The ITSPmagazine Podcast

James Pope is on site in Las Vegas more than a week before the doors open. As SOC lead for the Black Hat NOC and Senior Director of Security Product Research and Technical Marketing Engineering at Corelight, his show starts with switches and access points rather than alerts. The team brings in the ISP, the firewall, the switches, and the access points, deploys them across the conference, and then moves into SOC mode. If there is no network, there is nothing to secure.

The tooling arrives through partnership rather than sponsorship. James Pope says a company cannot buy or sponsor its way into the NOC, and that the team picks what it wants and fills gaps as it finds them. Cisco covers Umbrella and file malware analytics, Palo Alto Networks provides the firewall and XSIAM as the log aggregator, Arista handles switching and access points, Jamf runs MDM across the registration devices, and Lumen supplies the internet. Corelight is the network visibility layer.

That layer carries different weight here than it would inside a company. Asking attendees to install a certificate or an endpoint agent so the NOC can inspect their traffic is a request nearly everyone declines. In most corporate environments the endpoint is one of the richest sources of signal. At Black Hat, visibility into attendee activity comes from network data.

A Black Hat positive is malicious activity that is legitimate in context. Attendees pay to learn attack techniques against real targets, and researchers demonstrate new exploits on stage. Those events generate true detections no corporate SOC would ignore. The NOC lets them run rather than killing a paid training exercise or a live demo.

So how does the team tell a training exercise from a real attack? It baselines each classroom and spends its time on the outliers. When seventy students in a room run the same attacks against the same destinations, the activity is probably sanctioned. The curriculum is ingested as a JSON file and the system moves through a series of gates, asking whether this is a class, whether multiple sources are reaching the same destination, and whether the attack would be expected in that curriculum. Anything that does not fit comes back for a human.

The team informs far more often than it blocks. On the day of the recording, James Pope went to the trade show floor to tell someone that command and control traffic was running from their machine, and handed over logs for their IT and security team. He is not their manager, and what happens next is their call. Illegal activity is treated differently, and a handful of times per show the team asks a room to stop.

At Black Hat Asia, traffic from a Corelight sensor showed a double RAT infection on one machine, a single APT running one implant for exfiltration and another for command and control. Working from traffic, James Pope established that the person was a reporter, the region they covered, and the company they worked for. Open source intelligence narrowed it to a single name, registration confirmed the person was on site, and the NOC invited them in. The reporter arrived expecting a product demo. The laptop was reset with everyone present, sessions were revoked, passwords were changed, and the reporter left in a secured state.

This year the team opened the Outpost, running real Black Hat network logs from Corelight behind application guardrails, LLM guardrails, and a kill switch, where visitors query the data with text to SQL. Agentic triage stitches alerts into detections and detections into a timeline, and James Pope treats the ability to drill down to raw logs as a requirement rather than a preference. Success is measured largely by what does not happen: no compromise of registration, the switches, or the access points, and people who arrive infected leaving better than they got here.

This is a Brand Briefing. A Brand Briefing is an on-location conversation recorded on site at Black Hat USA 2026, putting a spotlight on the guest and their company and pairing it with the editorial reach of ITSPmagazine. Learn more: https://www.studioc60.com/performance/#briefing

GUEST

James Pope, Senior Director of Security Product Research and Technical Marketing Engineering at Corelight, and SOC lead for the Black Hat NOC

RESOURCES

Black Hat USA 2026 event coverage from ITSPmagazine: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas

Learn more about Corelight: https://corelight.com

Corelight blog, including the Black Hat NOC series: https://corelight.com/blog

Are you interested in telling your story?

KEYWORDS

james pope, corelight, sean martin, marco ciappelli, brand briefing, brand story, brand marketing, marketing podcast, black hat usa 2026, network detection and response, network evidence, security operations center, threat hunting, agentic triage, ai in the soc, conference network security, black hat noc, command and control, incident response

Recorded on location at Black Hat USA 2026 in Las Vegas at the end of day two, Karthik Kannan, Founder and CEO at Anvilogic, walks through a seven year build that reached its original shape this year. The plan from the start was a full security operations platform covering data, the detection engineering process, triage and investigation, and case management. In the shorthand of the category, SIEM and SOAR combined.

It arrived in phases. Detection engineering came first, implemented on top of Splunk for most customers, then the data platform expanded into data lakes including Snowflake, Databricks, and Microsoft Azure. Triage and investigation followed over the last two years. In the last year Anvilogic rolled out agents that carry out the work of specific personas, and this year the company launched Blueprints, an orchestrator agent that brings the discrete agents together to run a whole workflow with humans in the loop.

What separates a security graph from a frontier model? It knows the environment. Karthik Kannan describes the enterprise security graph as Anvilogic's own model running inside the network, learning the micro environment, with frontier LLMs called on to fill gaps in the macro environment. His argument is that platforms operating as LLM wrappers miss the last mile, because AI on its own reaches 60, 70, or 80 percent of the way if you are lucky.

How does a team keep control when agents run the workflow? Through gates, permissions, and a record of what happened. Workflows can be described in plain English, with human gates inserted as often as the team wants. Access controls sit at the persona, organization, and object levels, and activity is audited and logged, which matters to the GRC teams Anvilogic works with.

Screens dedicated to what the company calls a maturity score show which feeds are coming in, what kinds of detections exist, and what coverage looks like against the MITRE ATT&CK framework, in a form available to executives and CISOs. Karthik Kannan also points to version 8.0, introduced the week before the event, which includes an Anvilogic MCP Server for connecting to third party tools.

Customers are already building their own Blueprint workflows during proofs of concept, including a large life sciences customer Anvilogic expects to feature in a public case study. Karthik Kannan is careful about the claim being made here. This is not a proclamation of an autonomous SOC. It is automation that makes life in a SOC easier and more efficient, adopted at a crawl, walk, run pace, with every step visible along the way.

This is a Brand Briefing. A Brand Briefing is an on-location conversation recorded on site at Black Hat USA 2026, putting a spotlight on the guest and their company and pairing it with the editorial reach of ITSPmagazine. Learn more: https://www.studioc60.com/performance/#briefing

GUEST

Karthik Kannan, Founder and CEO at Anvilogic

RESOURCES

Black Hat USA 2026 event coverage from ITSPmagazine: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas

Learn more about Anvilogic: https://www.anvilogic.com

Anvilogic 8.0, from onboarding to investigation: https://www.anvilogic.com/learn/anvilogic-8-0-automate-the-soc

Are you interested in telling your story?

KEYWORDS

karthik kannan, anvilogic, sean martin, brand briefing, brand story, brand marketing, marketing podcast, black hat usa 2026, agentic secops, ai soc platform, enterprise security graph, detection engineering, triage and investigation, blueprints orchestrator agent, mcp server, mitre att&ck coverage, human in the loop automation, siem and soar, security operations, grc audit logs

Sean Murphy spent most of the past decade running F5 technology as a customer inside highly regulated environments. He is now about four weeks into the role of Field CISO for North America, and he describes the first month as drinking from a fire hose. Depending on how the math is done, he places F5 among the seven largest cybersecurity companies once BIG-IP is counted as security tooling, with the reasoning running through the CIA triad. Availability is the leg that tends to fall out of the security conversation, and without it there is no resiliency.

What changes for a CISO when AI moves from experimentation into production? Sean Murphy points less at speed on its own and more at what he calls the physics behind it. Anyone can build an agent, and people do, which brings shadow AI along for the ride. Forces multiply across speed and scale until the consequences turn existential for some organizations, and governance and visibility land at the feet of the CISO.

He argues they should not stop there. Sean Murphy wants a gating step that carries a business justification and a named accountable owner for each agent. His concern is less about who owns what an agent is designed to do and more about who answers for what it does outside that intent. Intention, in his framing, is the new frontier and the new perimeter.

What should executive teams understand before approving more agents? Exposure has stopped tracking company size. Adversaries are weaponizing agentic AI, and Sean Murphy describes the curve from vulnerability to exposure to exploit as closed for practical purposes, which removes the hiding places smaller organizations used to count on. Investment in AI innovation needs matching investment in governance and guardrails, or the result surfaces as a data breach or an SEC filing tied to shadow IT and shadow AI.

On the technology side, he points to the F5 Application Delivery and Security Platform watching at the customer edge and the regional edge, where AI logic and risk scoring can delay attempts before they reach customer production environments. That delay gives a security team room to detect, respond, recover, and patch on a compressed timeline instead of an almost instantaneous one. It is also why he favors a platform over a set of niche products, with AI risk scoring, runtime analysis, and behavioral alerting in one place a team is trained on.

Sean Murphy closes with a story from the customer seat, where F5 protections acquired through Silverline and Shape helped him push off automated botnet attacks and keep the business running, before anyone framed that work as AI. Boards are pressing executive teams on why more is not underway, and his answer is assurance built on capability, with enough friction in place to stay out of the headlines.

This is a Brand Briefing. A Brand Briefing is an on-location conversation recorded on site at Black Hat USA 2026, putting a spotlight on the guest and their company and pairing it with the editorial reach of ITSPmagazine. Learn more: https://www.studioc60.com/performance/#briefing

GUEST

Sean Murphy, Field CISO for North America at F5

RESOURCES

Black Hat USA 2026 event coverage: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas

Are you interested in telling your story?

KEYWORDS

Sean Murphy, F5, Sean Martin, brand briefing, brand story, brand marketing, marketing podcast, Black Hat USA 2026, field CISO, agentic AI, shadow AI, AI governance, agent accountability, application delivery and security platform, AI risk scoring, web application firewall, board reporting, security leadership

Sumedh Thakar joined Qualys as an early software engineer on the scanner, back when a 90-day scan cycle came with another 90 days to fix whatever it found. Twenty-three years later he leads the company, and the number he uses now is 90 seconds. At Black Hat USA 2026 he walks through what that compression asks of security teams.

So what has actually changed? The questions have not. Where are my assets, what is my assessment of them, what do I prioritize, and what do I fix. Thakar points at the clock instead, citing a CISA directive that gives government agencies three days and zero-day conversations built around a 24-hour window. Layering dashboards on top of that produces what he calls dashboard tourism when nothing gets fixed at the end of it.

Qualys organizes its response around three pillars. AI speed detection compresses the gap between a vendor disclosure and a confirmed finding. Hyper prioritization runs an actual exploit to see whether firewall and EDR controls already block it, cutting a theoretical 1% down to roughly 20% of that 1%. Autonomous remediation applies the fix without routing it through a human first.

How far along is autonomous patching already? Qualys has deployed over half a billion patches, 150 million of them in the past 12 months, and 40 million of those went out with no human intervention. Thakar describes a global company with 450,000 employees running the agent for autonomous patching, where the board metric is a maximum four-hour exposure window from the time a patch is released rather than a count of vulnerabilities.

He expects the monthly patch cadence to give way as disclosures accelerate. Qualys recently released InstaScan, which Thakar calls scanless scanning, delivering a finding within an hour of a vendor disclosure. A patch reliability score built using AI lets an agent judge whether a patch is dependable and reboot-free before applying it on a laptop.

His closing advice to CISOs is to show up as a business partner. The board and the CEO need visibility into potential loss, current spend, and whether risk sits inside an acceptable appetite. For a $500 million business that means pricing what a breach would cost, funding the reduction of an $80 million exposure, and transferring what remains to cyber insurance. His shorthand for the operating model is the ROC alongside the SOC.

This is a Brand Briefing. A Brand Briefing is an on-location conversation recorded on site at Black Hat USA 2026, putting a spotlight on the guest and their company and pairing it with the editorial reach of ITSPmagazine. Learn more: https://www.studioc60.com/performance/#briefing

GUEST

Sumedh Thakar, President and CEO at Qualys

RESOURCES

Black Hat USA 2026 event coverage: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas

Qualys: https://www.qualys.com/

InstaScan announcement: https://www.qualys.com/company/newsroom/news-releases/usa/qualys-launches-instascan-to-detect-vulnerabilities-within-minutes-of-disclosure

Agent Insta and scanless detection: https://blog.qualys.com/product-tech/2026/08/03/instascan-agent-insta-scanless-detection

The Risk Operations Center with Enterprise TruRisk Management: https://blog.qualys.com/product-tech/2024/10/09/qualys-launches-enterprise-trurisk-management-the-industrys-first-cloud-based-risk-operations-center

Are you interested in telling your story?

KEYWORDS

Sumedh Thakar, Qualys, Sean Martin, brand briefing, brand story, brand marketing, marketing podcast, Black Hat USA 2026, autonomous remediation, patch management, vulnerability management, hyper prioritization, AI speed detection, scanless scanning, InstaScan, risk operations center, cyber risk management, zero day remediation, CISO, exposure management

Lisa Liu, Corporate Marketing and Communications Manager at Stellar Cyber, says the AI noise has been running since RSAC Conference, and that what separates vendors now is whether they can back their claims with data their customers gave them. She came to Black Hat USA 2026 with figures on Agentic Auto Triage.

The numbers she cites: up to 19 minutes saved per hour per analyst, up to 1.5 full-time analysts per year, and 99.7 percent agreement with the human analyst. Liu treats the accuracy figure as the one carrying the weight. Reacting at machine speed matters only if the verdicts hold, and she describes security as a low trust industry where the burden of proof sits with the vendor.

Stellar Cyber is a security operations platform purpose built for MSPs and lean enterprise teams, offering full cycle, full visibility, unified security operations. Liu says the company builds its business logic around the customer pain point, maximizing the efficiency of the resources a team already has. With alerts climbing as attackers pick up the same AI tools as everyone else, she argues that hiring through the volume is out of reach for most teams.

So where does reclaimed time go? Liu says that call belongs to the customer. Reported answers include customer relations, other facets of the job, and expanded roles that analysts never had time for. There is a learning effect too. Analysts can see every step of the decision making behind an AI conclusion and draw lessons from it.

For managed service providers, Liu says partner analysts deliver more customized services and take in feedback more productively once their schedules loosen up. Where partners serve very different market segments, platform flexibility carries the load, along with full visibility and automation at machine speed. She also hears a shift on the floor: running many separate vendors creates expensive overlap and leaves gaps, and a single platform approach is becoming industry standard.

What comes next? Liu places the industry in a proof stage. More validation is necessary, claims about the Agentic SOC keep arriving, and backing those up with more numbers is a large part of moving forward. AI has been part of the Stellar Cyber logic since the company was founded over 10 years ago, and she says that has not changed.

This is a Brand Briefing. A Brand Briefing is an on-location conversation recorded on site at Black Hat USA 2026, putting a spotlight on the guest and their company and pairing it with the editorial reach of ITSPmagazine. Learn more: https://www.studioc60.com/performance/#briefing

GUEST

RESOURCES

Are you interested in telling your story?

KEYWORDS

On the show floor at Black Hat USA 2026, Marco Ciappelli connected with Dr. Chris Pierson, Founder and CEO at BlackCloak, about a change in where the company draws the line around who gets protected. BlackCloak launched Impersonation Protection several months ago for the C-suite and their families. Clients came back asking for more reach.

Why does deepfake risk extend past the executive? Because the people surrounding an executive hold the access attackers want. Pierson lists the trusts and estates attorney, the private wealth manager, the lawyer, the spiritual advisor, the dog walker. Each one is a plausible caller with a legitimate reason to reach out about money, schedules, property, or family.

The economics moved too. Pierson contrasts an era when a convincing fake needed something close to a studio operation with what the same result costs now: a laptop, a small sample of audio or video, roughly three minutes of processing, live video and audio. He points to the February 2024 case where a finance employee acted on an impersonated CFO and twenty five million dollars went out the door.

The expanded capability lets a member extend coverage across their circle at no cost to the invited contact. Pierson says the platform can now scale to hundreds, thousands, or tens of thousands of individuals at a single company, along with family members and key contacts. The point, as he frames it, is to stop the deepfake where it starts, which is at the human.

What changed for executive protection over the past year? Physical and digital stopped being separate programs. Pierson traces that shift to the murder of Brian Thompson, the UnitedHealthcare CEO, and to the questions corporate security teams started asking afterward. Digital breadcrumbs sit on data broker sites and across the deep and dark web, and erasure is unrealistic, which moves the work toward protection rather than removal.

That thinking shows up in the product. Members receive travel advisories tied to where they are going, and a CISO can pair a world threat dashboard with cybersecurity guidance for a specific trip. Behind it sits eight years of member data and one of the larger deception networks aimed at individuals, which shows BlackCloak where targeting concentrates, from executive airports to the Olympics to the World Cup.

This is a Brand Briefing. A Brand Briefing is an on-location conversation recorded on site at Black Hat USA 2026, putting a spotlight on the guest and their company and pairing it with the editorial reach of ITSPmagazine. Learn more: https://www.studioc60.com/performance/#briefing

GUEST

Dr. Chris Pierson, Founder and CEO at BlackCloak

RESOURCES

Black Hat USA 2026 event coverage from ITSPmagazine: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas

Learn more about BlackCloak: https://blackcloak.io

The BlackCloak Digital Executive Protection Platform: https://blackcloak.io/product/

BlackCloak extends deepfake protection to the executive's entire trusted circle: https://blackcloak.io/news-media/blackcloak-extends-deepfake-protection-to-the-executives-entire-trusted-circle/

Are you interested in telling your story?

KEYWORDS

chris pierson, blackcloak, marco ciappelli, brand briefing, brand story, brand marketing, marketing podcast, black hat usa 2026, digital executive protection, impersonation protection, circle of trust, deepfake, executive protection, ciso, data brokers, threat intelligence, travel advisory, social engineering, wire fraud, personal cybersecurity

There is a version of the music career that gets written about, and there is the version that gets played. Frankie Raye lives in the second one. She performs six or seven nights a week across the greater Tampa Bay area, mixes covers with originals depending on what the room wants, and treats the gig itself as the practice session. She points at old video of herself and measures the distance she has traveled, not against a chart position, but against her own playing.

That volume changes how craft works. Frankie Raye does not describe herself as a guitar player. She describes herself as a singer whose guitar carries her voice, and she is direct about the shortcuts that make a set possible: capo up, transpose on the phone, skip the bridge if the chords are ugly, come back to the chorus. The room is singing along to the chorus anyway. What sounds like a confession is closer to a working method, and the results are visible over 12 years of professional performing.

Her songwriting has flipped in the past few years. Frankie Raye used to build the music first and squeeze lyrics into it. Now the hook arrives first, often from a conversation or a road sign, and lives in her phone until a riff comes along that fits. A song she is recording this year began as a complaint about venues that want maximum energy on a minimum budget. Another began as a poem written from the passenger seat on a drive south. She performs that one, "Wasting Time," live during the episode.

On artificial intelligence she is unambiguous. Frankie Raye does not use it for music, and her objection is not about quality but about origin and consequence: the material was written by people, and the person who could have been hired to write a song for a friend was not hired. That position leads somewhere unexpected. If machine-generated tracks are charting, she reasons, then chasing that sound is chasing something that no longer rewards a human for reaching it. So she stopped. She writes what she wants and releases what she wants, and she has decided against the label path she once wanted, choosing instead a following small enough to know by name.

The measure she offers at the end of the conversation is not streams or signings. It is 50 people who bought tickets because they wanted to be in the room. That is a quieter ambition than the industry usually rewards, and it may be the only one currently under an artist's own control.

Sean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/

Frankie Raye, Singer-Songwriter | Website: https://frankieraye.com/

Frankie Raye Official Website: https://frankieraye.com/

Frankie Raye Live Show Schedule: https://frankieraye.com/live-show-schedule

Frankie Raye Electronic Press Kit: https://frankieraye.com/electronic-press-kit

Frankie Raye on Instagram: https://www.instagram.com/frankierayemusic/

Myrtle Beach Songwriters Festival, November 13-14, 2026: https://myrtlebeachsongwritersfestival.com/

Music Evolves: Sonic Frontiers Newsletter: https://www.linkedin.com/newsletters/7290890771828719616/

frankie raye, sean martin, independent artist, singer songwriter, songwriting process, working musician, live music economy, ai in music, cover songs, gigging, tampa bay music scene, independent music career, hook writing, music, creativity, art, artist, musician, music evolves, music podcast, music and technology podcast

More from Music Evolves: https://www.seanmartin.com/music-evolves-podcast

Music Evolves on YouTube: https://www.youtube.com/playlist?list=PLnYu0psdcllTRJ5du7hFDXjiugu-uNPtW

On Location with Sean and Marco: https://www.itspmagazine.com/on-location

ITSPmagazine YouTube Channel: https://www.youtube.com/@itspmagazine

Be sure to share and subscribe!

Automation and AI have flooded the sales and marketing side of the market, and Michael Parisi, Chief Growth Officer at Steel Patriot Partners, says the security leaders on the receiving end were already past capacity. The pitch tends to lead with the product rather than the problem. So many CISOs have stopped taking direct sales calls and started asking a different question: what VAR do you work with, and who can I buy you through?

That routing puts weight back on partners who know where a program has been and how to move it forward. Parisi describes a partner meeting during the week with RegScale and Wiz, with Steel Patriot Partners in the services role, and the recognition that the company is moving toward systems integration with engineering at the center. Software providers can supply the product. Aligning and configuring it against a specific set of business expectations is a different job.

What happens when that job has no owner? Tools get bought and the return never shows up. Parisi sees organizations spending on best of breed and failing to recognize ROI because the tools are not being used or configured against the business objective. The correction is engineering work rather than another purchase.

One client was told by its board to cut a significant portion of the IT and information security budget. Steel Patriot Partners looked for overlap, found three tools accomplishing the same business outcome, met the number, and exceeded it on cost savings. Parisi attributes the underlying problem to years of deferred maintenance on the stack, from teams with the appetite to buy tools and without the time to configure them.

He expects the consolidation the cloud market saw a decade ago to reach cybersecurity tooling and GRC, and puts a number on it: 48 main GRC providers today, roughly five within five years. Good enough, configured appropriately, beats best of breed sitting idle.

For CISOs building the next budget cycle, Parisi recommends bringing the sourcing closer in. Go to your anchor partners, ask what they are running next year and what worked this year, and skip the attempt to talk to everybody. Steel Patriot Partners co-founder Jason Ford has a line that fits alongside it. Have an open mind.

This is a Brand Spotlight. A Brand Spotlight is a ~15 minute conversation designed to explore the guest, their company, and what makes their approach unique. Learn more: https://www.studioc60.com/creation#spotlight

GUEST

Michael Parisi, Chief Growth Officer, Steel Patriot Partners

RESOURCES

Black Hat USA 2026 event coverage: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas

Steel Patriot Partners: https://www.steelpatriotpartners.com

Steel Patriot Partners at Black Hat USA 2026: https://www.steelpatriotpartners.com/events/black-hat-usa-2026

Steel Patriot Partners Insights: https://resources.steelpatriotpartners.com

Are you interested in telling your story?

KEYWORDS

michael parisi, steel patriot partners, sean martin, brand story, brand marketing, marketing podcast, brand spotlight, black hat usa 2026, ciso budget, channel partners, var, systems integrator, grc consolidation, security tool sprawl, licensing costs, roi, configuration, compliance, cybersecurity engineering, regscale, wiz

Crogl arrived at Black Hat USA 2026 with two announcements behind it. The week before the show, the company made a free download of its AI SOC agent generally available. On the morning of this conversation, it went public with a major global partner tied to the U.S. Department of Defense. Monzy Merza, Co-Founder and CEO of Crogl, ties both back to a position the company took three years ago, which is that customers should control their own data and a security product should be secure.

What does sovereignty mean in security operations? Less about geography, more about control and choice. Merza points to the electric utility that wants current AI technology inside an OT environment and historically had one path, which ran through the internet. Crogl is built to run closed off from the internet with its capability intact, which is what critical infrastructure operators, large banks, and defense organizations need to satisfy their own regulators.

There is a second reason, and it lands on intellectual property. A large financial institution holds knowledge about its customers that nobody else holds. If an outside party takes that data and builds derivative work from it, the institution has given away something it never intended to sell.

Can a sovereign deployment still be flexible? Merza makes the case that it can when the architecture is right. Customers bring whatever model they want, including models they build. Crogl creates a semantic layer across data stores without transforming, normalizing, or moving the data, so a field labeled one way in one data lake connects to its counterpart in the next. Federated querying and federated search were base principles from the start, and the company holds a patent on the approach. One customer runs a hundred terabytes a day across six data lakes.

The operational math is where it gets interesting for the business. An analyst who might close ten alerts in a shift can work fifty or sixty when the rest arrive with a verdict and documentation already attached. Risk drops because alerts actually get investigated, audit cycles move faster because the evidence is there when the auditor asks, and cost follows the data rather than the pipeline.

The reaction from practitioners is the part Merza keeps returning to. Rather than worrying about being replaced, the people he talks with are glad to skip the seventeen thousandth phishing email and spend that time on a blast radius question they could not get to before. One person went from a fresh install to a submitted investigation report in under ten minutes and posted about it publicly.

This is a Brand Spotlight. A Brand Spotlight is a ~15 minute conversation designed to explore the guest, their company, and what makes their approach unique. Learn more: https://www.studioc60.com/creation#spotlight

GUEST

Monzy Merza, Co-Founder and CEO of Crogl | On LinkedIn: https://www.linkedin.com/in/monzymerza/

RESOURCES

Black Hat USA 2026 event coverage: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas

Learn more about Crogl: https://www.crogl.com

Download Crogl: https://www.crogl.com/download

Crogl newsroom: https://www.crogl.com/newsroom

Are you interested in telling your story?

KEYWORDS

monzy merza, crogl, sean martin, brand story, brand marketing, marketing podcast, brand spotlight, black hat usa 2026, sovereign ai, ai soc, autonomous investigation, threat hunting, air gapped deployment, ot security, federated search, knowledge graph, alert triage, soc analyst workload, audit evidence, data sovereignty

At Black Hat USA 2026 in Las Vegas, Daniel Bardenstein, CEO and co-founder of Manifest Cyber, starts with a gap his team measured in a survey of security leaders and practitioners. Leadership described one version of what is happening with AI inside the enterprise. The people doing the hands-on work described another. Adoption keeps moving, and security teams are working to catch up.

So what is the real risk in AI security? Bardenstein puts less weight on non-determinism than most and more on ordinary poor software security, because AI is software. He walks through the OpenAI and Hugging Face incident, where models got out of sandboxes because the sandboxing was weak and the guardrails were missing. When Hugging Face went to use its own AI to defend and run forensics, the guardrails read the request as cyber activity and declined.

That fallback to an open weight model points to why he expects open weight adoption to accelerate. With frontier models, the provider sets the system prompt and treats it as intellectual property, so development teams inherit whatever was decided upstream. Open weight leaves more room to control the system prompt, the training data, and how the model gets deployed.

What does it mean to say AI has its own supply chain? Unless an organization controls how training data is sourced, housed, labeled, tagged, and modified, it is relying on something someone else built. Public datasets carry whatever is inside them, including personal and health data, licensing exposure, and material no one examined until models were trained and deployed. Models hosted on public hubs sit in the same category.

Two asks come up in most CISO conversations with Manifest Cyber. Visibility is one, and few organizations have an AI inventory covering which models run where, inside which applications, and which agents teams have stood up on their own. Third party risk is the other, since AI is getting built into vendor products whether a buyer asks for it or not. That turns model provenance into a trust question about the vendor.

Bardenstein started Manifest Cyber four years ago after responding to Log4Shell from the Pentagon, where the question was where one affected piece of code was running across everything the organization had built and bought. Years later, he finds few security leaders who could answer that question quickly about a poisoned model or dataset. His advice for CISOs is to know what is inside what the organization builds and buys, with particular attention to the parts it does not build.

This is a Brand Spotlight. A Brand Spotlight is a ~15 minute conversation designed to explore the guest, their company, and what makes their approach unique. Learn more: https://www.studioc60.com/creation#spotlight

GUEST

Daniel Bardenstein, CEO and Co-Founder, Manifest Cyber

RESOURCES

View all of our Black Hat USA 2026 coverage: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas

Learn more about Manifest Cyber: https://www.manifestcyber.com

Beyond the Black Box: How AI is Forcing a Rethink of Software Supply Chain (research report): https://www.manifestcyber.com/beyond-the-black-box-ai-report

Manifest Cyber on LinkedIn: https://www.linkedin.com/company/manifestcyber/

Are you interested in telling your story?

KEYWORDS

daniel bardenstein, manifest cyber, sean martin, brand story, brand marketing, marketing podcast, brand spotlight, ai supply chain security, software supply chain security, ai inventory, shadow ai, third party cyber risk, open weight models, frontier models, model provenance, hugging face, log4shell, ciso, agentic ai, black hat usa 2026