Best of LinkedIn: Black Hat Europe 2025

00:00:00: This episode is provided by Thomas Allgeier and Frennis, based on the most relevant LinkedIn posts about Black Hat Europe, twenty twenty-five.

00:00:07: Frennis supports ICT enterprises with market and competitive intelligence, decoding emerging technologies, customer insights, regulatory shifts, and competitor strategies.

00:00:17: So product teams and strategy leaders don't just react, but shape the future.

00:00:23: Welcome to the Deep Dive.

00:00:24: This week, we're cutting through all the noise from the huge Black Hat Europe, twenty twenty five conference in London.

00:00:30: Yeah, there's a lot of

00:00:31: it.

00:00:31: There always is.

00:00:32: Our goal is to filter out the hype and really deliver the most essential cybersecurity insights directly to you.

00:00:38: Black Hat is just, it's a technical fire hose.

00:00:40: It absolutely is.

00:00:41: And Black Hat Europe, it's unique because it's so focused on operational security, you know, practical innovation.

00:00:48: It's where researchers show you how they actually break things.

00:00:50: Right.

00:00:50: Which is why practitioners pay such close attention.

00:00:53: So what we're going to do is unpack the key trends we saw across LinkedIn from all the attendees, the researchers, the experts.

00:00:59: Things that matter right now.

00:01:01: And we've kind of clustered the highlights into four critical themes that tell a bigger story.

00:01:05: The central idea we saw really is this shift away from static defense towards something more like dynamic resilience.

00:01:13: A very important distinction.

00:01:14: It is.

00:01:16: And it means we have to look at... First, how AI security is maturing into this agentic revolution.

00:01:22: Second, what offensive security looks like today across cloud and legacy stuff.

00:01:26: And

00:01:26: the third piece has to be that shift toward organizational resilience.

00:01:30: Right.

00:01:31: Better visibility.

00:01:32: Yeah.

00:01:32: Hardening the supply chain.

00:01:33: Exactly.

00:01:34: And finally, we'll zoom out to the strategic and policy views that are shaping what comes next.

00:01:38: That narrative that moved from static defense to dynamic resilience.

00:01:42: That's perfect.

00:01:44: because it starts right where the industry is going.

00:01:46: AI.

00:01:46: Of course.

00:01:47: I mean, AI security was central, but the conversation has moved so quickly past just, you know, protecting the data or the model.

00:01:53: We're now talking about securing autonomous systems.

00:01:57: Agentic

00:01:58: AI.

00:01:58: Agentic AI.

00:01:59: These are systems that don't just analyze data.

00:02:02: They act on it.

00:02:02: They make real world decisions.

00:02:04: And that kind of operational shift, it demands immediate governance rate.

00:02:08: It has to.

00:02:08: Which is why initiatives like the launch of the OWASPEGENTIK AI Top Ten were so critical.

00:02:14: I saw Helen Oakley and others were heavily involved in that.

00:02:17: Yeah, that gives practitioners a real framework to focus on these new pretty dangerous vulnerabilities.

00:02:23: So

00:02:23: what's changed?

00:02:24: What's the new risk?

00:02:25: Well, the whole attack surface has changed.

00:02:28: We're securing the entire AI stack now, not just the model weights.

00:02:32: Ron Bitten, PhD, he highlighted how high quality submissions focused on exploitation in production.

00:02:39: In production?

00:02:40: Not in a lab.

00:02:40: Exactly.

00:02:41: Including research on how, get this, image downscaling artifacts.

00:02:45: The little distortions.

00:02:46: The

00:02:46: tiny distortions when you compress an image.

00:02:48: They can be weaponized to trigger hidden prompts in live systems.

00:02:52: Wow.

00:02:53: That's a next level supply chain attack just hiding in plain sight.

00:02:56: It is.

00:02:57: And it proves that even simple data processing can open up a new attack vector.

00:03:01: And the offensive community is already all over this.

00:03:03: I saw that attendees of the AI red teaming training, like Stefan Metler, were diving deep into multi-agent vulnerabilities.

00:03:11: Right.

00:03:11: And when we talk about techniques like Crescendo, GCG, PayR, and TAPI, for anyone listening who isn't deep in the weeds on this.

00:03:19: Which is most of us.

00:03:20: These

00:03:20: are not simple prompt injections.

00:03:22: They're sophisticated, often programmatic ways to exploit the agent's internal reasoning.

00:03:27: You're basically coercing it to bypass its own safety rules.

00:03:31: So you're exploiting the logic of the agent, not just the code.

00:03:34: Precisely.

00:03:35: Yeah.

00:03:35: And that raises the stakes so much, especially when these things are making autonomous decisions.

00:03:40: Dennis Belie made a critical point about this, the urgency of securing systems that

00:03:45: act.

00:03:45: What was it he said?

00:03:46: His line was just unforgettable.

00:03:48: LMMs don't fail loudly, they fail confidently.

00:03:51: Oof,

00:03:51: yeah.

00:03:52: That lack of a clear failure signal when a model makes a catastrophic mistake is just... It's terrifying in an enterprise setting.

00:03:59: Which

00:03:59: is why we have to use AI for defense too.

00:04:01: I saw a great post from Sharon Kumar and noting that the really cutting-edge AI security tools are hitting the arsenal stage as open-source projects now.

00:04:10: A community defense push.

00:04:12: A huge one.

00:04:13: Democratizing sophisticated defenses.

00:04:15: Yeah, we're talking about tools like Harbinger for Mandiant, which is like an AI co-pilot for a red team, helping them work faster.

00:04:20: Or Threat Shield, such a knockball was showing it off.

00:04:23: It's an AI-driven threat modeling assistant.

00:04:26: So designing security in from the start, not bolting it on.

00:04:29: Exactly.

00:04:30: And that concept... ties right into the last point on this theme.

00:04:33: Eduardo Gonzalez-Lanez pointed out a significant shift left in AI security.

00:04:38: Which in

00:04:39: testing earlier?

00:04:40: Way earlier.

00:04:41: Moving assurance into the development life cycle, not waiting to test things in production.

00:04:45: It's DevSecOps, but for systems that could, you know, go rogue.

00:04:49: Okay, so that shift left demands proactive testing.

00:04:52: But where are attackers actually putting that resilience to the test?

00:04:56: Ah, well that brings us right to our second theme.

00:04:59: pure offensive security research.

00:05:01: Where Black Hat is still the epicenter for breaking things.

00:05:05: Definitely.

00:05:05: And the research showed systemic attacks across the board, new cloud stuff, hardware, even deep inside old platforms.

00:05:12: So where do we start?

00:05:13: Cloud.

00:05:14: Let's

00:05:14: start with cloud.

00:05:15: Cloud Native Offense is maturing so quickly because those environments are just so complex.

00:05:22: Ashita Pandey presented Cube Shadow.

00:05:24: Cube

00:05:24: Shadow.

00:05:25: It's an advanced offensive Kubernetes red team framework.

00:05:28: and it's open source now, which tells you attackers are moving way past simple misconfigurations.

00:05:34: We're

00:05:34: talking systematic technical attacks designed to take over containerized environments at scale.

00:05:39: That's it.

00:05:40: But it's not all software, is it?

00:05:42: No, not at all.

00:05:43: Physical systems, deep hardware flaws, that's still a huge research area.

00:05:49: I saw a SOC web or Falknex was focused specifically on payments and card present technology.

00:05:54: The

00:05:54: hardware behind the transaction.

00:05:55: Exactly.

00:05:56: Yeah.

00:05:57: That kind of research is vital.

00:05:58: One flaw could impact millions of devices.

00:06:01: And they're making this knowledge more accessible.

00:06:03: Giorgio's Rumeleo has showcased PumePad.

00:06:05: What's that?

00:06:06: It's

00:06:06: an immersive hardware hacking learning platform.

00:06:09: It covers everything from reverse engineering PCBs to side channel attacks.

00:06:13: So it's about that knowledge transfer.

00:06:15: It's still central to the black cat ethos.

00:06:17: Absolutely.

00:06:18: And while cloud and hardware get the headlines, we can't forget the legacy stacks.

00:06:22: Right.

00:06:23: Martin B had a great reminder about the importance of mainframes.

00:06:27: So many enterprises still run their core financial and logistics processing

00:06:32: on them.

00:06:32: And they're often forgotten in modern security budgets.

00:06:35: Making them a high value, very low visibility target for a sophisticated actor.

00:06:41: And that systemic view is crucial.

00:06:43: Researchers are bringing modern tools to these old corners of the stack.

00:06:47: For instance, Mohit A. presented Iofhammer.

00:06:50: A fuzzing

00:06:51: tool.

00:06:51: A lightweight, parameter-centric fuzzing tool.

00:06:54: For listeners, fuzzing is basically just throwing intelligently crafted garbage at a system to see if it breaks or gives up a vulnerability.

00:07:01: And this just makes that process way more efficient.

00:07:03: It does.

00:07:04: But the sheer volume of vulnerabilities being found is creating its own crisis.

00:07:08: Which is where Jerry Gamblin's point comes in.

00:07:10: He was advocating for global CVE decentralization.

00:07:14: Arguing that our current centralized systems for tracking vulnerabilities just can't keep up.

00:07:19: It's a systemic problem in how we respond.

00:07:21: And speaking of what's hidden in the system, one of the most insightful bits of research I saw was noted by James Johnson from his Bitdefender colleagues.

00:07:29: Okay.

00:07:30: They showed that encryption is not a security panacea.

00:07:32: You mean

00:07:33: even encryption?

00:07:33: to traffic can leak information.

00:07:35: A

00:07:35: lot of it.

00:07:36: The metadata, the packet size, the timing.

00:07:39: It can still reveal important details about devices and user behavior.

00:07:43: Encryption hides the content, but the conversation patterns still tell the story.

00:07:47: That is exactly the kind of forensic low-level research that makes Black Hat what it is.

00:07:53: OK, so let's pivot from breaking things to fixing things, the stuff that translates directly into enterprise budgets.

00:08:00: Our third theme, right?

00:08:01: Software supply chain.

00:08:03: operational resilience and visibility.

00:08:05: Yes.

00:08:06: This is all about the practical solutions for what keeps EISOs up at night.

00:08:11: Supply chain chaos and just drowning in alerts.

00:08:14: Well, on the supply chain side, the fight against dependency confusion is definitely ramping up.

00:08:19: Where an attacker tricks your build system into pulling a malicious package instead of a legitimate one.

00:08:24: Right.

00:08:24: Harsh Farajah presented a tool called Dep Confuse.

00:08:27: It's an S-bomb first tool designed to proactively find those vulnerabilities before they get exploited.

00:08:33: So, from detection to prevention.

00:08:35: then, I saw Yadu Krishna M. introduced supply shield.

00:08:39: And that's a CICD native framework that does something really critical.

00:08:43: It uses EPSS-based prioritization.

00:08:45: The exploit prediction scoring system.

00:08:48: Which is a huge improvement.

00:08:49: It forces div teams to focus not on the number of vulnerabilities, but on the handful that are actually likely to be exploited.

00:08:56: Context.

00:08:57: It's context-driven prioritization.

00:08:59: Context is everything.

00:09:01: And the attack surface just keeps expanding.

00:09:03: Subho Holder demonstrated knock-spy.

00:09:05: For mobile?

00:09:06: Yeah, a technique for real-time API interception in MDM-locked mobile apps.

00:09:11: So even your tightly managed enterprise phones are still vulnerable.

00:09:15: And the perimeter's going way beyond logical networks too.

00:09:18: Robin Wilding Webb highlighted the growing importance of physical security.

00:09:21: You're talking about distributed acoustic sensing or DOS.

00:09:24: Exactly.

00:09:25: For fiber, pipelines, rail lines, you're basically turning the entire fiber optic cable into a giant microphone.

00:09:32: Or a tripwire.

00:09:34: Listening for vibrations that signal tampering.

00:09:36: It's extending monitoring way beyond the IT layer.

00:09:39: Which brings us right back to visibility.

00:09:41: If you're going to monitor everything, you need high fidelity data.

00:09:45: Austin SM noted this.

00:09:47: The demo has all proved that the quality of your telemetry is directly linked to faster, more confident decisions.

00:09:54: Bad data means slow response.

00:09:56: It's alert fatigue.

00:09:57: It's a mess.

00:09:58: And that's why there was so much buzz around DSPM, data security posture management.

00:10:03: Yeah, Alvin Kamara really drove this home.

00:10:05: Visibility is king.

00:10:06: You cannot protect data, you cannot see.

00:10:08: DSPM forces you to map and classify your data first.

00:10:12: Where it is, who has access, it flips the old perimeter model on its head.

00:10:15: And that all feeds back into the SOC.

00:10:17: The big NOC coverage supported by people like Liz Pinder and Jessica Bear Oppenheimer, it all highlighted this need for integrated operations for less manual overhead.

00:10:27: which

00:10:27: leads directly to next-gen MDR as Aachenbrand was discussing, fighting automation with smarter automation.

00:10:33: Okay, so for our final theme, let's pull back.

00:10:36: Let's look at the broader strategic issues that things influencing spending and policy.

00:10:40: I think we have to start with Max meets keynote on ransomware.

00:10:43: Yes,

00:10:44: the trust paradox.

00:10:45: Exactly.

00:10:46: For a ransomware payment to even work, the victim has to trust the attacker to delete the data.

00:10:52: or provide a working key.

00:10:53: Which

00:10:54: is absurd when you think about it.

00:10:56: And with law enforcement operations like Kronos taking down groups like Lockbit, it just reinforces the best advice.

00:11:01: Don't pay.

00:11:02: Don't pay.

00:11:03: break their business model.

00:11:04: And that message is echoing across the entire financial sector.

00:11:08: I saw Frank Chinard and Harvey Green noted this critical shift toward integrating fraud and cyber risk management.

00:11:15: They're realizing it's no longer two separate silos.

00:11:17: It's

00:11:17: one single intertwined battlefield.

00:11:21: It needs combined leadership.

00:11:23: And while those threats are immediate, you have things like post-quantum cryptography, PQC that are looming.

00:11:28: It's a renderer.

00:11:28: Panna highlighted that it's not feature talk anymore.

00:11:31: It's a real present opportunity for crypto resilience.

00:11:34: The time to plan your crypto agility roadmap is now, not when the quantum computers show

00:11:39: up.

00:11:39: And what about on the policy side?

00:11:41: Well, Dr.

00:11:42: Anjuli R.K.

00:11:43: Shear and Jen Ellis hosted important sessions on UK cyber policy, specifically the Cybersecurity and Resilience Bill, the CSRB.

00:11:50: giving practitioners a chance to actually influence the details of the legislation.

00:11:55: Which is so important.

00:11:56: Bringing that ground level experience into how the compliance requirements are actually written.

00:12:01: Okay, and finally, we have to touch on the threat actors themselves.

00:12:04: Their motivations seems to be evolving.

00:12:06: Yeah, this was fascinating.

00:12:07: Matthew Pittington highlighted a point from the BBC's Joe Tidy.

00:12:11: That the biggest, most unpredictable threats aren't always sophisticated nation-states or organized crime.

00:12:17: No.

00:12:18: Often, they're teenagers chasing fame and clout on forums.

00:12:22: Which makes defense inherently less predictable, right?

00:12:25: Totally.

00:12:26: And it means we have to invest in education and early intervention, not just more fear-driven regulation.

00:12:32: It's a social problem as much as a technical

00:12:34: one.

00:12:34: So when you tie it all together... The recurring

00:12:36: themes are pretty clear.

00:12:37: The maturation of AI security, the persistence of risk in legacy systems, like the Project Brain Fog findings.

00:12:44: and that big move toward resilience over rigid compliance, which people like Linus women were advocating for.

00:12:51: It all just confirms that security isn't a destination.

00:12:54: It's this ongoing, continuous journey.

00:12:57: It requires practical engagement at every single level of the stack.

00:13:01: And that leads directly to what I thought was the most provocative takeaway of the whole event.

00:13:06: It came from Virgil Octavian Tiuka, who was channeling a Key Sands recommendation.

00:13:11: Okay, what was it?

00:13:12: that the security mindset has to fundamentally shift from purely defensive strategies to a monitor-first approach.

00:13:18: The monitor-first

00:13:19: approach.

00:13:20: The concept is simple, but it's profound, and it integrates every single point we've talked about.

00:13:25: Assume breach, monitor everything, and respond rapidly.

00:13:28: Wow.

00:13:29: So if AI is failing confidently and encrypted traffic is still leaking secrets?

00:13:33: And if the threat actor is an unpredictable teenager, you just have to assume your perimeter will fail.

00:13:38: Visibility and response.

00:13:39: That's the ultimate defense now.

00:13:41: If you enjoyed this episode, new episodes drop every two weeks.

00:13:44: Also check out our other editions on cloud, defense tech, digital products and services, artificial intelligence, ICT and tech insights, sustainability and green ICT, defense tech and health

00:13:54: tech.

00:13:55: Thank you for joining us for this deep dive into Black Hat Europe, twenty twenty five.

00:13:59: Subscribe to ensure you never miss a deep dive.