Black Hat 2025 is on its home stretch, having gathered together thousands of security professionals to discuss the latest developments in adversarial tradecraft and cybersecurity defense.
Security leaders and teams explored AI-driven threats and innovations, with a focus on the dangers lurking in autonomous AI agents and shadow AI, the acceleration of identity-based attacks, and the critical importance of hardware-level security and supply-chain protection.
The conference also included a dizzying number of new product and update announcements, mostly focusing on (surprise) AI. Here’s a look at some of them.
SOCRadar launches Agentic Threat Intelligence
SOCRadar’s new agents in its Agentic Threat Intelligence platform understand threat context, identify appropriate courses of action, and autonomously trigger responses. The agents specialize in different threats, such as phishing, IP exposure, or credential leaks, and can be mixed and matched and customized.
SOCRadar is also launching what it calls the first cybersecurity AI marketplace, where security teams can browse, purchase, and manage agents.
Snyk secures AI from inception
Snyk’s new platform capability, Secure at Inception, includes real-time security scanning that begins at the moment of code generation or execution. It offers visibility into generative AI, agentic, and model context protocol (MCP) components in software, and also features a new, experimental scanner for detecting AI-specific MCP vulnerabilities.
Secure AI Inception is now available in early access.
AirMDR AI SOC handles majority of Tier-1 alert triage
AirMDR says its new AI SOC platform automates more than 90% of Tier-1 alert triage. Security teams can perform one-click, sub-5-minute root cause analysis and autonomous response. Designed for managed security service providers (MSSPs), its multi-tenant operations keep customer data isolated by centrally triaging and investigating alerts. The platform offers 200–plus native integrations and full audit trains.
AirMDR also introduced a “free forever” plan that supports up to three data sources and 100 alerts per week.
Descope manages AI agents
Descope’s agentic identity control plane institutes policy-based governance, auditing, and identity management for AI agents and MCP environments.
The platform gives security teams the ability to restrict agent access within specific third-party tools and lets them enact policies based on user roles. Monitoring and auditing capabilities help users spot errors and misconfigurations and identify “rogue agents.” AI lifecycle management provides visibility into agent behavior and links with human users.
Cyera secures all types of AI
Cyera’s AI Guardian secures any type of AI, from public tools like ChatGPT to embedded software-as-a-service (SaaS) models and proprietary platforms. The platform has two core products: AI-SPM (security posture management), which provides inventory of all AI assets; and AI Runtime Protection, which monitors and responds to risks in real-time. AI Guardian also features Omni AI, a new conversational AI tool that can analyze millions of enterprise records in seconds, and creates security reports to help remediate threats.
AI-SPM and Omni AI are available in private beta; AI Runtime Protection is available for early access.
Netskope One copilot
Netskope One now offers a copilot for zero trust network access (ZTNA) and a Netskope MCP server. The AI-powered copilot optimizes ZTNA, automatically recommends policies for newly-discovered applications, and configures apps and policies. The tool is now generally available.
Netskope MCP server allows popular LLMs such as Claude, Microsoft Copilot, Amazon Bedrock, and Google Vertex to interact with Netskope management APIs to gain context to improve workflows. The server includes several example scenarios, including incident analysis and status, and insider risk analysis.
Flashpoint’s AI-powered summarization for search and investigation
Flashpoint Ignite now includes AI summarization of search and investigations. Search summarization is directly incorporated into workflows; with one click, teams can gain insights into discussions from dark web forums, social networks, and chat platforms. These are provided in footnoted snapshots.
AI investigation summarization is built into Ignite, automatically producing reference-backed summaries. Users can regenerate, summarize, and share investigation findings via PDF or plaintext files. These findings stay up to date as investigations evolve.
Cyware also incorporates MCP
Cyware’s MCP Server integrates LLMs directly into workflows to provide real-time context and control across detection and response. MCP Server is incorporated into Cyware’s Quarterback AI, which features automated summarization and smart parsing, where embedded AI agents surface indicators of compromise (IOCs), adversary TTPs, malware, and vulnerabilities. It also offers recommendations from threat intelligence and alerts.
Palo Alto Networks expands Cortex Cloud
Palo Alto Networks’ Cortex Cloud now features application security posture management (ASPM) and an open AppSec partner ecosystem that shares proven tools and integrates findings from industry-leading scanners. Cortex Cloud surfaces critical risks and vulnerabilities, automates fixes, and automatically maps vulnerabilities and routes them to the relevant developer. Findings are correlated across the threat surface so that SOCs have the visibility to detect, prioritize, and respond to the most serious threats.
CrowdStrike Falcon Shield expands support for hundreds of apps
Falcon Shield is now integrated with the OpenAI ChatGPT Enterprise Compliance API to help teams see and govern GPT-based and Codex agents. This expands support for 175-plus SaaS apps.
Falcon Shield maps agents to their human creators to trace access, govern privileges and secure identities; detects risky behavior; and automatically contains threats via Falcon Fusion, CrowdStrike’s no-code security orchestration, automation, and response (SOAR engine).
AppOmni gives teams app control
AppOmni has released three new product packages to give enterprises control over their SaaS and AI apps. A “foundations” starter package discovers shadow SaaS and AI, app users and permissions, and threats and suspicious activities. An advanced tier adds more sophisticated threat detection and SaaS controls, while an enterprise package provides “the highest level of SaaS security maturity.”
The platform also features enhanced threat detection and support for 30 new AI and SaaS applications, including ChatGPT Enterprise, Claude, Cisco Umbrella and Secure Access, and Gong.
Tenable AI Exposure allows teams to see, manage, and control risks
Built into Tenable One, the new Tenable AI Exposure helps enterprises see, manage, and control risks presented by enterprise use of generative AI tools such as ChatGPT Enterprise and Microsoft Copilot. It identifies all AI usage (whether allowed or not), prioritizes risks, and enforces security guardrails and organization policies.
Menlo secures storage and controls browsers
The new Menlo Secure Storage gives users full accessibility to files. They are not, however, allowed to save locally to their own devices; all file interactions stay confined within the cloud environment. This allows contractors and other third parties to securely access sensitive documents and employees to transfer files between secure apps without exposing them on endpoints.
Menlo’s new Adaptive Web offers cloud-based browser controls. Delivered through Menlo’s cloud service, the platform allows teams to tailor users’ capabilities, redact data, block and redirect pages, enforce safe search, and disable password fields. Modules can be customized and deployed based on individual users or groups across browser sessions.
No Responses