Hey all!

We made it back. (Most of us.) Jason is still recovering, so you are stuck with me. I am Ryan Bonner, Lead Security Engineer here at Arcanum.

Black Hat & DEFCON 34 is done. Six days of Vegas, not enough sleep, and more conversations than my brain knew what to do with. It was one of the best weeks I have had in a long time.

The Week

Black Hat ran first. Jason had his Attacking AI talk at the AI Zone on Thursday, and both panels went well. I spent most of my time on the floor and in conversations between sessions. The show floor this year was wall-to-wall AI booths. (Nobody saw that coming.) Some of them are building real things. Some of them had a slide deck and a prayer.

Then DEFCON kicked off. We set up outside n00b Village, and that table became home base for the next four days. Jason was sprinting between stages (Building Hackbots ran three times across three villages. I spoke at the n00b village Friday and got sick going home early before my Bug Bounty Village on Sunday morning

The AI for n00bs workshop at n00b Village on Saturday. People showed up with laptops, needed no hand-holding, and were going in under an hour.

(Sponsor)

Holding Down the Fort

Julia, Boston, and Jenika held that table for the full run of DEF CON. Four days. Every question, every conversation, every person who walked up and said: "So what is Arcanum?" They handled it.

It was hot, it was long, and by day three my voice was going. (Turns out talking for four days straight will do that.) But people came up who had been reading the newsletter for months, watching the talks, following the research. And they just wanted to talk. That part never gets old.

Faces to Names

We finally met Arcanum customers in person. People we'd worked with for months over Zoom and email, but had never actually shaken hands with. You know their voice, you know their problems, but you have never been in the same room. Sometimes you even fight with them on X, but it’s always so fun to see everyone in person.

The Card (and the Cards)

AppSec Village made trading cards for DEF CON 34. They made one of Jason.

Jason and his son collect Pokémon cards together. It is their weekend thing. They go hunt down packs, open them- the whole ritual. He was telling someone he met at one of the events about it, and they came back later with two Pokémon packs for him. He got to open them with his son when he got home. That is the kind of thing that keeps DEF CON worth showing up to. Someone you just met doing something cool for no reason. I saw similar things countless times at n00b village: someone with experience taking time to help newer people in security get the understanding they were looking for.

"Security Is Cooked"

All week I kept hearing some version of "this is the last real DEF CON, AI is going to eat everything, cybersecurity is cooked." From content creators. From practitioners I respect. A lot.

Jason wrote a long piece about this a few days ago, and it got way more attention than any of us expected. The full essay is here: DEF CON Is Dead and Security Is Cooked… Or Is It?

He does not pretend the anxiety is baseless. The disappearing entry-level is a real problem. But the doom narrative doesn't hold up on closer inspection. A force multiplier on expertise is not a replacement for it. The attackers get AI too, which means defender demand goes up, not down. And a ten-year-old walked up to our table at DEF CON and solved five out of five prompt injection CTF challenges. The pipeline is fine; the talent coming up in our industry is so advanced, and we can’t wait to bring them onto our team.

Wrapping Up

Every year the same thing turns out to be true. The talks get recorded. The hallway does not.

If you stopped by our table, came to the meetup, caught a talk, or just said hi in passing, thank you. That is the whole reason we were there. Jason, Julia, and I (Potentially) will be out at Cybr.Sec.Con. So, if any of our friends in the area come by, we’d love to see you!

Hack The Planet Agent

-Ryan Bonner