Black Hat 2026 is shaping up to be another AI-heavy conference, but this year’s announcements suggest the industry is moving beyond simply adding copilots to existing products.
Vendors are increasingly packaging AI into operational workflows, while pairing automation with governance, exposure management, and recovery capabilities aimed at making autonomous security more practical for enterprise environments.
Across this year’s launches, several themes stand out. Security vendors emphasize attack path analysis over raw vulnerability counts, integrating external threat intelligence directly into security and recovery workflows, and introducing purpose-built AI agents that promise to accelerate investigations without forcing customers to replace existing infrastructure.
Below is a running list of the announcements that stood out.
ArmorCode adds AI agents for vulnerability remediation
ArmorCode expanded its Agentic Control Plane with four new Anya AI agents and enhanced Context Risk Graph capabilities designed to help organizations prioritize and remediate vulnerabilities based on “real business risk” rather than raw CVE volume.
The new capabilities introduce attack path analysis, network reachability mapping, patch management integration, and support for compensating controls such as WAFs and EDR platforms. The company says the new AI agents can investigate exploitability, recommend mitigations, assess cloud exposures, and orchestrate patch rollouts while reusing shared security context to reduce redundant AI analysis and operational costs.
Cribl turns telemetry into AI observability
Cribl introduced a new AI Observability application alongside expanded detection engineering capabilities and stream-native detections. The AI Observability app promises enterprises visibility into AI model usage, token consumption, spending, and potential sensitive data exposure using telemetry they already collect.
The company also enhanced its detection engineering capabilities through its CardinalOps acquisition by mapping detections to MITRE ATT&CK, identifying coverage gaps, and applying AI-assisted workflows, while new stream-native detections aim to identify high-confidence threats directly from telemetry in motion without requiring another data platform.
Commvault brings Google Threat Intelligence into recovery workflows
Commvault announced an integration between its Threat Scan and Google Threat Intelligence to help organizations identify clean recovery points after cyberattacks.
The integration combines Google’s threat intelligence with Commvault’s backup validation workflows, while new inline file hash collection allows recovery points to be checked against threat indicators during backup operations. The company says the layered approach enables customers to validate recovery points faster before performing deeper malware or forensic analysis and strengthens its AI-enabled Synthetic Recovery capability. Availability is expected in the coming months.
SOCRadar focuses on identity exposure intelligence
SOCRadar is introducing People Intelligence, a new identity-focused offering within its Extended Threat Intelligence (XTI) platform.
The capability aggregates breached credentials, stealer logs, personally identifiable information, attacker telemetry, and other external identity exposure data into unified analyst records, allowing investigators to prioritize identity risks without integrating internal HR and IAM systems. Automated risk scoring and consolidated identity context are intended to reduce manual correlation work during investigations.
Arctic Wolf doubles down on cyber resilience
Arctic Wolf unveiled a new Cyber Resilience offering that bundles managed detection and response, exposure management, endpoint protection, incident response, and up to $3 million in warranty protection into a single package. The offering is available immediately through Arctic Wolf and its partner ecosystem.
Separately, Arctic Wolf also highlighted new milestones for its Aurora Agentic SOC, including processing more than 10 trillion security events per week, introducing a new Mean Time to Trusted Action (MTTA) metric, expanding its Swarm of Experts architecture, and enhancing customer visibility through updates to the Arctic Wolf Portal.
Additionally, the company announced a partner-focused Cyber AI Readiness Accelerator that combines Aurora Attack Surface Management with consulting and remediation services from channel partners. The 30-day assessment is designed to help organizations inventory exposed assets, identify attack paths, prioritize remediation, and establish broader cyber resilience programs.
Crogl pushes sovereign AI for the SOC
Crogl announced general availability of its Enterprise AI SOC Agent as a free download. Designed to run inside customer-controlled environments, including on-premises and air-gapped deployments, the autonomous investigation platform integrates with existing security tools without requiring new data pipelines or schema normalization. Crogl says the platform investigates alerts, performs threat hunts, documents investigative steps, and generates reports while allowing organizations to keep security data within their own infrastructure.
Tanium expands autonomous security platform
Tanium announced several additions to its Autonomous IT Platform spanning agentic AI, exposure management, and security operations. New Atlas capabilities include background AI agents, agentic performance analysis, expanded automation, and an MCP server that exposes governed Tanium data to compatible AI assistants. The company also introduced External Attack Surface Management, Attack Path Mapping, Agent-Guided Threat Hunting, and a private preview integration with Google Threat Intelligence, extending its focus from endpoint management to coordinated autonomous security operations.
