46:15Black Hat USA 2026 Keynote: The End of Rare Defending When Offense Is Cheap
David Weston, who leads the agentic security team at Microsoft, argues that all of cyber security is priced on one unwritten assumption: crossing a security boundary is hard, so attacks that do it are rare. He then puts numbers on that assumption collapsing. MSRC is processing nine times the vulnerability volume it did in March, roughly doubling every six weeks; an internal harness turned 182 of about 200 Linux kernel bugs into crash level proofs of concept, many working root exploits, at $3.61 and 21 minutes each; and on discovery benchmarks the leaders are harnesses, not models, so restricting model access will not hold the line. His optimistic half is that this is productivity rather than magic, and defenders should refuse the symmetric fight and spend the same productivity on durability instead: memory safe rewrites (Android went from 76 percent memory safety bugs to under 20 percent), AI scaled formal verification (30,000 lines of Lean verifying AES-GCM in a week), and agent driven prevention over infrastructure as code. Jeff Moss opens the 29th Black Hat with a short argument that security is political whether the industry likes the word or not.