There are two enormous cybersecurity events each year in the United States: RSA Conference and the week in Vegas that is so full of conferences, summits, and ancillary events that it's simply known as "Hacker Summer Camp." From Security BSides Las Vegas to Black Hat and DEF CON, it takes the fortitude of a camel to survive the desert heat and the late nights. I've been going to summer camp for at least fifteen years in different contexts: as a CISO, an industry analyst, a threat intelligence research director, and as a security vendor team member. All of these contexts are different, and they shape the way I look at the goings-on.

For several years, I was involved with the Black Hat CISO Summit as a member of the advisory board. This year, I was invited to moderate a sponsor panel titled "Beyond Resilience: Building Anti-Fragile Security in an Uncertain Future," which sounds fine until you look at the rest of the agenda and notice that two other summit talks also had the term "anti-fragility" in them. There were three national security-related talks and two explicitly mentioning AI, and bear in mind that the advisory board is responsible for choosing the topics based on what they believe CISOs most want to hear about.

In short, CISOs are more worried than ever. They're concerned about nation-state threats and the ability to respond to the biggest disruptive technology and buzzwords since … well, the last ones. Generally speaking, they're trying to bolster their defenses against anything that can break down the current business systems; everyone wants to hear about resilience.

That's just the official Black Hat CISO Summit. Those who are looking at the wider landscape also find their way to the other Black Hat summits, like the Innovators & Investors summit and the AI summit (because, of course, there's an AI summit). The BSides Las Vegas conference, created to showcase talks that didn't get accepted to Black Hat, has everything for stressed CISOs as well, including talks such as "Human Attack Surfaces in Agentic Web: How I Learned to Stop Worrying and Love the AI Apocalypse," and 1Password's very own Dave Lewis speaking on "Lessons from Black Swan Events and Building Anti-Fragile Cybersecurity Systems." If you really want to hear the scariest, juiciest talks, you go to the Skytalks, which have strictly controlled, limited attendance and do not allow attribution, photos, or recordings of any kind (and they have staff walking the room to enforce this). Naturally, I can't divulge the content of Skytalks except for the public titles, but ones like "The Botnet Strikes Back: how we assembled a coalition to take down a criminal network & their all-out response" nearly used up half the popcorn in Vegas.

But those are just the official, public conference schedules. If you were resilient enough to make it to 1Password's 8 am breakfast panel on Thursday morning, you got to hear about "Weaponized Autonomy: The Rise of AI Agents as Enterprise Threat Vectors," which probably woke up the attendees better than the free-flowing coffee. There were numerous invitation-only conferences, roundtables, parties, and outings as well. CISOs tend to use these to have real discussions off the record and get the spilled tea that isn't released to the media. In fact, if you wanted to ask people, "So what do you really think of AI?" the places to do it were in restaurants, hotel suites, hallways, and pretty much anywhere that was marked off with a velvet rope. Just as CISOs use private Slacks and Signal chats to get real online, they do it over coffee, tea, and mimosas in Vegas.

The biggest question asked privately about AI in Vegas was, "Are you using it? And if so, how?" The answers ranged from "I tried it out" to "I use it to generate reports that I have to create regularly but don't want to spend a lot of time on." There was general agreement that agents are like toddlers: you have to follow them around and say, "No, don't touch that. No, don't do that. Not like that. Come back over here." But for very tightly scoped use cases, there were highly technical executives who managed to incorporate LLMs and customized agents into their work.

Of course, the other huge concern was over business users putting sensitive data into various private apps (I won't say "unapproved," because you can't approve or prohibit something that you don't know about in the first place). Suffice it to say, CISOs are on the hook to protect business data against an exponentially growing vector of leakage, even when the organization’s leadership is reluctant to do any real enforcement. Policies are cheap; actual controls are much more effective.

Buzzwords, emerging technology, anti-fragility, and threat actors: come to think of it, these are the perennial causes of CISO insomnia, and only the details change from year to year. We'll see you on the edge of the desert again next August.