AI Aids Security Pros at Black Hat, Creates New Threats

At the annual Black Hat conference in Las Vegas, artificial intelligence emerged as a significant tool for information security professionals, enhancing their ability to detect and assess threats on the conference's network operations center (NOC) Wi-Fi. AI-powered agentic triage has provided the most substantial improvement to NOC staffers' threat assessment capabilities, by both identifying suspicious network behavior and differentiating between routine conference activity and genuinely hostile actions requiring intervention. James Pope, senior director of security product research at Corelight and a NOC administrator, described the process as combining alerts into detections, which are then rolled up into "agentic triage." He stated that when this system functions correctly, "it's amazing."

A presentation on the final day of the conference highlighted the complexity of the NOC administrators' task, which they liken to "finding a needle in a needle stack." During the event, 8,892 issues were observed on the network. Of these, 2,593 were escalated to cases, and 2,543 of those cases were handled automatically by the system. The remaining issues required human oversight, judgment, and potential intervention. Pope emphasized that "illegal stuff at Black Hat is still illegal," underscoring the need for human review in critical situations.

The AI triage tool integrates Corelight's existing network security tools with components developed by Pope himself and third-party solutions from companies like Splunk. A key advantage of this system is its transparency, allowing users to verify its findings rather than blindly trusting the AI's output. Pope explained that the system is "tied all the way down to the raw log," providing concrete evidence for its assessments. Furthermore, the system is designed for ease of use, enabling NOC administrators to query its data through a bot integrated into the Network Operation Center's Slack workspace, eliminating the need for separate, cumbersome data checks.

Beyond its role in threat detection, AI also presented new challenges at Black Hat. The conference, known for its demonstrations of hacking techniques and security vulnerabilities, also served as a venue where AI itself was explored as a potential vector for new types of attacks or as a tool to amplify existing ones. Security professionals are increasingly grappling with the dual nature of AI in cybersecurity: its power to augment defensive capabilities while simultaneously offering sophisticated new avenues for malicious actors. This dynamic necessitates continuous adaptation and innovation in security strategies to stay ahead of evolving AI-driven threats.