BlackHat 2025... AI is Everywhere

This year’s Black Hat Conference in Las Vegas continued the hype cycle about AI, but also showcased a lot of tangible AI innovation.  The real story was defenders awakening to the dual threat and opportunity of AI: weaponized by attackers, and more importantly, harnessed to defend against them.  

Below is a curated vendor highlight reel; each pushing boundaries within their respective niche:

Black Hat 2025 was a turning point. AI has shifted from buzzy jargon to meaningful capabilities.  Purpose-built tools are now defending AI assets and securing AI-driven operations, not just slapping “AI” on legacy products. Across the board, vendors are embracing a future where AI is both the tool and the target.

• Horizon3.ai:  Autonomous Pen testing / Attack‑Aware Risk Validation
  Their NodeZero® platform continuously assesses, fixes, and verifies security posture across on‑prem, cloud, and hybrid environments, enabling autonomous penetration testing, threat detection (via honeytokens and tripwires), zero and N‑day alerting, and risk reporting. It enables security teams to “find what’s exploitable,” validate remediation success, and prioritize with proof, not probability.

• Prophet Security:  AI SOC (Agentic AI SOC Analyst)
  Deploys an Agentic AI SOC Analyst that autonomously triages, investigates, and responds to security alerts, planning and executing investigations, correlating evidence, reconstructing incident timelines, and delivering explainable actions. The expanded Agentic AI SOC Platform now includes Threat Hunter and Detection Advisor, enabling proactive threat hunting and detection tuning.

• Radiant Security:  AI SOC Co‑Pilot (Adaptive AI SOC Platform)
  Radiant delivers an AI-powered SOC co‑pilot, ingesting alerts from any source, using contextual AI to prioritize high‑risk incidents, auto-resolve false positives, generate incident summaries, and recommend actions. Their Adaptive AI SOC Platform supports triage and remediation across the broadest range of use cases, from cloud to DLP to OT/IoT, with zero pre-training and predictable use-case-based pricing.

• Aim Security: AI Security Posture Management (AI‑SPM)
  Aim scans AI models (LLMs, agents, notebooks) for security, licensing, compliance, and legal risks via model backdoor and vulnerability scanning. Their platform maintains full visibility (AI-SPM), enforces prompt and app policies, protects view into free and enterprise AI tool usage, and shields homegrown AI applications using lightweight sensors and their Aim Engine, empowering runtime AI protection with low false positives.

• MIND:  AI‑Powered Data Loss Prevention (DLP)
  MIND offers an AI-automated DLP platform that detects and prevents data breaches using automation and AI, tailored for the growing data and AI risk landscape. It emerged from stealth with $11 million in funding to address sensitive data exposure. 

• Dope.security: Secure Web Gateway
  Provides a fly‑direct, on‑device secure web gateway (SWG) that runs at the endpoint rather than routing traffic through data center proxies. This improves performance (up to 4× faster), privacy, and reliability, and now includes controls to block consumer ChatGPT and allow enterprise editions only. 

• Cybermaniacs:  Cybersecurity Awareness and Training
  Delivers cyber awareness training designed to build real human resilience—using engaging, story‑based content, microlearning modules, phishing simulations, and behavioral science to create “cyber‑secure humans,” not rote learners. 

• UpGuard:  Vendor Risk Management
  A comprehensive TPRM platform offering AI‑powered vendor risk and attack surface management. Features include automated questionnaires, third‑party ratings, continuous monitoring, actionable dashboards, and AI‑generated risk assessment reports—all to streamline vendor risk workflows. 

• Doppel.ai:  Social Engineering Defense
  An AI-native platform for multi‑channel social engineering defense. It uses LLM-enhanced detection and expert analyst input to map attacker infrastructure, automate takedowns, centralize threat intelligence via the Doppel Vision platform, and dramatically double response efficiency. 

• Seemplicity: Remediation Operations
  Offers a RemOps (Remediation Operations) platform that streamlines and automates vulnerability remediation workflows across teams and tools. Using intelligent automation and integrations, it accelerates risk reduction, improves visibility and accountability, and leverages an AI engine to tailor remediation plans. 

• StepSecurity:  GitHub Security
  Secures GitHub Actions pipelines with a multi-layered platform offering visibility, detection, response, and remediation. The Harden‑Runner acts like an EDR for CI/CD runners—monitoring network egress, file/process behavior, and replacing risky third-party Actions with maintained, safe ones, while also providing automated security scoring and compliance enforcement. 

• Jit:  AI AppSec
  Promotes AI Agents that act like product security engineers, automating scanning, triage, remediation, code reviews, and compliance reports to keep pace with fast-moving development. 

• RAD Security:  AI-Driven Cloud Security Automation
  RAD Security delivers a cloud-native, AI-powered platform that detects and investigates threats across cloud, containers, identity, and data. Their agentic AI, including VulnBot and GRCBot, automates risk prioritization, remediation, and compliance—helping teams fix what matters faster and stay audit-ready without adding headcount.
• Cymulate: SaaS Exposure Management
  Introduced its new Threat Resilience Platform (Exposure Management). It enables continuous attack simulations, exposure validation, and resilience scoring, highlighting AI’s role in exposure-centric defense

• Island: The Enterprise Browser
  Showcased its secure enterprise browser at Black Hat, designed to eliminate the risks of consumer browsers, protecting against malicious extensions, credential theft, and phishing with security‑first governance baked into the browser. 

• Root.io:  Agentic Container Security & Automated Vulnerability Remediation (AVR)
  Root.io delivers Agentic Vulnerability Remediation (AVR) for containers—patching vulnerabilities automatically without disrupting code, workflows, or the pipeline. Their system integrates seamlessly into existing processes, reducing CVE remediation from weeks to minutes, supporting infinite image variants, and providing full compliance-ready audit trails. 

the human side of things. 

While the conference floor kept us busy, the trip wasn’t all work. Staying at Vdara continues to impress year after year; quiet, modern, smoke-free, and just far enough from Mandalay Bay to feel like a retreat. When we did break away from the Strip, heading to Downtown Las Vegas was a highlight. The energy of Fremont Street is unmatched… just a word to the wise: leave the white shoes at home unless you want them to come back a few shades darker.