Latest / Best of LinkedIn: Digital Transformation & Tech / Best of LinkedIn: Black Hat Europe 2025

Transcript

Best of LinkedIn: Black Hat Europe 2025 · Best of LinkedIn: Digital Transformation & Tech

• 0:00
  Speaker 1: This episode is provided by Thomas Allgeier and Frennis, based on the most relevant LinkedIn posts about Black Hat Europe, twenty twenty-five.
• 0:07
  Speaker 1: Frennis supports ICT enterprises with market and competitive intelligence, decoding emerging technologies, customer insights, regulatory shifts, and competitor strategies.
• 0:17
  Speaker 1: So product teams and strategy leaders don't just react, but shape the future.
• 0:23
  Speaker 1: Welcome to the Deep Dive.
• 0:24
  Speaker 1: This week, we're cutting through all the noise from the huge Black Hat Europe, twenty twenty five conference in London.
• 0:30
  Speaker 0: Yeah, there's a lot of
• 0:31
  Speaker 1: it.
• 0:31
  Speaker 1: There always is.
• 0:32
  Speaker 1: Our goal is to filter out the hype and really deliver the most essential cybersecurity insights directly to you.
• 0:38
  Speaker 1: Black Hat is just, it's a technical fire hose.
• 0:40
  Speaker 0: It absolutely is.
• 0:41
  Speaker 0: And Black Hat Europe, it's unique because it's so focused on operational security, you know, practical innovation.
• 0:48
  Speaker 0: It's where researchers show you how they actually break things.
• 0:50
  Speaker 0: Right.
• 0:50
  Speaker 0: Which is why practitioners pay such close attention.
• 0:53
  Speaker 0: So what we're going to do is unpack the key trends we saw across LinkedIn from all the attendees, the researchers, the experts.
• 0:59
  Speaker 1: Things that matter right now.
• 1:01
  Speaker 1: And we've kind of clustered the highlights into four critical themes that tell a bigger story.
• 1:05
  Speaker 1: The central idea we saw really is this shift away from static defense towards something more like dynamic resilience.
• 1:13
  Speaker 0: A very important distinction.
• 1:14
  Speaker 1: It is.
• 1:16
  Speaker 1: And it means we have to look at... First, how AI security is maturing into this agentic revolution.
• 1:22
  Speaker 1: Second, what offensive security looks like today across cloud and legacy stuff.
• 1:26
  Speaker 1: And
• 1:26
  Speaker 0: the third piece has to be that shift toward organizational resilience.
• 1:30
  Speaker 0: Right.
• 1:31
  Speaker 0: Better visibility.
• 1:32
  Speaker 0: Yeah.
• 1:32
  Speaker 0: Hardening the supply chain.
• 1:33
  Speaker 1: Exactly.
• 1:34
  Speaker 1: And finally, we'll zoom out to the strategic and policy views that are shaping what comes next.
• 1:38
  Speaker 0: That narrative that moved from static defense to dynamic resilience.
• 1:42
  Speaker 0: That's perfect.
• 1:44
  Speaker 0: because it starts right where the industry is going.
• 1:46
  Speaker 0: AI.
• 1:46
  Speaker 0: Of course.
• 1:47
  Speaker 0: I mean, AI security was central, but the conversation has moved so quickly past just, you know, protecting the data or the model.
• 1:53
  Speaker 0: We're now talking about securing autonomous systems.
• 1:57
  Speaker 1: Agentic
• 1:58
  Speaker 0: AI.
• 1:58
  Speaker 0: Agentic AI.
• 1:59
  Speaker 0: These are systems that don't just analyze data.
• 2:02
  Speaker 0: They act on it.
• 2:02
  Speaker 0: They make real world decisions.
• 2:04
  Speaker 1: And that kind of operational shift, it demands immediate governance rate.
• 2:08
  Speaker 0: It has to.
• 2:08
  Speaker 1: Which is why initiatives like the launch of the OWASPEGENTIK AI Top Ten were so critical.
• 2:14
  Speaker 1: I saw Helen Oakley and others were heavily involved in that.
• 2:17
  Speaker 0: Yeah, that gives practitioners a real framework to focus on these new pretty dangerous vulnerabilities.
• 2:23
  Speaker 0: So
• 2:23
  Speaker 1: what's changed?
• 2:24
  Speaker 1: What's the new risk?
• 2:25
  Speaker 0: Well, the whole attack surface has changed.
• 2:28
  Speaker 0: We're securing the entire AI stack now, not just the model weights.
• 2:32
  Speaker 0: Ron Bitten, PhD, he highlighted how high quality submissions focused on exploitation in production.
• 2:39
  Speaker 1: In production?
• 2:40
  Speaker 1: Not in a lab.
• 2:40
  Speaker 0: Exactly.
• 2:41
  Speaker 0: Including research on how, get this, image downscaling artifacts.
• 2:45
  Speaker 1: The little distortions.
• 2:46
  Speaker 1: The
• 2:46
  Speaker 0: tiny distortions when you compress an image.
• 2:48
  Speaker 0: They can be weaponized to trigger hidden prompts in live systems.
• 2:52
  Speaker 1: Wow.
• 2:53
  Speaker 1: That's a next level supply chain attack just hiding in plain sight.
• 2:56
  Speaker 0: It is.
• 2:57
  Speaker 0: And it proves that even simple data processing can open up a new attack vector.
• 3:01
  Speaker 1: And the offensive community is already all over this.
• 3:03
  Speaker 1: I saw that attendees of the AI red teaming training, like Stefan Metler, were diving deep into multi-agent vulnerabilities.
• 3:11
  Speaker 0: Right.
• 3:11
  Speaker 0: And when we talk about techniques like Crescendo, GCG, PayR, and TAPI, for anyone listening who isn't deep in the weeds on this.
• 3:19
  Speaker 1: Which is most of us.
• 3:20
  Speaker 1: These
• 3:20
  Speaker 0: are not simple prompt injections.
• 3:22
  Speaker 0: They're sophisticated, often programmatic ways to exploit the agent's internal reasoning.
• 3:27
  Speaker 0: You're basically coercing it to bypass its own safety rules.
• 3:31
  Speaker 1: So you're exploiting the logic of the agent, not just the code.
• 3:34
  Speaker 0: Precisely.
• 3:35
  Speaker 0: Yeah.
• 3:35
  Speaker 0: And that raises the stakes so much, especially when these things are making autonomous decisions.
• 3:40
  Speaker 1: Dennis Belie made a critical point about this, the urgency of securing systems that
• 3:45
  Speaker 0: act.
• 3:45
  Speaker 0: What was it he said?
• 3:46
  Speaker 1: His line was just unforgettable.
• 3:48
  Speaker 1: LMMs don't fail loudly, they fail confidently.
• 3:51
  Speaker 1: Oof,
• 3:51
  Speaker 0: yeah.
• 3:52
  Speaker 1: That lack of a clear failure signal when a model makes a catastrophic mistake is just... It's terrifying in an enterprise setting.
• 3:59
  Speaker 1: Which
• 3:59
  Speaker 0: is why we have to use AI for defense too.
• 4:01
  Speaker 0: I saw a great post from Sharon Kumar and noting that the really cutting-edge AI security tools are hitting the arsenal stage as open-source projects now.
• 4:10
  Speaker 1: A community defense push.
• 4:12
  Speaker 0: A huge one.
• 4:13
  Speaker 0: Democratizing sophisticated defenses.
• 4:15
  Speaker 1: Yeah, we're talking about tools like Harbinger for Mandiant, which is like an AI co-pilot for a red team, helping them work faster.
• 4:20
  Speaker 0: Or Threat Shield, such a knockball was showing it off.
• 4:23
  Speaker 0: It's an AI-driven threat modeling assistant.
• 4:26
  Speaker 1: So designing security in from the start, not bolting it on.
• 4:29
  Speaker 0: Exactly.
• 4:30
  Speaker 0: And that concept... ties right into the last point on this theme.
• 4:33
  Speaker 0: Eduardo Gonzalez-Lanez pointed out a significant shift left in AI security.
• 4:38
  Speaker 0: Which in
• 4:39
  Speaker 1: testing earlier?
• 4:40
  Speaker 0: Way earlier.
• 4:41
  Speaker 0: Moving assurance into the development life cycle, not waiting to test things in production.
• 4:45
  Speaker 0: It's DevSecOps, but for systems that could, you know, go rogue.
• 4:49
  Speaker 1: Okay, so that shift left demands proactive testing.
• 4:52
  Speaker 1: But where are attackers actually putting that resilience to the test?
• 4:56
  Speaker 0: Ah, well that brings us right to our second theme.
• 4:59
  Speaker 0: pure offensive security research.
• 5:01
  Speaker 1: Where Black Hat is still the epicenter for breaking things.
• 5:05
  Speaker 1: Definitely.
• 5:05
  Speaker 0: And the research showed systemic attacks across the board, new cloud stuff, hardware, even deep inside old platforms.
• 5:12
  Speaker 1: So where do we start?
• 5:13
  Speaker 1: Cloud.
• 5:14
  Speaker 1: Let's
• 5:14
  Speaker 0: start with cloud.
• 5:15
  Speaker 0: Cloud Native Offense is maturing so quickly because those environments are just so complex.
• 5:22
  Speaker 0: Ashita Pandey presented Cube Shadow.
• 5:24
  Speaker 0: Cube
• 5:24
  Speaker 1: Shadow.
• 5:25
  Speaker 0: It's an advanced offensive Kubernetes red team framework.
• 5:28
  Speaker 0: and it's open source now, which tells you attackers are moving way past simple misconfigurations.
• 5:34
  Speaker 0: We're
• 5:34
  Speaker 1: talking systematic technical attacks designed to take over containerized environments at scale.
• 5:39
  Speaker 0: That's it.
• 5:40
  Speaker 0: But it's not all software, is it?
• 5:42
  Speaker 1: No, not at all.
• 5:43
  Speaker 1: Physical systems, deep hardware flaws, that's still a huge research area.
• 5:49
  Speaker 1: I saw a SOC web or Falknex was focused specifically on payments and card present technology.
• 5:54
  Speaker 1: The
• 5:54
  Speaker 0: hardware behind the transaction.
• 5:55
  Speaker 1: Exactly.
• 5:56
  Speaker 1: Yeah.
• 5:57
  Speaker 1: That kind of research is vital.
• 5:58
  Speaker 1: One flaw could impact millions of devices.
• 6:01
  Speaker 0: And they're making this knowledge more accessible.
• 6:03
  Speaker 0: Giorgio's Rumeleo has showcased PumePad.
• 6:05
  Speaker 1: What's that?
• 6:06
  Speaker 1: It's
• 6:06
  Speaker 0: an immersive hardware hacking learning platform.
• 6:09
  Speaker 0: It covers everything from reverse engineering PCBs to side channel attacks.
• 6:13
  Speaker 1: So it's about that knowledge transfer.
• 6:15
  Speaker 1: It's still central to the black cat ethos.
• 6:17
  Speaker 0: Absolutely.
• 6:18
  Speaker 0: And while cloud and hardware get the headlines, we can't forget the legacy stacks.
• 6:22
  Speaker 1: Right.
• 6:23
  Speaker 1: Martin B had a great reminder about the importance of mainframes.
• 6:27
  Speaker 1: So many enterprises still run their core financial and logistics processing
• 6:32
  Speaker 0: on them.
• 6:32
  Speaker 0: And they're often forgotten in modern security budgets.
• 6:35
  Speaker 1: Making them a high value, very low visibility target for a sophisticated actor.
• 6:41
  Speaker 0: And that systemic view is crucial.
• 6:43
  Speaker 0: Researchers are bringing modern tools to these old corners of the stack.
• 6:47
  Speaker 0: For instance, Mohit A. presented Iofhammer.
• 6:50
  Speaker 0: A fuzzing
• 6:51
  Speaker 1: tool.
• 6:51
  Speaker 0: A lightweight, parameter-centric fuzzing tool.
• 6:54
  Speaker 0: For listeners, fuzzing is basically just throwing intelligently crafted garbage at a system to see if it breaks or gives up a vulnerability.
• 7:01
  Speaker 1: And this just makes that process way more efficient.
• 7:03
  Speaker 0: It does.
• 7:04
  Speaker 0: But the sheer volume of vulnerabilities being found is creating its own crisis.
• 7:08
  Speaker 1: Which is where Jerry Gamblin's point comes in.
• 7:10
  Speaker 1: He was advocating for global CVE decentralization.
• 7:14
  Speaker 0: Arguing that our current centralized systems for tracking vulnerabilities just can't keep up.
• 7:19
  Speaker 0: It's a systemic problem in how we respond.
• 7:21
  Speaker 1: And speaking of what's hidden in the system, one of the most insightful bits of research I saw was noted by James Johnson from his Bitdefender colleagues.
• 7:29
  Speaker 0: Okay.
• 7:30
  Speaker 1: They showed that encryption is not a security panacea.
• 7:32
  Speaker 1: You mean
• 7:33
  Speaker 0: even encryption?
• 7:33
  Speaker 0: to traffic can leak information.
• 7:35
  Speaker 0: A
• 7:35
  Speaker 1: lot of it.
• 7:36
  Speaker 1: The metadata, the packet size, the timing.
• 7:39
  Speaker 1: It can still reveal important details about devices and user behavior.
• 7:43
  Speaker 1: Encryption hides the content, but the conversation patterns still tell the story.
• 7:47
  Speaker 0: That is exactly the kind of forensic low-level research that makes Black Hat what it is.
• 7:53
  Speaker 1: OK, so let's pivot from breaking things to fixing things, the stuff that translates directly into enterprise budgets.
• 8:00
  Speaker 0: Our third theme, right?
• 8:01
  Speaker 0: Software supply chain.
• 8:03
  Speaker 0: operational resilience and visibility.
• 8:05
  Speaker 1: Yes.
• 8:06
  Speaker 1: This is all about the practical solutions for what keeps EISOs up at night.
• 8:11
  Speaker 1: Supply chain chaos and just drowning in alerts.
• 8:14
  Speaker 0: Well, on the supply chain side, the fight against dependency confusion is definitely ramping up.
• 8:19
  Speaker 1: Where an attacker tricks your build system into pulling a malicious package instead of a legitimate one.
• 8:24
  Speaker 1: Right.
• 8:24
  Speaker 0: Harsh Farajah presented a tool called Dep Confuse.
• 8:27
  Speaker 0: It's an S-bomb first tool designed to proactively find those vulnerabilities before they get exploited.
• 8:33
  Speaker 1: So, from detection to prevention.
• 8:35
  Speaker 1: then, I saw Yadu Krishna M. introduced supply shield.
• 8:39
  Speaker 0: And that's a CICD native framework that does something really critical.
• 8:43
  Speaker 0: It uses EPSS-based prioritization.
• 8:45
  Speaker 1: The exploit prediction scoring system.
• 8:48
  Speaker 0: Which is a huge improvement.
• 8:49
  Speaker 0: It forces div teams to focus not on the number of vulnerabilities, but on the handful that are actually likely to be exploited.
• 8:56
  Speaker 1: Context.
• 8:57
  Speaker 1: It's context-driven prioritization.
• 8:59
  Speaker 0: Context is everything.
• 9:01
  Speaker 0: And the attack surface just keeps expanding.
• 9:03
  Speaker 0: Subho Holder demonstrated knock-spy.
• 9:05
  Speaker 1: For mobile?
• 9:06
  Speaker 0: Yeah, a technique for real-time API interception in MDM-locked mobile apps.
• 9:11
  Speaker 0: So even your tightly managed enterprise phones are still vulnerable.
• 9:15
  Speaker 1: And the perimeter's going way beyond logical networks too.
• 9:18
  Speaker 1: Robin Wilding Webb highlighted the growing importance of physical security.
• 9:21
  Speaker 0: You're talking about distributed acoustic sensing or DOS.
• 9:24
  Speaker 1: Exactly.
• 9:25
  Speaker 1: For fiber, pipelines, rail lines, you're basically turning the entire fiber optic cable into a giant microphone.
• 9:32
  Speaker 0: Or a tripwire.
• 9:34
  Speaker 0: Listening for vibrations that signal tampering.
• 9:36
  Speaker 0: It's extending monitoring way beyond the IT layer.
• 9:39
  Speaker 1: Which brings us right back to visibility.
• 9:41
  Speaker 1: If you're going to monitor everything, you need high fidelity data.
• 9:45
  Speaker 0: Austin SM noted this.
• 9:47
  Speaker 0: The demo has all proved that the quality of your telemetry is directly linked to faster, more confident decisions.
• 9:54
  Speaker 1: Bad data means slow response.
• 9:56
  Speaker 0: It's alert fatigue.
• 9:57
  Speaker 0: It's a mess.
• 9:58
  Speaker 1: And that's why there was so much buzz around DSPM, data security posture management.
• 10:03
  Speaker 0: Yeah, Alvin Kamara really drove this home.
• 10:05
  Speaker 0: Visibility is king.
• 10:06
  Speaker 0: You cannot protect data, you cannot see.
• 10:08
  Speaker 1: DSPM forces you to map and classify your data first.
• 10:12
  Speaker 1: Where it is, who has access, it flips the old perimeter model on its head.
• 10:15
  Speaker 0: And that all feeds back into the SOC.
• 10:17
  Speaker 0: The big NOC coverage supported by people like Liz Pinder and Jessica Bear Oppenheimer, it all highlighted this need for integrated operations for less manual overhead.
• 10:27
  Speaker 0: which
• 10:27
  Speaker 1: leads directly to next-gen MDR as Aachenbrand was discussing, fighting automation with smarter automation.
• 10:33
  Speaker 0: Okay, so for our final theme, let's pull back.
• 10:36
  Speaker 0: Let's look at the broader strategic issues that things influencing spending and policy.
• 10:40
  Speaker 1: I think we have to start with Max meets keynote on ransomware.
• 10:43
  Speaker 1: Yes,
• 10:44
  Speaker 0: the trust paradox.
• 10:45
  Speaker 1: Exactly.
• 10:46
  Speaker 1: For a ransomware payment to even work, the victim has to trust the attacker to delete the data.
• 10:52
  Speaker 1: or provide a working key.
• 10:53
  Speaker 1: Which
• 10:54
  Speaker 0: is absurd when you think about it.
• 10:56
  Speaker 0: And with law enforcement operations like Kronos taking down groups like Lockbit, it just reinforces the best advice.
• 11:01
  Speaker 0: Don't pay.
• 11:02
  Speaker 0: Don't pay.
• 11:03
  Speaker 0: break their business model.
• 11:04
  Speaker 1: And that message is echoing across the entire financial sector.
• 11:08
  Speaker 1: I saw Frank Chinard and Harvey Green noted this critical shift toward integrating fraud and cyber risk management.
• 11:15
  Speaker 0: They're realizing it's no longer two separate silos.
• 11:17
  Speaker 0: It's
• 11:17
  Speaker 1: one single intertwined battlefield.
• 11:21
  Speaker 1: It needs combined leadership.
• 11:23
  Speaker 0: And while those threats are immediate, you have things like post-quantum cryptography, PQC that are looming.
• 11:28
  Speaker 1: It's a renderer.
• 11:28
  Speaker 1: Panna highlighted that it's not feature talk anymore.
• 11:31
  Speaker 1: It's a real present opportunity for crypto resilience.
• 11:34
  Speaker 0: The time to plan your crypto agility roadmap is now, not when the quantum computers show
• 11:39
  Speaker 1: up.
• 11:39
  Speaker 1: And what about on the policy side?
• 11:41
  Speaker 0: Well, Dr.
• 11:42
  Speaker 0: Anjuli R.K.
• 11:43
  Speaker 0: Shear and Jen Ellis hosted important sessions on UK cyber policy, specifically the Cybersecurity and Resilience Bill, the CSRB.
• 11:50
  Speaker 1: giving practitioners a chance to actually influence the details of the legislation.
• 11:55
  Speaker 0: Which is so important.
• 11:56
  Speaker 0: Bringing that ground level experience into how the compliance requirements are actually written.
• 12:01
  Speaker 1: Okay, and finally, we have to touch on the threat actors themselves.
• 12:04
  Speaker 1: Their motivations seems to be evolving.
• 12:06
  Speaker 0: Yeah, this was fascinating.
• 12:07
  Speaker 0: Matthew Pittington highlighted a point from the BBC's Joe Tidy.
• 12:11
  Speaker 1: That the biggest, most unpredictable threats aren't always sophisticated nation-states or organized crime.
• 12:17
  Speaker 0: No.
• 12:18
  Speaker 0: Often, they're teenagers chasing fame and clout on forums.
• 12:22
  Speaker 1: Which makes defense inherently less predictable, right?
• 12:25
  Speaker 1: Totally.
• 12:26
  Speaker 0: And it means we have to invest in education and early intervention, not just more fear-driven regulation.
• 12:32
  Speaker 0: It's a social problem as much as a technical
• 12:34
  Speaker 1: one.
• 12:34
  Speaker 1: So when you tie it all together... The recurring
• 12:36
  Speaker 0: themes are pretty clear.
• 12:37
  Speaker 0: The maturation of AI security, the persistence of risk in legacy systems, like the Project Brain Fog findings.
• 12:44
  Speaker 1: and that big move toward resilience over rigid compliance, which people like Linus women were advocating for.
• 12:51
  Speaker 0: It all just confirms that security isn't a destination.
• 12:54
  Speaker 0: It's this ongoing, continuous journey.
• 12:57
  Speaker 0: It requires practical engagement at every single level of the stack.
• 13:01
  Speaker 1: And that leads directly to what I thought was the most provocative takeaway of the whole event.
• 13:06
  Speaker 1: It came from Virgil Octavian Tiuka, who was channeling a Key Sands recommendation.
• 13:11
  Speaker 0: Okay, what was it?
• 13:12
  Speaker 1: that the security mindset has to fundamentally shift from purely defensive strategies to a monitor-first approach.
• 13:18
  Speaker 0: The monitor-first
• 13:19
  Speaker 1: approach.
• 13:20
  Speaker 1: The concept is simple, but it's profound, and it integrates every single point we've talked about.
• 13:25
  Speaker 1: Assume breach, monitor everything, and respond rapidly.
• 13:28
  Speaker 0: Wow.
• 13:29
  Speaker 0: So if AI is failing confidently and encrypted traffic is still leaking secrets?
• 13:33
  Speaker 1: And if the threat actor is an unpredictable teenager, you just have to assume your perimeter will fail.
• 13:38
  Speaker 1: Visibility and response.
• 13:39
  Speaker 1: That's the ultimate defense now.
• 13:41
  Speaker 1: If you enjoyed this episode, new episodes drop every two weeks.
• 13:44
  Speaker 1: Also check out our other editions on cloud, defense tech, digital products and services, artificial intelligence, ICT and tech insights, sustainability and green ICT, defense tech and health
• 13:54
  Speaker 0: tech.
• 13:55
  Speaker 0: Thank you for joining us for this deep dive into Black Hat Europe, twenty twenty five.
• 13:59
  Speaker 1: Subscribe to ensure you never miss a deep dive.