Black Hat USA 2026: Vendors Announce AI Security and SOC Tools
Summary
Black Hat USA 2026 announcements include AI-agent security controls, automated remediation and detection tools, SOC response features, and open-source exposure-hunting tools. BeyondTrust also reported identity or privilege issues in 75% of attacks it studied.
Key points
- Acalvio, Cyera, KnowBe4, Sweet Security, Varonis, and Zero Networks announced controls to monitor, govern, or block AI-agent activity, including prompt injection, unauthorized access, and data leakage.
- Artiphishell introduced a feature that validates vulnerability findings and produces evidence that remediation fixed the underlying issue.
- Cato Networks announced agent-based prediction of attack paths, while Cribl and Prophet Security introduced AI-supported detection and detection-engineering capabilities.
- SentinelOne announced governed, traceable SOC response actions and expanded managed threat-hunting services.
- XM Cyber released open-source exposure-hunting tools for macOS and Oracle Cloud, including tools to identify privilege-escalation paths.
- BeyondTrust’s annual Research Index reported that 75% of attacks in its research involved identity or privilege issues, often in combination.
Article Details
- Event Type
- Cybersecurity product, service, and research announcements at Black Hat USA 2026.
- Impact
- The announcements describe new and updated capabilities for AI-agent security, vulnerability validation and remediation, threat detection, exposure management, and security operations. The article reports no specific cyber incident or confirmed compromise.
Vendors
AcalvioAcalvio launches Deception Guardrails for AI agentsArctic WolfArctic Wolf launches cyber resilience offeringArtiphishellArtiphishell introduces Verifiable RemediationBeyondTrustBeyondTrust report ties majority of attacks to identity and privilege gapsCato NetworksCato Networks adds agentic capability to predict AI-driven attacksCriblCribl adds new AI security and observability capabilities to platformCycodeCycode adds agentic workflows to automate risk responseCyeraCyera launches Agent Guardian, new AI agent risk productFlashpointFlashpoint adds custom summary builder to threat intelligence platformKnowBe4KnowBe4 extends Agent Risk Manager to cover ClaudeMiggo SecurityMiggo Security launches defense-in-depth mitigation solutionNoveeNovee expands AI pentesting platform to mobile applicationsProphet SecurityProphet Security adds AI-driven detection engineering to SOC platformRealm SecurityRealm Security adds detection integrity and search features to data platformSentinelOneSentinelOne expands autonomous SOC and Wayfinder AI servicesSweet SecuritySweet Security announces new blocking capabilitiesVaronisVaronis adds intent-based access control to Atlas platformXM CyberXM Cyber released open source exposure hunting toolsZero NetworksZero Networks launches new tool for enterprise AI
Products
Agent GuardianCyera launches Agent Guardian, new AI agent risk productAgent Intent-Based Access Control (IBAC)Varonis has introduced Agent Intent-Based Access Control (IBAC), a new capability in its Atlas platform that monitors whether an AI agent’s actions match its assigned instructions.Agent Risk ManagerKnowBe4 extends Agent Risk Manager to cover ClaudeAgentic AI BlockingSweet Security announced Agentic AI Blocking, the ability to stop rogue AI agents in live production, in real time.Agentic AI SOC PlatformProphet Security has released AI Detection Engineer, a new addition to its Agentic AI SOC Platform that automates the process of building and maintaining detection rules.Agentic WorkflowsCycode adds agentic workflows to automate risk responseAI Detection EngineerProphet Security has released AI Detection Engineer, a new addition to its Agentic AI SOC Platform that automates the process of building and maintaining detection rules.AI Workspace for Investigations ManagementFlashpoint has launched a Custom Summary Builder within its AI Workspace for Investigations Management, part of the Flashpoint Ignite platform.AtlasVaronis adds intent-based access control to Atlas platformAutomated VulnOps PlatformArtiphishell, a DARPA-backed company, launched Verifiable Remediation as part of its Automated VulnOps Platform, aimed at helping teams cut through scanner noise and confirm that fixes actually work.Cato Agentic Threat PreventionCato Networks has launched Cato Agentic Threat Prevention, a new capability that uses autonomous agents to anticipate likely attack paths and tailor defenses to each customer’s environment.ClaudeKnowBe4 extends Agent Risk Manager to cover ClaudeCribl App for AI ObservabilityThe new tools include the Cribl App for AI Observability, which manages AI usage and risk; new detection engineering capabilities that identify coverage gaps; and stream-native detections in Cribl Stream that pinpointCribl Streamnew detection engineering capabilities that identify coverage gaps; and stream-native detections in Cribl Stream that pinpoint high-confidence threats earlier.Custom Summary BuilderFlashpoint adds custom summary builder to threat intelligence platformCyber ResilienceArctic Wolf launches cyber resilience offeringCyera EndpointCyera has introduced Agent Guardian and Cyera Endpoint, new capabilities designed to secure enterprise AI agents by providing visibility into agent activity, governing what agents can access, and enforcing runtimeData HavenRealm Security has introduced two new capabilities, Detection Integrity and search in Data Haven.Deception GuardrailsAcalvio launches Deception Guardrails for AI agentsDetection IntegrityRealm Security adds detection integrity and search features to data platformFlashpoint IgniteFlashpoint has launched a Custom Summary Builder within its AI Workspace for Investigations Management, part of the Flashpoint Ignite platform.Least Agency EnforcementZero trust security firm Zero Networks has launched Least Agency Enforcement, a new AI security capability that allows enterprises to limit what AI agents can access, what actions they can perform, and when humanPurple AIThe first adds governed, closed-loop response to its Singularity Platform, letting Purple AI investigate alerts, reach verdicts, and execute response actions within limits set by security teams, with every actionShadowPlexAcalvio has launched Deception Guardrails, a new capability within its ShadowPlex platform aimed at protecting AI agents from compromise.Singularity PlatformThe first adds governed, closed-loop response to its Singularity Platform, letting Purple AI investigate alerts, reach verdicts, and execute response actions within limits set by security teams, with every actionVerifiable RemediationArtiphishell introduces Verifiable RemediationWayfinder Frontier AI ServicesThe second expands Wayfinder Frontier AI Services, its managed offering that now pairs Anthropic’s latest models with SentinelOne analysts to find and validate exploitable vulnerabilities, backed by a new remediation
Tools
FAInd my XPCAt Black Hat Arsenal, it will demonstrate FAInd my XPC, which uncovers macOS trust flaws that could let unprivileged attackers invoke privileged services, including paths to root code execution.Offensive OCIAt DEF CON, XM Cyber will unveil its Offensive OCI toolset, which maps effective Oracle Cloud permissions and exposes hidden privilege-escalation paths.