Analyst(s): Fernando Montenegro, Mitch Ashley
Publication Date: August 13, 2026
For one week in August, the security industry crowds into Las Vegas, and this year it went all-in on agentic AI. The floor was loud, the funding was enormous, and the research was sobering. What mostly went missing was a settled answer to the questions a board actually asks: who gets protected, and what any of this is really securing.
What Is Covered in This Article:
- The scale and shape of the week: Black Hat, DEF CON, and BSides Las Vegas
- The agentic-AI wave on offense and defense, and why the label outran the substance
- The capability gap between the well-resourced and everyone else, and why it is everyone’s problem
- What a board will actually fund, from asset visibility to an assurance layer for agents
- The signals to watch as the category, the funding, and the gap play out
The Event—Major Themes & Vendor Moves: For one week each August, Las Vegas becomes the center of gravity for the security industry. It is less a single conference than a multitude of overlapping events stacked on top of one another, and the draw is the network effect: once everyone is in town, the meetings, briefings, and side gatherings multiply on their own.
Two shows anchor the week, Black Hat and DEF CON, with an honorable mention to the community-run BSides Las Vegas. Black Hat set the tone on scale, with more than 23,000 verified attendees this year, up over 15% year over year.
The throughline across all of it: agentic AI has crossed from novelty to normal on both sides of the table, even as the week’s sharpest research argued that AI is mostly speeding up old attacks rather than inventing new ones.
The Vendor Floor
On the show floor, the defensive “agentic” wave was hard to miss and impossible to walk through in full. With more than 400 sponsors and a constant stream of announcements, no single pass could take it all in.
The patterns were clear enough, though. One cluster wrapped agents in guardrails and governance, discovering, monitoring, and constraining what an agent is allowed to do. The loudest by far was the “agentic SOC,” with upwards of 50 vendors positioning some form of autonomous detection, investigation, or response, several of which coined new metrics to describe it.
Identity ran through much of the rest, from offerings that tie an agent back to the human who deployed it to more structural rethinks of privilege, including moves to retire standing access and an acquisition in identity threat detection. A quieter strand tackled telemetry and detection integrity, the plumbing all of this has to run on, and there was a concrete post-quantum note in a card that retrofits post-quantum cryptography onto existing servers.
The Research
The research told a starker story than the floor. One vendor’s autonomous system swept thousands of open-source projects and surfaced roughly 14,000 vulnerabilities, the overwhelming majority never reported before, a preview of AI-scale vulnerability discovery.
Others turned the lens on the agents themselves, with a zero-click hijack class disclosed across leading agentic browsers and a credential-stealing campaign riding malicious agent “skills” that spanned something like 1.7 million installs. The big threat reports pointed the same way: AI-enabled attacks up sharply, most exploits landing within 48 hours of a public proof of concept, and identity or privilege at the root of roughly three-quarters of the intrusions one study examined.
Hardware had a loud year too, as fault-injection research pushed the attack surface down to the silicon the AI boom runs on, next to a run of “old attacks, one layer down”: webmail exfiltration through CSS, flaws in a major passkey implementation, and a one-character DNS bug. The mood came through in a line heard more than once: you cannot write signatures or patch fast enough, so the SOC has to operate at the speed of the attack.
Agent Intent, Behavior, and Accountability
Agent and AI security dominated the floor. The breakthrough conversations off the floor were agent intent, behavior, and accountability. Scoping an agent’s token controls what it can call. It says nothing about whether the authorized action is the right one, whether the behavior was within guardrails, on whose authority it acts, and whether it achieved the intended outcome. An agent can pass every technical control and still land in the failed column during the postmortem.
The vendors that reasoned about an agent’s role in a business process, what it is trying to accomplish and whether it is cleared to do it, were building the layer that both the CIO and CISO together can defend to a board. AI governance was the other standout: policy an agent inherits, an audit trail of the calls it made, a way to quantify the risk of letting it act. That is the assurance layer. Reaching it separates a fundable product from a demo.
ServiceNow, Okta, HashiCorp, Veracode, ReversingLabs, and Red Hat were the names that stood out during analyst meetings, both for what they’ve delivered and for what they’re working on. The NightDragon media breakfast ran the conversation at board altitude. Watching tool calls is table stakes now. Governing intent, and proving it, gives a security leader something to take upstairs.
The Money and the Register
The commercial energy matched the volume. Well over $700 million flowed into agentic-security startups in the single week around the show, with one round billed as the largest cybersecurity Series A on record, even as an independent floor survey found dozens of booths whose messaging was hard to parse.
The other register was human and governmental. The opening keynote put national cyber leadership, CISA, the FBI, and defense policy on one stage, and the organizers framed the week around AI security and the emerging threats facing national defense.
Black Hat also hosted the world premiere of “Midnight in the War Room,” a documentary produced by Semperis that trades product talk for the human side of cyber conflict, drawing on national-security leaders, defenders, journalists, and reformed attackers to portray the people on every side and the stakes for the critical infrastructure caught between them.
DEF CON
DEF CON is the original. It predates Black Hat and still carries the culture Black Hat later commercialized: the community’s event rather than the industry’s.
Its value is spread across the villages and communities, the main-stage talks, the hallway conversations, and even the show floor, which is a different animal. Its vendors skew toward individuals and small shops, tools and hardware, and hacking in the original sense rather than enterprise booths.
The villages and communities are the heart of it. Some center on craft, the Red Team, Blue Team, Adversary, and Social Engineering villages, among them, where offense and defense are practiced rather than pitched. Others put researchers hands-on with genuinely complex systems, as the Aerospace, Maritime, ICS, and Biohacking villages do with satellites, marine and subsea-cable protocols, industrial controllers, and medical devices, where a failure is physical rather than abstract.
Policy @ DEF CON sits alongside them, one of the few venues built for hackers and policymakers to actually talk, which matters more each year as AI cyber capability becomes a governance question and not only a technical one. The long-running Voting Village shows what that produces, with findings that have reached Congressional testimony.
A Loud Floor and a Quiet Gap: Security Summer Camp 2026
Analyst Take: So what did a week in Vegas actually tell us? The easy read is that agentic AI has arrived, and in a sense it has, on nearly every booth, through most of the research, and behind the largest checks anyone was writing.
We would offer a less comfortable read. “Agentic” did an enormous amount of work this year, asked to mean too many things at once, and the controls on offer mostly addressed the plumbing rather than what actually worries a board.
Buyers seemed to know it. In Futurum’s 1H 2026 Cybersecurity Decision-Makers survey, about 57% of respondents said they were highly concerned about the security implications of agentic AI operating within their environment (N=929, unweighted), a striking level of worry about something the floor was busy selling as the answer. That gap, between how much was shipped and how little was settled, is the story worth telling, and it runs in three directions.
Everyone Shipped Agentic, Nobody Defined It
Start with the word. “Agent” was everywhere and meant almost nothing consistent: a coding assistant that writes and runs code, a SaaS feature that acts inside an application, a custom workflow carrying its own credentials, an autonomous process sitting on an endpoint. These are wildly different things with different blast radii, and the floor mostly treated them as one category wrapped in one set of controls.
Those controls tend to operate at the technical layer, watching tool calls, scoping tokens, and sandboxing execution. That work is necessary. For coding agents in particular, it is overdue, after a year of supply-chain scares aimed squarely at the tools developers now let write and run code. But necessary is not sufficient.
Very little on the floor addressed the level that actually decides whether an agent is safe, the business process it takes part in: what it may do, on whose authority, toward what outcome, and how a human stays accountable. We did see some early movement in that direction, a few vendors starting to reason about an agent’s role in a workflow rather than only its API calls, but that is a claim to verify once the cacophony of Black Hat dies down.
We are wary of the lazy version of this critique, the “it is all AI-washing” line trotted out every hype cycle. This is not only marketing, and the capabilities are real. The trouble is that the controls are aimed a level or two below where the risk actually lives.
The Capability Gap Underneath the Noise
Underneath the noise sat the thing that may matter most: who gets to use the best AI, not what it can do. The strongest defensive capability, and much of the strongest offensive capability, is concentrated among the organizations that can afford it, the large enterprises, well-funded verticals, and national programs.
That concentration is not accidental. Anthropic spent the spring restricting its most capable vulnerability-finding models, the Mythos-class capability, to a short list of large partners and critical-infrastructure providers through Project Glasswing, an explicit tiering of who gets frontier defense and who does not.
The practitioners we heard from described the same split from the demand side: the well-resourced deploy agents carefully and keep getting better, while everyone else drowns in sprawl and fights for basic visibility. Attackers do not respect that line. They route through the least-defended participant, the small supplier, the regional clinic, the contractor sitting inside a larger enterprise’s trust boundary, which makes the have-nots everyone’s problem and not only their own.
“Midnight in the War Room,” the documentary that premiered at the show, made the human side of that gap vivid, the defenders carrying the weight and the victims who have no 40-person SOC to fall back on. A market that sells its best work almost exclusively to the top of the pyramid is, in the aggregate, leaving the surface wide open beneath it. That is not a comfortable thing to say at a show whose economics depend on selling to that same top, but it is the honest read.
What a Board Will Actually Fund
The through-line for a buyer is not which agent to buy. It is whether any of this survives contact with a board that has started asking harder questions. Security spending is under real scrutiny, and “we bought the agentic platform” is not an answer to “are we more defensible than we were last year?”
The pragmatic posture we heard from most practitioners reflected that: measured adoption, compensating controls, and a clear-eyed read of which business processes actually matter, rather than wholesale replacement of the SOC. It also starts somewhere less glamorous, with a comprehensive, continuous, and current view of assets. You cannot govern an agent, or defend much of anything, without knowing what you run, which is why the quiet momentum behind treating the software bill of materials as a living system of record, now extended to AI and model components, may matter more than most of the agentic launches.
The hard problem on top is speed versus control. Machine-speed agents make a human in the loop difficult, yet fully autonomous response still sits past most organizations’ risk tolerance, and the capability is running ahead of the practice for governing it. The government’s own cyber-reasoning work has shown autonomous find-and-patch becoming real engineering rather than a demo, which raises the bar for what a credible agentic-defense offering should include.
The thin part of the market is the assurance layer around these agents, governance, transparency, and a way to quantify the risk of letting one act, which is the same business-flow altitude the floor mostly skipped. The vendors who reach it will have something a CISO can take upstairs; most of what we saw is not there yet.
What to Watch:
- Does “agentic” survive as a category, or fracture back into the specific things it actually describes? The label cannot carry edge, SaaS, custom, and coding agents forever, and the useful vocabulary is probably narrower and more boring.
- Who climbs to business-flow context, and who stays at tool-level telemetry? That is the line between a control that a board will fund and a feature that only demos well.
- Does the funding wave meet real deployment, or does it meet renewal? Well over $700 million in a single week is a bet on adoption that has not happened yet, and the next few quarters, not the keynote, will settle it.
- How fast does autonomous find-and-patch commoditize? With the government’s cyber-reasoning systems now open-sourced, some of what the AI-SOC startups are selling could become table stakes sooner than their valuations assume.
- Does the capability gap widen or close? If frontier defense continues to tier toward the top of the market, expect the action and incidents to keep moving to the under-defended edge.
For more on the event itself, see the official close of Black Hat USA 2026.
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of Futurum as a whole.
Other Insights From Futurum:
RSAC 2026 Conference: The AI “Tragedy of the Commons” and the Future of Agentic Security
Anthropic Glasswing: AI Vulnerability Detection Has Crossed a Threshold
Selling Agent Provenance to the CIO: Entire Changes Who Signs
Cisco to Acquire Galileo: AI Agent Observability Can’t Run at Human Speed
Security Summer Camp: Black Hat 2025, Def Con, and Others
Author Information
Fernando Montenegro serves as the Vice President & Practice Lead for Cybersecurity & Resilience at The Futurum Group. In this role, he leads the development and execution of the Cybersecurity research agenda, working closely with the team to drive the practice's growth. His research focuses on addressing critical topics in modern cybersecurity. These include the multifaceted role of AI in cybersecurity, strategies for managing an ever-expanding attack surface, and the evolution of cybersecurity architectures toward more platform-oriented solutions.
Before joining The Futurum Group, Fernando held senior industry analyst roles at Omdia, S&P Global, and 451 Research. His career also includes diverse roles in customer support, security, IT operations, professional services, and sales engineering. He has worked with pioneering Internet Service Providers, established security vendors, and startups across North and South America.
Fernando holds a Bachelor’s degree in Computer Science from Universidade Federal do Rio Grande do Sul in Brazil and various industry certifications. Although he is originally from Brazil, he has been based in Toronto, Canada, for many years.
Mitch Ashley is VP and Practice Lead for the CIO & Technology Buyers and Software Lifecycle Engineering practices at The Futurum Group. A multi-time CIO and CTO with 30+ years leading technical organizations, Mitch built and operated production systems spanning cybersecurity for the U.S. Department of Defense, PKI services for the broadband and 5G industries, SaaS platforms, large-scale telecom and banking systems, and a national broadband network. His work with AI began early, developing expert systems that diagnosed and repaired complex mainframe environments. That operator foundation grounds his analysis in operational consequence, covering the technology buyer's world of software engineering, cybersecurity, DevOps, cloud, and AI.
