yet play it all the way to the end of the tape where they say, okay, but you have 5,000 devices that are still down out in the world right now. How do you get back online? And do you understand what your minimum viable operations are? Do those people know what they're supposed to do and where they're supposed to go and how they're supposed to communicate with one another? Do you understand how you would roll this across the organization? So it's just muscle memory. And I think that we, as the landscape around us has changed, we have to go back and pull out those playbooks and rewrite them and then rehearse, rehearse, rehearse. And I think that that's a catalyst for that. What I would add though, is really the business leaders and the board participating in that conversation.

Krista Case

>> It needs to come from the top down.

Christy Wyatt

>> It really does. And I think that there are a lot of boards that are very active in the cyber conversation. So they want to know what is our posture, what is our risk appetite? And I think we've done a pretty effective job over the years of getting boards to cyber fluency. But this is a— this is the next step, right? The next step is, okay, so whether it's cyber or anything else that took us down, run me through a scenario where the data center just went dark. How do we take orders? How do we pay people? How do we do operations? How do we— like, step me through that. And I think that's a level of visibility that we haven't necessarily had to have in the board conversation before, but we probably should go back and revisit just given how much has changed.

Krista Case

>> And are you seeing amongst your peers— obviously you're the CEO of Absolute Security— are you seeing amongst other peers with a similar title that there is this recognition that they need to start working with their teams to understand what those minimal viable operations are? Because I agree, I think that's a critical piece of the resilience conversation.

Christy Wyatt

>> I do think that you're seeing an increased awareness from— now, again, I think it can come from a variety of different directions. It could be coming from the CIO, from the CISO, from the CEO, from the CFO who's saying, how am I going to have to explain to investors what happened if all of a sudden everything went dark? So I think the catalyst could come from a variety of different directions. But I do see an awareness. I think the CrowdStrike event was kind of a wake-up moment, but we've had many of them since then.

Krista Case

>> Ransomware, and a lot of ransomware has continued to grow.

Christy Wyatt

>> I think the AI breakthroughs that we've seen over the past couple of months, quantum's just around the corner. We could go on. So I do think that there is absolutely a recognition that this is a timely conversation.

Krista Case

>> I agree. I think you were referencing, I think, kind of the Hugging Face, where it was able to chain these different vulnerabilities together and gain access. So I agree. I think as we experience incidents like that, it does open eyes, and like you say, the CrowdStrike incident a couple of years ago, that was not a security incident. No, that was an issue of downtime and continuity. Right.

Christy Wyatt

>> Right. And we're, maybe because of our background in our industry, we're very much trained to think that every major disruption an enterprise could face would be as a result of a cyber event or a bad actor. But I just, I don't know that I think, I think the fragility is probably as much of a risk. How many technologies are being interwoven and how many new things are being tried all simultaneously in every part of the business. And so it doesn't have to be intentional. It could just frankly be, you know, somebody's racing to keep up with all of the patches that are getting fired at them from all different directions and every vendor. And one was bad. It wasn't tested well enough with the other 15 things you had to install that day. And poof, there you are. And so it's not a stretch, right? It's not a low statistic.

Christy Wyatt

>> Unfortunate. It's potentially a house of cards.

Christy Wyatt

>> Yeah.

Krista Case

>> So Christy, can you talk to the role of endpoint resilience in kind of this stack for cyber resilience moving forward? I know you were mentioning earlier, potentially thousands or even hundreds of thousands of endpoint devices being deployed depending on the size of your organization. And obviously the endpoint is kind of that productivity vehicle for workers. So can you talk to the role of endpoint resilience in this conversation?

Christy Wyatt

>> I think endpoint resilience is clearly just one part of a broader cyber resilience conversation, but it is an important part because it is where your users touch your enterprise, right? And it's where the fingers meet the keyboard is where a lot of that work happens. And so if those users can't do their work or if they can't connect to you or they can't communicate with you, that is a significant cause of downtime. Our approach is very unusual because we've been built, we have a capability called Persistence, which has been built into almost every laptop for the last, and PC for the last couple of decades, I would say, from 28 different PC manufacturers. So if you're working on, these kinds of devices, chances are you've already had us several times in your life. What that allows us to do is actually to heal the company or heal the computer from inside. So whether an application has stopped working, the network connection can't connect, whether it's vulnerability and patch management, whether it's something catastrophic that's happened to that device, but that user's working from home and you need some way of reaching out and rebuilding that device or restoring it. So we think of endpoint resilience as that permanent anchor that's built into the hardware, plus the data and intelligence that we have as a result of that tells us whether that device and that user is able to actually do their job. And then how can we help make them more resilient in a more automated way? And of course, we're leveraging AI and all of the same things we've been talking about to how we do that in a more agentic way on the device itself. But if I can save you weeks, if the answer from IT was, we think you clicked on ransomware, please box that laptop up and ship it back in a FedEx box. If we can say, actually, we'll just pull the forensics from that device and we'll do a remote bare metal reinstall and you'll be back up and running in 25 minutes. That's probably better, right? Everybody gets what they want.

Krista Case

>> Absolutely. Absolutely. Just the time savings there. And like you say, getting the user back up and running quickly.

Christy Wyatt

>> Exactly

Krista Case

>> . So we've covered a lot. There's a lot that practitioners are navigating these days, Christy. If I'm a practitioner that understands the importance of resilience, but I'm not sure sort of where to begin, what would be the starting point that you would recommend?

Christy Wyatt

>> I would say channel your inner toddler. I'm a mother of 4, so I like to think of executives wandering through the hallway saying, but why? But how? But why? But how? If 60% of my devices all of a sudden stopped working. How? How would you do that? How specifically? Step me through it. Talk me through it. What are the missing pieces? Where are you going to get stuck? we just had a great conversation with a room full of CISOs here, and folks were saying, look, we get stuck in collecting the forensics. We get stuck in, while we're very much racing to get the organization back up and running, we still need to have the data so that we can figure out what went wrong in the first place. So, I would say, in order to build that plan, Just kind of step through the basics. Ask yourself the really— ask your leadership team and your company the really hard questions about how and why and what, and just kind of step through it in very much like a very basic tabletop exercise. And then who would you call and how would you have their number? it's the non-intuitive things that people get stuck on. We had an individual we were talking to that talked about their break glass strategy was thumb drives. The core team of people that would need to connect would have a thumb drive with an alternate environment that they could boot into. And that worked great until they went to test it and they realized that that thumb drive had been imaged, 6 to 12 months ago, that software was all stale and was no longer, their network configuration wouldn't allow them to connect. So, had this been a real event, they would have been stuck on the outside. So, that would be my advice, which is if you're a business leader, you should be asking, what would we do? What would our worst day look like and what would we do? And have we written that down? Have we practiced it? Have we rehearsed it? It's not rocket science.

Christy Wyatt

>> It's not rocket science, but it's definitely very critical for sure.

Christy Wyatt

>> Right.

Krista Case

>> Well, Christy, thank you so much for joining theCUBE. It's been a pleasure. We really appreciate having you on.

Krista Case

>> Thank you for having me.

Krista Case

>> Thank you so much. And thank you for joining us. Make sure you stay tuned. We'll be right back in just a few minutes with more live here from Black Hat 2026.