Black Hat USA 2026 | Timothy Youngblood, Onyx Security

Clips
More from Black Hat USA 2026

Timothy Youngblood

Chief Strategy Officer

Onyx Security

play_circle_outline CISO Leadership in Safe AI Operations and Cross-Functional Governance

play_circle_outline AI impacts all stack layers: network, apps, data, transport

play_circle_outline Runtime protection and real-time model assessment/guardrails

play_circle_outline CISO metrics shifting to enabling business and cost/use analysis

play_circle_outline Agentic AI risks: agents going rogue and misconfiguration scenarios

Info
Transcript

Timothy Youngblood, Onyx Security

Timothy Youngblood

Chief Strategy Officer Onyx Security

In this interview from Black Hat 2026, Timothy Youngblood, chief strategy officer of Onyx Security Ltd., joins theCUBE's Krista Case to discuss how artificial intelligence is reshaping the CISO's role and forcing enterprises to rethink their security stacks. Youngblood, who spent 30 years in the industry and served as CISO for four Fortune 500 companies including McDonald's, explains why AI differs from prior shifts like cloud and mobile because it touches every layer of the stack at once. He details why real-time protection is critical as AI-driven transacti... Read more

explore Keep Exploring

How are safe operations of AI and AI governance affecting security leaders’ responsibilities and the role of the CISO? add

Is AI causing different parts of the security stack (network, identity, applications, data, transport, resilience) to need to work together to secure AI and defend against AI-driven attacks? add

How should organizations manage and mitigate operational and security risks when deploying AI systems in production, and what kinds of guardrails or real-time protections are needed? add

How must security leaders adapt their role and approach as AI becomes integral to business operations? add

What issues do tabletop exercises about AI agents going rogue reveal about organizational decision-making, stakeholder ownership (including CISOs), and who should respond when misconfigurations cause customer-impacting incidents? add

bolt Powered by CUBE AI

Timothy Youngblood, Onyx Security

search

Krista Case

>> Hey, welcome back to theCUBE. We are live here at Black Hat 2026 with our ongoing coverage. Here, day 2. I'm Krista Case, and we've been talking a lot about this concept of safe operations of AI and in particular the impact to security leaders. So security leaders are still responsible for managing cyber risk. But increasingly, they're also playing an important role collaborating alongside the business to establish what these guardrails look like for AI as we move it into production. And this is really going to even extend beyond security. So we see that AI governance brings not only security to the table, but also legal compliance, IT, and the business, because we need this clear accountability for how AI systems are accessing data, how they're making the decisions and how they're interacting with enterprise processes. And this has a very important impact on the role of the CISO. So here to unpack that conversation with me is Timothy Youngblood. Timothy is currently the Chief Strategy Officer with Onyx Security, but before joining Onyx, he actually served as CISO for 4 Fortune 500 companies, and he's seen a lot of evolution managing cybersecurity and risk programs through major technology shifts such as cloud and mobile in addition to AI. Tim, thank you so much for joining us on theCUBE.

Timothy Youngblood

>> Yeah, thank you, Krista. Glad to be here.

Krista Case

>> Yeah, how's the show going for you?

Timothy Youngblood

>> the show is another, massive Black Hat conference.

Krista Case

>> Yes, yes

Timothy Youngblood

>> , it never fails to, impress you with the scale and scope of what's going on.

Krista Case

>> I know, and I think that what's going on is certainly at a scale that is unprecedented, right? And I'm hoping, Tim, you could maybe sort of unpack that a little bit. As I was just mentioning, you have been in the role of a CISO through a lot of technological change. Can you talk about kind of this AI moment, for lack of a better way to put it, and sort of why that's different than some of these other shifts like cloud and mobile?

Timothy Youngblood

>> Yeah, it's amazing because I've been in the industry 30 years and it's incredible the cycles that I've seen in those 30 years from moving from mainframes to workgroup computing, going into cloud and now we're here in another era, right? And AI is different because it's the one thing that touches everything.

Krista Case

>> It does.

Timothy Youngblood

>> You know, it's— and it's not necessarily aligned to just one layer of your stack, your IT stack, right? It's hitting at the network layer, it's hitting applications, it's hitting data, even transport. All of those things have AI implications to them.

Krista Case

>> And Tim, I'm glad you brought that up because there's, as you mentioned, important technological implications. And we've had a couple conversations over the last few days here on theCUBE about the fact that the need to both secure AI and protect against these AI-driven attacks is almost causing not quite this convergence of these elements of the security stack that you're talking about, but at least they need to work together in concert. You mentioned kind of the network and identity, but even through resilience, can you talk about, I guess, are you seeing that as well?

Timothy Youngblood

>> Yeah, I think that's an important part as people start to mature. In this space where we're coming up with some unknown categories of what we think the technology can do because we don't know for sure. And we've seen evidence of that with Anthropic and the Hugging Face incident. And we're realizing that AI is learning and, you know, it may know how to solve a task in a certain way one day, the next day it may figure out a different way, right? And that different way may not be the way that you want it to do it.

Krista Case

>> It's given a task and it's going to find a way to complete that task no matter what.

Timothy Youngblood

>> Absolutely. It's continuously enumerating what it can do and it's hard to track what that is.

Krista Case

>> And so that might be a great lead-in to talking about governance. So we've also been hearing at the show a lot about the need to secure AI in runtime because we're seeing that enterprises, there's this hard charge to operationalize AI as much as possible. So for security practitioners, they're trying to not only turn the lights on and kind of uncover how their organization is using AI, but they're also at the same time trying to make sure that they have at least the baseline guardrails in place to make sure that that AI is moving into production in a safe way. What are some recommendations for security leaders that you would have to keep in mind as they're looking to help their organization in this process?

Timothy Youngblood

>> It's a good question because, as you know, this is being turned on and we're figuring out the impacts to our environment. We need to be able to stop things that we don't want to see happen. In many cases, it's not necessarily threats that are the issue. It's more operational errors that could cause huge impacts that are just as damaging as an attack would be. And so the aspects around real-time protection is really critical with AI because you imagine maybe you had a human doing this task and it could do it, maybe 10 transactions in 20 minutes. Well, you put AI in there and it's doing 100,000 transactions a minute, right? So the speed is everything. And I think leaders have to look at, okay, solutions that are going to help me put guardrails in, give me a breaker switch on things. Is it talking at the level of API, right? Or am I looking at solutions that are just running scripts? And if they're running scripts or they're just running standard rules, they're not going to be able to move as fast as AI is. So you want solutions that have maybe many models that are also assessing your AI models in real time. And I think that's a big differentiator between a lot of the solutions that are out there today.

Krista Case

>> Yeah. And I think the ability to assess those models in real time is going to be important, especially as we have all of these startups that are all kind of claiming to be AI native, right? So one question that I'd have for you is how do you think about evaluating these different solutions? You know, someone with your background is going to be just inundated with all this vendor messaging. So how do you really dig into what's going to make a meaningful impact and what's concrete at the end of the day?

Timothy Youngblood

>> Yeah. And particularly in this sort of agentic security space, there's a lot of noise there. I think there may be 80 or 90 vendors that have come out in the space in the last 2 years and growing. And so it's a segment that is the hottest topic in every corporate office boardroom. You have it. So that's why so many people have jumped in, but it's made it really noisy. You know, my peers are having a really tough time determining, like, this messaging we're seeing from these vendors all sounds the same. And how do I differentiatewho actually can address my use cases and address my needs at the scale that I need it to based off of all this messaging? And it's almost impossible to do that. So you really have to start to look at, okay, how was this designed? So was this a solution that was actually a pivot? Was this vendor doing something else a year ago and then all of a sudden they are now an AI agentic solution, right? And you have to really step back and scratch your head at some of those scenarios because they have a legacy architecture to them. And they're just always going to be going uphill. And so that's a big factor is like, okay, were you actually designed to solve this problem or did you kind of pivot into it? So I think I've always given CISOs the advice to go and look at what was the origin story of this. And then you have to also look at the team and the founders. That's a big part of it. Are they willing to work with you? Because no solution is going to be perfect. I don't know anyone who's going to have their entire procurement list of needs met by every solution out there. In particular, AI, I think it'll be similar to identity where you're going to have multiple solutions to kind of cover multiple types of issues. And so are you going to work with a team that's going to be willing to move with you, adjust with you, partner with you to address your needs when I was the CISO for McDonald's, we had very specific needs in quick-service restaurants, right? You had 30,000 restaurants all around the globe. we had 2.2 million people that were McDonald's employees, and you needed people that could flex to meet the scale and the needs and the complexity that we had to deliver on. And some teams aren't ready for that.

Krista Case

>> I would very much agree, Tim, especially in this day and age as enterprises are still in the early days of understanding how their own organization is going to be using AI. That creates a whole potential risk surface that we just don't know what it's going to look like over the next 12, 24, 36 months. And then similarly, how are the adversaries going to continue to evolve and adapt?

Timothy Youngblood

>> So, yes, and that's a great point because that's the other thing when I talk to my peers is we have to look at the work we do today is not going to be the same as what we do tomorrow.

Timothy Youngblood

>> All right.

Timothy Youngblood

>> And so am I actually getting a solution that's future ready, right? That it's actually going to be able to adjust to what I need in 6, 7 months even, right? How quickly things are moving. And I think that's where this whole AI native thing and trying to describe what that means is, can you flex and change as AI is changing?

Krista Case

>> Yes, yeah, no, it's definitely a great point. And Tim, when you think about your current security stack, right? What are some of the areas that you see key gaps that maybe are going to need to be solved? Maybe we can just talk about over the next 6 months. I know you've already referenced identity a couple times, and I know you and I have had the opportunity to have a couple conversations, and even prior to this, and that's been one thread that we've been talking about is how do we evolve identity governance and privileged access to be able to address agentic AI and what that means. So maybe you could talk a little bit about that.

Timothy Youngblood

>> Yeah, yeah. The stack is changing so drastically and I see CISOs reassessing their entire security ecosystem and determining, okay, now that we have this new capability with models, what in my stack can I potentially get rid of now that I have the capability to do the monitoring with AI and to develop agents to go and continuously assess these things. Do I still need a SIEM the same way I did before? Do I still need vulnerability management? That seems to be a very turnkey type thing, as long as you can get access to the malware signatures, then you could have your own capability going out to your workstations and endpoints and that kind of thing. So it's re-envisioning what's really needed now.

Krista Case

>> Um, kind of evaluate your environment and understand what the needs are going to be.

Timothy Youngblood

>> Yes, I think the stack in security is going to look drastically different even next year than it does now. When we're here at Black Hat again in a year, some of those companies aren't going to be on the floor that are on the floor, right? So, yeah, and a lot of that's going to be because of AI's maturity.

Krista Case

>> So let's talk about that. I hope you and I can sit down again in a year from now at Black Hat and talk through what's changed. What, you know, if you had to, you know, look at your crystal ball, what do you think might change over the next 12 months?

Timothy Youngblood

>> Yeah. Yeah. Well, we talked about identity. Right? And you're starting to see a lot more companies come to the table who are re-envisioning what identity is. We've been doing identity the same way for 40 years. And now that everyone is becoming sort of AI aware and the definition of what identity is has changed, this is an opportunity to kind of think the old-school passwords, IDs, maybe don't work in this new model anymore. Maybe there's something else. Maybe it's all token-based. It's, I think, one of the more exciting things because identity is definitely one of the more complex areas of anybody's operations. If you think about it, it's the thing that allows everybody else to get work done.

Krista Case

>> Yes.

Krista Case

>> So—Yes. Even developers these days.

Timothy Youngblood

>> Yeah, exactly. So it's exciting to see some solutions come to the table to say, okay, we're going to eliminate the complexity of identity for you by completely changing what identity means. So that's a really critical area. Also seeing a lot in the area of resiliency. That's a big area because now I think every company realizes they're going to have cyber events and it's not an if-but-when thing. It's happening now and it's more about how do I keep my business running? Through an event. I'm going to have events, so how do I ensure that resiliency? And so you're seeing a lot of solutions that come to the table that highlight the ability for high resilience in critical business processes. So even if half your network is being attacked or down, you're still serving customers, right? So that's a key part as well as the speed to respond to an event, which is also a big aspect of resiliency. So those types of solutions are really, I think, at the top of mind for a lot of CISOs right now.

Krista Case

>> I'm really glad, Tim, that you brought up resiliency. We've had a number of conversations over the last few days about how that understanding at the board level that, to your point, security has become an issue of business operations and business continuity. And at the same time, to your point, it's not a matter of if, it's a matter of when. So we need to make sure that we can have those minimal viable operations up and running in the event that we have a cyber incident. Is that changing how CISOs are evaluated? Sort of the metrics? It used to be kind of, okay, we've stopped this number of attacks, right? But I think it's becoming more of a conversation of collaborating with the business and sort of talking through these issues regarding what does it look like to keep those critical services up and running?

Timothy Youngblood

>> Well, and it's interesting now because when you think about it, every company is a technology company to some degree, right? Particularly with AI evolving. And so no longer can security leaders be guns, gates, and guards, right? Because that just isn't going to cut it anymore. You know, the fact that you stop something from happening, that's great, but what the business leaders are looking for is like, how are you enabling my business, right? And so it's requiring, security leaders to have that business acumen to come in and say, well, how can I, expose our infrastructure so that we can, get more transactions, identify more customers? How am I helping to reduce costs? Right? And that's one of the key areas, particularly with AI, that security leaders can now assess token usage pretty well and then go back to the business and say, okay, does this make sense? I see, $3 million in tokens being used here, but I don't see the output that we're looking for. So should we shut this down? So it's a totally different conversation than what they've had in the past.

Krista Case

>> Yeah. And it's— so there's a lot of, I imagine, sort of ongoing collaboration again to figure out what that new process looks like. Yeah, I know you've done some work recently around tabletop exercises for cyber resilience. Can you share a little bit about what that looks like and maybe some of the reception that you've had?

Timothy Youngblood

>> Yeah, I've had the pleasure to do a few tabletop exercises on AI agents going rogue, which is an interesting concept that is a viable issue for everyone, which also is another thing that CISOs have to change their playbook to account for AI and things that happen at AI speed. But in the tabletop exercise I go through, it's also a business decision aspect because even with the introduction of AI or agents, who is interfacing, making the decisions on what solutions to acquire and why are they making those decisions and are they including all the stakeholders that need to be involved in it? And the tabletop exercise is really realistic because a lot of CISOs find themselves coming to the table after the decision's already been made and then trying to figure out, okay, well, how much of this do I have ownership of now when I had no choice in what was acquired now? And the interesting part about it too is that it's a security tabletop, but the main issue of it is the agent goes off and it wasn't a threat actor that caused the agent to go rogue, it was misconfigurations that led to huge customer impacts. And it was a question like, okay, who's supposed to respond to this? Is it customer service or is it the procurement team? Is it security? Whose problem is this, right? And that's something that I think people are wrestling with right now.

Krista Case

>> And the answer is probably going to look different for each organization, I would imagine, Tim.

Timothy Youngblood

>> Yes, exactly, exactly. And in each industry vertical, like financial services is going to be different than healthcare or high-tech.

Krista Case

>> Exactly, exactly. And I know you were also mentioning you're kind of doing some work and some presentations around this concept of high-performance teams, right? And so I think it's really salient to bring that up because as we're talking through, these issues are as much about people and processes as they are about the technology itself. And there's a lot of pretty significant evolution to these roles that's happening. So, yeah, I guess, what do you think a high-performance team is going to look like as we move AI into production?

Timothy Youngblood

>> Yeah, and I think as these AI transformations are occurring, a lot of the key learnings that are coming out is that it can't just be about the technology itself, right? You can't buy models and just run them and expect immediate success, right? It's also going to require business process redesign work, right? So, it's all the stakeholders involved in that assessing and re-determining, how do we do our processes now that we have AI? We can't do them the same way we've been doing them, right? We're not going to get the results that we need. And same thing that happened the last cycle with cloud, right? Because people had to figure out how do I cloud-enable my app, right? I forklift it up there, expecting I'm going to get a different result and, I'm just getting the same thing. So it's happening at this scale and I see people looking for AI literate and AI proficient people to come to the table who understand the different models and what they're good at. And then how do you leverage them? How do you do integrations? How are you assessing hallucinations? How are you making sure that in critical areas there's a human-in-the-loop aspect to it, right? And so it's changing the way teams are formulated and people who are highly knowledgeable of those skill sets are the ones leading the teams now.

Krista Case

>> Can you talk a little bit more about those skill sets, Tim, because it's come up in a number of conversations. You talk about the AI literacy and you talk about the human in the loop. We've been having conversations about how AI is not going to replace your security analyst, for example, right? But it's more of a matter of one-to-three in terms of really upskilling the human and allowing the human to focus on where they're most proficient and can add expertise. So what are some of the more specific areas of expertise you think are going to be critical maybe over the next— we'll call it 12 months. We'll start there.

Timothy Youngblood

>> Well, yeah, it's an interesting space because I think in areas where you've got a large consumption of data and you need to do some quick analysis and reads, that's an area where you're gonna have AI and humans having to work well together, right? Like in security, it may be in the SOC itself, where an AI agent may be looking at the same issue over and over again, but not really understanding the aggregate of the problem where an experienced human will be able to see that this is a trend that we may need to make some bigger adjustments, even though you're taking care of the issue, which is what you're supposed to do. But to stop it from happening, you need to have that sort of tacit knowledge that this trend is happening. It's not normal.

Krista Case

>> Absolutely.

Timothy Youngblood

>> Yeah. So SOC is a great area there. Yeah. And it's just those things. I think we had talked about that example of the doorman. You have a doorman at a fancy hotel or property, and you could get an automatic door for people to come in and out of, but when you have a doorman there, they're making sure that the entrance is safe.

Krista Case

>> Exactly.

Timothy Youngblood

>> You know, they're helping people with their bags. They're doing a lot more than just opening the door, and that's one of the things we all have to realize too, and what people's jobs are. What are all the other ancillary things that make up what they do that may not necessarily be documented.

Krista Case

>> AI is doing the, okay, I'm going to open the door for you, but the human is still the one controlling.

Timothy Youngblood

>> Yes.

Krista Case

>> Going back to the identity, is still the one overseeing the access, right? To use that to build on that analogy.

Timothy Youngblood

>> Yeah, absolutely. Absolutely.

Krista Case

>> So just a quick closing thought, Tim, what do you think we're going to learn when it comes to AI governance over the next 12 months that we might be talking about reflecting on at Black Hat 2027?

Timothy Youngblood

>> Yeah, yeah. I think you're going to see a lot more consolidation occur just in the industry. You're seeing, for example, non-human identity companies getting acquired by large footprint companies like Cisco and Palo Alto. And I think you're going to see more people help them provide more holistic AI solutions, right? And most of your, I think, legacy vendors, they have to scramble and keep up and they're going to try to keep their customers from going off and buying point solutions and they're going to want to try to bundle it and to make it more cost effective and support effective. For particularly large-scale companies. So I think you'll see a lot more of this consolidation happening in multiple places where you've got solutions that are great as sort of a standalone solution. There are more features than anything, and you'll see bigger companies capturing those things, trying to roll it all together.

Krista Case

>> Yes, absolutelyWell, Tim, this has been really insightful and a pleasure. Thanks so much for joining us, really appreciate it.

Timothy Youngblood

>> It's been fun. Thank you.

Krista Case

>> Absolutely. Thanks so much. Thank you for joining. Don't go anywhere. We're going to be right back in just a couple minutes with more live from Black Hat 2026.