Three Key Takeaways from Black Hat 2023

As is our tradition at infoedge, we hosted a series of executive events at the recent Black Hat cybersecurity conference, where we discussed the topics and issues that our information security customers see as most important to them in the short to medium term. These discussions yielded the below (not exhaustive) main takeaways.

What were your key takeaways from Blackhat this year?

AI will increase both the landscape for opportunity and challenges an organization faces. It will be important for organizations to think through the potential risks and opportunities associated with AI information security based on how data and information drive their business model(s). This should be done based on various types of AI, not just generative AI. Analysis may result in shifts in focus for the information security program e.g. increase efforts on security awareness as line employees/staff may be utilizing AI without understanding the attendant risk(s). In some cases, AI may provide value to the information security program e.g. autonomous agents, but will require planning and design.

Rationalization of security tools and improving integration will be key to managing cyber security spend and effectiveness. Lack of tool integration and tool sprawl is creating user/customer experience impacts and siloing of risk management efforts. Business leadership is increasingly wary of investing more in information security tooling without, at a minimum, recognition of the impacts of disjointed and siloed tools. Organizations are looking for a plan to improve integration and reduce sprawl-driven where possible internally but putting increasing pressure on vendors externally to build integration capabilities.

Improving the ongoing refreshment and governance of security strategy will be key for information security leaders in light of the recent SEC information security rules. For example, materiality determination and disclosure mandated for incident reporting will require appropriate governance to determine baselines and thresholds for such reporting. Boards will increasingly demand well-defined approaches for managing cybersecurity investments and operations that are aligned with risk exposures in order to demonstrate assessment and management of material risks.

We’d love to hear from you about any of the topics we covered above, and of course, we’d be happy to share more in-depth insights if you are interested. Reach out for a deeper dive into insights or to inquire about our upcoming events!