Cocktails and Cyber opened the week at S Bar, in partnership with Akamai, Cloudflare, Darktrace, Forescout, Gigamon, Fortinet, Infoblox, Netskope, Tanium and Rubrik.

Before the formal programming began, customers, partners and practitioners compared notes on what they were actually seeing: where AI was producing real value, where security teams were feeling pressure, which problems were overstated and which risks weren't getting enough attention. The most useful intelligence at Black Hat rarely arrives as a finished conclusion. It usually starts as an observation someone puts on the table early enough for others to challenge it.

The Morning Brief brought together WWT's Rob Joyce, David Luber and Chris Konrad to unpack how AI is reshaping the threat environment.

Their conclusion was direct: the playbook hasn't disappeared — AI has put it on fast-forward. AI agents can research software, navigate networks, identify vulnerabilities and operate continuously without fatigue. Meanwhile many security operations centers still rely on people to review alerts, approve changes and coordinate response.

The panel also surfaced a hard operational tradeoff. For internet-facing devices, traditional test-and-deploy patch cycles may leave a window machine-speed attackers can cross first. Leaders increasingly have to weigh the risk of a self-inflicted outage against the risk of leaving a known path open. There's no risk-free answer — only a decision about which risk you're prepared to own.

WWT's Kate Kuehn and the Honorable Kirsten A. Davies, Chief Information Officer of the U.S. Department of War, convened a community listening session on CMMC and defense cybersecurity.

Following the suspension of CMMC Phase II requirements, the Department is reviewing the program. This session gave the people responsible for implementation a direct channel to explain what they're experiencing — where requirements are working, where they're creating unintended friction and what should inform the review.

That exchange matters. Policymakers need candid feedback from operators, suppliers and practitioners. Industry needs to understand the mission, not just the requirement. Stronger security comes from bringing those perspectives together before friction hardens into failure.

At the WWT Community Breakfast, Acting CISA Director Nick Andersen joined WWT's Madison Horn for a fireside conversation grounded in what infrastructure operators are facing right now.

The discussion ranged from coordinated cyber activity against community water systems to the implications of AI-enabled operations, CISA's priorities and the role industry must play in connecting federal visibility with the realities facing states, local governments and operators. Different examples, same question: are we learning and adapting as fast as the threat environment is changing?

In operational technology, cyber risk doesn't stay contained to data. It reaches the systems that move water, power communities and keep essential services running. Resilience has to be designed across systems, organizations and levels of government.

Marcela Denniston and NVIDIA opened the breakfast with the work of the newly formed Open Secure AI Alliance — reinforcing another theme from the week: securing AI will take shared work across an ecosystem no single company or agency controls.