Black Hat USA 2026 is underway in Las Vegas, and vendors are using the moment to unveil what they hope will define the next year of defense. Here are the announcements drawing the most attention on the ground, and why they matter for teams weighing new budgets.
BlackCloak extends deepfake protection to the executive’s trusted circle
Impersonation Protection enables members to authenticate phone calls, video meetings, emails, WhatsApp and Slack messages, texts, and other communications in real time. BlackCloak moves the security control out of the potentially compromised channel, and puts the focus on the basis of trust between the two parties.
The expanded capability extends functionality beyond BlackCloak’s membership. Members can now invite the people they trust most: family members, wealth advisors, lawyers, executive assistants, caregivers, and household staff, into their own circle of trust. Invited contacts download a free version of the BlackCloak app, register their device, and can then both send and receive authentication requests with the member.
Stairwell launches Backstory, pioneering agentic investigation for malware blast radius
Stairwell, the AI SOC that stops breaches no one else can, today announced the availability of Backstory, an agentic investigation platform that traces related malware variants, identifies affected systems, and maps the full blast radius of an incident in seconds, so enterprises know what happened, where it spread, and what needs to be contained before precious time is lost.
Jscrambler launches Unified Client-Side Security Platform
Jscrambler launched its Unified Client-Side Security Platform, introducing a new approach to securing applications and customer data where AI-powered risks increasingly operate: inside the browser. Organizations can deploy individual solutions based on their priorities or expand across initiatives over time, giving CISOs, security architects, AppSec, Security Engineering, Privacy, GRC, and SOC teams shared visibility, continuous runtime enforcement, and a common operational foundation through a single platform.
Novee brings continuous AI pentesting to mobile apps
Novee announced the expansion of its AI penetration testing platform to mobile applications. With this addition, Novee becomes the industry’s first complete AI pentesting platform across the modern application attack surface, providing continuous, autonomous coverage. The platform tests web apps and APIs, along with desktop, AI and LLM-enabled applications.
Filigran launches XTM One to automate CTEM with AI agents
Filigran has announced XTM One, an AI-native agentic layer that automates Continuous Threat Exposure Management (CTEM) workflows across the Filigran XTM Platform. XTM One introduces a dedicated AI orchestration layer that connects OpenCTI and OpenAEV into a single, continuous workflow. Security teams move manually between tools, ingesting threat intelligence in one system, building attack scenarios in another, and tracking remediation in separate dashboards.
ServiceNow organizes autonomous security around six solution areas
ServiceNow accelerated its Autonomous Security vision with six unified solutions that help deliver prevention-first, AI-native cyber defense across unified exposure management, continuous vulnerability detection, cyber-physical security, identity and access security, and agentic incident response, and cyber risk and compliance.
Horizon3.ai expands NodeZero with automated web application attack path testing
NodeZero WebApp Pentesting closes the gap by delivering production-safe autonomous testing that spans web applications, infrastructure, cloud, data, and identity. It proves what is actually exploitable, quantifies the business consequence of each attack path, and maps those paths to the tactics of known threat actors, enabling companies to accurately prioritize and urgently fix vulnerabilities that matter.
Legit Security VibeGuard 2.0 brings endpoint security and real-time guardrails to AI coding agents
VibeGuard 2.0 harmoniously runs on the endpoint, automatically discovers and protects all agents and interacts with users rather than blocking, and frustrating, developers. It can cover all agentic variations and plugins, delivering complete coverage and very granular policies that secures specific agent commands and tools.
Tanium expands autonomous security across AI, exposure management and SecOps
Tanium is extending the Tanium Autonomous IT Platform across three areas: agentic AI, exposure management, and security operations, giving operators a complete view from external attack surface to endpoint, and the ability to act on it autonomously, at scale.
Snyk unveils continuous AI pentesting and agent red teaming
Snyk has announced the general availability of Evo Continuous Offensive Security (COS), enabling security teams to continuously test applications with autonomous, AI-powered pentesting and AI agent red teaming while providing validated proof of what attackers could exploit.
