AI is accelerating cyberattacks while recovery remains slow, making the costs of conflict harder to contain. Drawing on SEC filings and attacks on hospitals and suppliers, this keynote examines recovery, economic fallout, and the erosion of the boundary between cybercrime and warfare.

AI’s capabilities in bug discovery, exploitation, and reverse engineering have made Linux kernel exploits cost < $20, and OpenBSD exploits no longer rare. This keynote discusses applying frontier models to computer security problems, successes and failures, future challenges and preparations.

This session examines proxy and relay infrastructure used to collect and exfiltrate geospatial data, covering its design, purpose, daily operations, national security implications, network observations, and potential attribution of backend interfaces.

Cybersecurity’s autonomous capabilities often operate in silos. Introducing Autonomous Mission Assurance: a human-governed architecture connecting development, operations, validation, compliance, remediation, and monitoring through shared context, evidence, orchestration, and bounded autonomy.

Examines perimeter device compromises through a real-world edge appliance intrusion, showing how attacker tactics have evolved, why these cases are hard to investigate, and how defenders can improve visibility, readiness, and response.

CCCS presents an LLM-driven purple-team pipeline that automates detection engineering, adversarial testing, telemetry validation, hardening, and triage. The talk examines architecture, failure modes, and which capabilities genuinely improved analyst effectiveness.

This talk explores AI’s benefits and pitfalls in malware analysis, emphasizing the role of domain expertise. Using LegionLoader as a case study, it covers agent-assisted unpacking, C2 analysis, and extraction of cryptographic keys and indicators.

Explore how Windows access tokens govern permissions, follow processes and threads, and enable impersonation. Learn how attackers abuse tokens to escalate privileges—and what defenders can monitor to spot misuse.