Black Hat’s biggest lesson this year is not about AI, it’s about control. Paul and Owahn unpack fragmented security stacks, why “agentic AI” is just the latest rebrand of old identity problems, and what defenders actually need to do to reduce risk without drowning in hype.

From the airport after five intense days in Las Vegas, they break down the real conversations happening on the vendor floor, the SMB-sized gaps that enterprise tools keep ignoring, and the one startup that genuinely stood out with file-level and even page-level encryption at a price smaller teams can actually afford. Along the way, they trace how prompt injection, model poisoning, and over-permissioned agents map back to the same control failures security teams have wrestled with for years.

You’ll hear why Paul is so done with AI being slapped on every booth and every pitch, why Owahn keeps pushing the idea that security has to be treated as a connected control web, and how both of them see the same core issue from different angles: isolated tools don’t create resilience. Standards, policy, process, people, tech, and service all have to work together.

They also dig into one of the most important shifts in cybersecurity right now - treating agents like identities, cataloging what you actually have, and building a program that starts with operations, governance, and business impact instead of chasing the newest shiny product. If you’ve ever wondered how small and midsize organizations are supposed to keep up, or how security can become a business enabler instead of a cost center, this conversation gives you a sharper way to think about it.

The episode closes on the part most people miss at conferences: the hallway conversations, random dinners, and unexpected CISO chats that often matter more than the giant booths and flashy demos. Essential listening if you care about practical cybersecurity, smarter buying decisions, and what actually works once the hype cycle fades.