With Black Hat USA 2024 now officially over, it’s time to reflect on what we saw and heard. The event welcomed more than 20,000 in-person attendees at the Mandalay Bay Convention Center in Las Vegas. Although smaller by half in terms of the number of attendees compared to RSAC, Black Hat seemed crowded and its keynotes and sessions were well-attended. Here are a few quick takeaways from our trip to Las Vegas:
CrowdStrike’s recent incident dominated the conversation – and grabbed headlines
Since Black Hat was the first major cybersecurity event after the CrowdStrike incident (Big Valley’s initial reaction here), many of the show’s speakers used the opportunity to provide their take on the buggy software rollout and its costly aftermath. “Sadly, it was an interesting lesson for the bad guys,” said Hans de Vries, COO of the European Union Agency for Cybersecurity, during the show’s keynote, “Democracy’s Biggest Year: The Fight for Secure Elections Around the World.” During her main stage appearance, Microsoft Deputy CISO Ann Johnson praised the industry for working around the clock to deal with the issue. “It renews my faith that we can all win together.”
The need for more diversity
According to a DarkReading piece published earlier this year, “in 2024, at least three of every four cybersecurity professionals is male.” Not surprisingly, the show itself appeared to be overwhelmingly attended by men, with some diversity among the briefing speakers. The conference – and the industry itself – needs to get more creative and develop year-round initiatives to try to attract more diverse participants not only to the conference, but the industry at large. Black Hat, if you are listening, we would be happy to help.
The show must go on
Before settling into a fireside chat with Black Hat founder Jeff Moss, Signal founder Moxie Marlinspike delivered a solo presentation. Unfortunately, the 20+ minute preso got disrupted every minute or two due to a connection glitch, resulting in a black screen each time. Kudos to Marlinspike for keeping his cool through the many interruptions. We were happy to get his many insights including, “When I was a kid, software was magic. The only thing you needed was a computer; that magic has diminished over time,” and “today software has to be at a certain scale. To scale, we need to make software development cheaper and that is where I think AI can help.”
Award for favorite session
Natalie Silvanovich, who leads Google Project Zero’s North American team, provided a terrific overview of her team’s efforts to reduce the number of zero-days over the past 10 years. Our favorite talk was “How Hackers Changed the Media (and the Media Changed Hackers),” featuring cybersecurity beat reporters Bob McMillan, of The Wall Street Journal, and Lorenzo Franceschi-Bicchierai of TechCrunch. Both reporters shared their difficulty dealing with hackers – sorting out and verifying information fed to them by these individuals – as well as their frustrations securing on-the-record statements and updates from the hackers’ corporate victims. “Corporations have two choices: put your head in the sand or get out ahead of it [the story],” said McMillan, who advocated for the latter and warned against letting the hackers set the narrative. “They are not good people.”
Hooking the press
Similar to trends that we’ve seen at other trade and industry shows in the post-COVID world, media attendance seems lighter and grabbing their interest can be a challenge. A lot of the trends we are seeing are consistent with the realities of the media world – newsrooms are shrinking, and budgets are also tighter, limiting travel and conference expenses. One reporter told us that while he’s at Black Hat, his goal is to cover the event, the keynote and sessions, allowing his readers to see and feel the show. He said he was less focused on holding meetings with vendors and subject matter experts and building relationships – “I can do that anytime,” he said.
Paid opportunities with specific cybersecurity outlets at Black Hat continue to gain popularity – and provide a chance for companies to articulate their value and opine on industry trends and key issues in a controlled environment. Unlike other cyber shows, Black Hat is solely focused on threat intelligence and sharing analysis of threat actors – and the media want to hear and learn about that, not about a company’s latest or upcoming products. Key lesson: Understand what reporters want before pitching them, and conversely, share that information with clients so expectations can be met.
As with RSAC, it’s the real-world stories told by the folks in the trenches that provide the best learning for the audience. With RSAC CFP set to open September 4th, 2024, we have a few quiet weeks in between conferences. It’s a good time to meet with your team to identify the stories – and storytellers – you want to share with the industry over the next 12 months. Let us know if we can help.
