AI
Building the Conference Network
The first Black Hat Neil Wyler ran had 1,500 attendees and 15 training classes. This year: 20,000 attendees and over 90 classes. Open-source scripts and shelf gear held up for a while, then stopped scaling. Wyler and Bart Stump walked the expo floor, pitched vendors on brand association instead of cash, and built a partner model that now brings Palo Alto, Arista, Cisco, and Lumen into a single network stood up in four days and torn down in hours.
You cannot sponsor your way into the NOC. Partners go through demos, get evaluated like customers, and send their best gear and engineers. That selection pressure is why this year’s show ran smoother than any since pre-COVID.
Network Traffic by the Numbers
Full packet capture across the conference produced 63 billion packets and over 62 terabytes. Sixty-two hosts transmitted plaintext passwords. The NOC pulled 2,800 unique plaintext credentials off the wire. Encrypted traffic hit 91% for the first time in eleven years of tracking, up from a plateau of 75 to 80%. App iCloud beat Google for top DNS category. Hinge overtook Tinder as the top dating app. Cryptomining traffic shifted from XMRig to NiceHash.
“1.19 million threats alerted on, seven blocked.” — Neil Wyler
The number sits low because most suspicious traffic is class demos. Blocking a scan also kills the lab. The NOC only hard-blocks direct attacks on the registration server or traffic that threatens network stability.
Proactive Monitoring with Precogs and Vibes
Michael Spicer’s “Precogs” project drops Orange Pi nodes with wireless cards throughout the venue, acting as synthetic clients. They catch channel congestion and interference before any attendee files a ticket, letting the NOC rebalance channels without anyone noticing. Sensor coverage jumped from 18% last year to 45% this year, and the NOC recorded the fewest network trouble reports in Black Hat’s history.
The second tool, Vibes, replaced an unmaintained visualizer that required VNC on a nook. Spicer vibe-coded a new one from scratch. It runs on a 100-gig span port connected to a box with 128 terabytes of storage, so the NOC holds the full PCAP for the duration of the conference. The tool is open source.
AI-Assisted SOC Triage
James Pope’s SOC work centers on one problem: analysts arrive two days before traffic goes live. There is no three-month onboarding. The NOC trained ML models to classify beacons, profile backbone device behavior, and score HTTP post-body entropy against normalized English, then route only high-confidence anomalies for human review. Alerts matching same-class, same-destination patterns are auto-closed as “Black Hat positive.” Mean time to respond is now under one hour.
At this show the team built a Cortex XSIAM MCP server, then wired a Slack AI bot querying Gemini → XSIAM live (26:07) so analysts and managers can query threat context on any IP or MAC address without leaving chat.
“we’re not looking for use cases for AI. I’m trying to get AI to solve use cases” — James Pope
What the NOC Actually Caught This Year
Four catches stood out. A Korean AI voice-search app leaked auth tokens in the clear. A multilingual group-chat app sent all translations unencrypted. A vendor CTF on the expo floor asked attendees to prompt-inject an AI; the NOC watched successful extractions in plaintext. The sharpest case came from Black Hat Asia: a speaker on stage had a malicious Chrome extension exfiltrating data from their laptop. Pope spotted the traffic, identified the speaker, and waited for the talk to end.
“it can happen to a black hat speaker again with all those credentials and everything behind them, um it can happen to us and it can definitely like happen to our users” — Neil Wyler
Q&A
How do you handle client-to-client traffic and segment training labs from the general show floor? General Wi-Fi uses host isolation; training classrooms are open within the classroom subnet so trainers can run lab servers, but classroom-to-classroom and attendee-to-infrastructure traffic is blocked or alerted on. Multicast/broadcast was not fully blocked on the show floor this year due to Mandalay Bay’s flat VLAN ceiling APs, and the team flagged it as a fix for next year. ▶ 38:03
Notable Quotes
1.19 million threats alerted on, seven blocked. Neil Wyler · ▶ 14:20
we’re not looking for use cases for AI. I’m trying to get AI to solve use cases James Pope · ▶ 27:35
it can happen to a black hat speaker again with all those credentials and everything behind them, um it can happen to us and it can definitely like happen to our users Neil Wyler · ▶ 35:49
Key Takeaways
- 91% of Black Hat traffic was encrypted in 2025, the first time the NOC ever broke 90%.
- The NOC blocked only 7 of 1.19 million alerts, separating real attacks from class demos with ML.
- A Black Hat speaker arrived actively compromised via a malicious Chrome extension, showing phishing beats expertise.