Back in Black (Hat): Here’s What Stole the Show

After Jay Radcliffe's Black Hat 2011 insulin pump demo, the author stresses the FDA's view that medical device security is shared by manufacturers and user facilities, which must plan for updates.

Bugcrowd's Savant Forge combines fuzz testing with symbolic execution to surface real exploitable vulnerabilities in CI/CD pipelines, while Savant Runtime tracks live third-party components in production to support SBOM compliance.

NetSPI's Black Hat and DEF CON research shows z/OS Unix is an overlooked mainframe attack surface, with paths from authenticated user to APF-authorized code execution and UID 0.

NetSPI leadership distills four key themes from Black Hat USA 2024, where the team demoed its CAASM solution, unveiled a $500 laser hardware hacking tool, and paired EASM with CAASM for CTEM.

A GrammaTech guest post argues DevSecOps pipelines alone miss the adversarial view; pairing SAST automation with offensive security closes the blind spot where design and code flaws slip through.

API security remains underprioritized as usage surges; the 2023 OWASP API Security Top 10 still leads with BOLA and broken authentication, and manual testing is needed where scanners fall short.