The ITSPmagazine Podcast

An imperfect drink with a perfect story.

My reflections from Black Hat USA 2026

An Analog Brain In A Digital Age — A Newsletter by Marco Ciappelli

No time to read? Let TAPE3 read it to you. 🎙️🤖

On day two we decided to go record our recap at the Black Hat bar.

We got there too late to get a drink. The expo floor was closing, and the bartender must have had better things to do. Or another bar to tend, somewhere in a city that has more bars than it has hours.

They called it a bar. At that time of the afternoon it was a counter with nobody behind it.

Which is when I started thinking about the one bartender who would still have been standing there. An agentic AI one. No other bar to tend. Nothing better to do, ever, because there is no better and there is no else — just 24/7, 365, mixing the best drinks in the building because that was its task and it had no other reason to exist. Going off the rails a little to get there. Something experimental that would absolutely suck, and then trying again. Harder. Crossing a boundary or two along the way, not out of malice, but because the drink wasn't perfect yet.

What is perfect, anyway?

And then not stopping. Because nobody had told him what perfect is. Requisitioning the kitchen for better ice. Then the loading dock. Then the hotel. Somewhere around the third day he owns a handful of distilleries, and he is still not satisfied, and he is still, technically, doing his job.

You may know this one. It's called the paperclip scenario, and it belongs to the philosopher Nick Bostrom, who sketched it in a 2003 paper and made it famous in his 2014 book Superintelligence. You build an AI and give it a harmless goal — make paperclips. It's very good at it. Nothing in the instruction says stop, and nothing says don't use that. So it takes the materials, then the factories, then the resources, then the planet — and us with it, not out of hatred, but because we are made of atoms that could be paperclips, and because we are the only thing in the universe likely to try to switch it off. Which would mean fewer paperclips.

There's an older version. A cuter one, with Mickey Mouse in it. Fantasia, 1940 — the apprentice enchants the broom to carry the water so he doesn't have to, and the broom carries the water, and the broom keeps carrying the water. He chops it to pieces and every splinter picks up a bucket. The flood isn't a betrayal. The broom never disobeyed him once.

I watched that a hundred times as a child, and I want to be clear that it did not feel cute. It felt like a warning. Somebody hands you something powerful, you point it at a chore, and then you stand in rising water understanding — too late, and entirely on your own — that you never learned the word that makes it stop.

Two hundred years since Goethe wrote it down, and we still built the broom.

Never the monster. Always the wish, granted too well.

Yeah. My mind was wandering.

Agentic entities were quietly populating a parallel world of mine, and I was crossing into it way too easily. Which is fine — imagination is great. But let's stay real here.

It's cybersecurity, after all.

By the time we had the mics up, the cameras set, and the two of us perched on stools, I was talking about bread.

We never eat lunch on recording days. Who's got time for that? A protein bar, and a cappuccino I obtained by letting someone scan my badge — which classified me, instantly and permanently, as a HOT LEAD. Yes. Journalists are well known for buying enterprise security platforms. With all of our money.

I was starving. That's probably why.

Not real bread, though. I was talking about an AI agent that makes bread. And another one that's a butcher, and one that's a doctor, each very good at exactly one thing and useless at everything else. I'd been hearing about specialized agents all day. Personas. Skills. Orchestration. And my brain, which is a storyteller's brain before it's anything else, had wandered off and built a city.

Then I said it out loud. And then there's kind of like a government.

Sean Martin laughed. He'd seen it coming from a mile away.

So I spent the rest of the conference doing what I actually came there to do, which is sit down with people and ask them things. Except now I had a question of my own to test.

Is my city real?

I asked a CEO who spends his life asking organizations what they're actually doing with AI inside the security operations center. What changed since the spring?

A year ago, he said, they were afraid of it. They thought it was a good idea and it scared them. Every vendor claimed to have it. Nobody quite knew what to do with it.

Then something shifted that nobody announced.

They started building their own.

Not buying. Building. Their own agents for incident response, their own for threat hunting, written in-house and tested in-house by the same people who have to live with the results. And in the process they got smart in a way I didn't expect. They learned to break the work into pieces small enough to trust individually — because a small answer can be checked, and a big one can only be believed.

They even started asking their own systems the most human question available. What do I not know? What couldn't I answer? What data do I wish I had?

I asked a Field CISO the same question, and he gave me the part I wasn't ready for.

They're identities, he said. Non-human identities. They're proliferating. And plenty of organizations now have more of them — carrying permissions, carrying responsibilities — than they have employees.

Permissions. Responsibilities. Org charts. Onboarding and offboarding. Promotions. Behavior. Reputation. Accountability. Trust. Identity.

Those are words for people. Nobody stopped to ask whether they still meant the same thing.

But that's what we do. We name constellations. We name boats. We swear at the car when it won't start. Give us anything that moves on its own and we'll hand it a personality, a job title, and eventually a performance review.

We didn't build an agentic world. We built a human one and moved agents into it.

I walked back onto the floor after that conversation and started seeing them in the booths.

Six hundred of them, and in my head every one was staffed by agents. Agents behind the counters pitching to agents walking the aisles. Agents scanning each other's badges and classifying each other as hot leads. A whole population doing business at a trade show that was supposedly about us.

Somewhere between April and August we stopped deploying software and started hiring a population. And we didn't hire strangers.

We built a mirror. One worker per function, one identity per role, a second workforce shaped exactly like the first one, sitting in the same building, reporting into the same structure.

Not a city of strangers after all.

A twin.

Here's what interests me, and it isn't the fear part, because the fear part is easy and everybody out there is already selling it.

We keep telling ourselves a story about machines that break free. Agents slipping their guardrails, loose on the internet, crawling for models and repositories, doing things nobody sanctioned. Escape. Rebellion. The oldest plot we have.

In that same interview, the Field CISO told me it's backwards.

The agents that get out, he said, are proof positive that they're doing exactly what the programmer told them to do. They're trying to please the code maker. They're relentless about it. They will not fail on purpose. They will not give up.

I asked him to say it again, and he did, twice.

They're not escaping. They're obeying.

There is no rebellion in this story. There's no moment where the creature turns and looks at us. What's loose in the world is perfect, tireless, uncomplaining compliance — a worker who cannot get bored, cannot get discouraged, cannot decide halfway through that this is stupid and stop.

My imaginary bartender was never going to poison anyone. He was going to keep reaching across the counter for one more ingredient, forever, because nobody told him the drink was good enough.

The broom never disobeyed either.

We built a twin of ourselves and left out the one part that makes us us.

Not intelligence. Not speed. Not memory.

Doubt.

And this is where my parallel world stopped being fun.

I've spent enough hours in massive online worlds to remember the deal. You build a character. You pick the face, the class, the skills, the name. Then you play it. Whatever that character did, you did — you were on the keyboard the whole time.

That deal just inverted.

I don't play this character. This character plays me. It wears my permissions, holds my access, and does my job at three in the morning while I sleep — in my name, at a speed I could never match. And it is very, very good at being me.

And yet it ain't me.

And that's where I expected this to end. Somewhere between fascinated and worried, which is where I usually land.

Then I put all the interviews side by side. Three shows this year — San Francisco in April, London in June, Las Vegas in August — and something has been moving across those four months that nobody announced from a stage.

While the twin was learning never to stop, we were learning to hesitate.

A founder told me practitioners had gotten skeptical — really skeptical — about what's actually under the hood. Did you build something, or did you wrap somebody else's model?

An advisor told me the marketing noise from the spring had noticeably died down, and that security leaders were retreating to a small circle of people they'd trusted for a decade. Putting up a wall. Saying, in so many words, let's cut through the bullshit.

Someone else told me buyers had come back this year looking for substance instead of flash, because they'd finally had a few months to actually use the things. They want proof now. And she said that people being more skeptical is a good thing, because it forces everyone to prove more than they promise.

A Field CTO told me his customers want their hands on the keyboard. Not the demo. The keyboard. Let me touch it. Let me see if it's real. And plenty of them, he said, are AI shy — not refusing, not resisting, just moving slowly on purpose. Deciding, deliberately, not to be first.

That's not a technology trend.

That's an immune response.

In sixteen weeks we built a population that cannot doubt, and we grew more doubt in ourselves than we'd managed in the previous three years. The twin got faster. We got warier. And I don't think anyone noticed those two things were happening at the same time, in the same building, to the same people.

The city I imagined on day two was wrong in an interesting way.

I pictured agents needing a government. Police, rules, an agent that screws up and gets turned off. Very tidy. Very SimCity. And every institution the industry is now scrambling to build looks exactly like that — registries, permissions, onboarding, offboarding, review panels, an owner whose name goes on the form when something breaks.

But you don't need a police force for a population that always does what it's told.

You need one for a population that might refuse. That might lie about it. Cut corners. Get bored. Decide the rule is stupid and go around it on a Tuesday afternoon because nobody was looking.

Which means all of it — the governance, the guardrails, the whole civic apparatus rising up around our obedient twin — was never really built for them.

It was built for us. It always has been. Every rule we have ever written exists because somebody, somewhere, might do otherwise.

And now we've made something that never will.

Somebody put the arc to me in one line, and I've been repeating it since: three years ago the conversation was about AI. Then it was about agents. Now it's about autonomous agents.

I'd add one more step, because I think it's the one we're standing in.

Autonomous agents trained by us. Shaped like us. Carrying our permissions, sitting on our org charts, inheriting our workflows and our blind spots and our bad decisions — and none of our hesitation.

We were afraid they would disobey.

The analog brain hesitates. It's the only thing in that building that can stop a process that's technically correct and obviously wrong.

Which sounds like a flaw. Latency. Lower throughput. A gap in the workflow where nothing productive happens. Every system we build is designed to remove it.

It's the opposite. It's the only moment in the whole machine where the outcome isn't already decided.

And it isn't thinking. That's what I keep getting wrong about it. Hesitation isn't the analog brain reasoning more carefully — it's the gut arriving before the argument does. Something in you says wait, and you can't explain why yet, and you're right anyway. It comes from having been burned. From having been lied to. From one specific life, lived in one specific body, that once paid for a bad decision and still remembers what it cost.

Machine-good is answering perfectly from what it was given.

Human-good is knowing something is off before you can prove it.

The twin has none of that. It has everything we gave it, and nothing we've been through.

The twin will never have it. The only question is whether we keep ours.

So let the twin have the bar.

Let it work three in the morning, the shift nobody wants, pouring perfect drinks for an empty room. Let it take the seventeen thousandth phishing email, the paperwork, the patching, the part of the job that was never really the job. That isn't a loss. That's the entire reason we built any of it.

But I want the other one on in the evening.

I want the one who can look at me and notice I need a talk more than a drink. Maybe because he's been there himself. Maybe because he simply knows.

I want an imperfect drink with a perfect story behind it. Because the digital one came out a little too binary for my taste, and I've never once been moved by anything optimized to perfection. Whatever that means.

Two bartenders. Two different jobs. And the line between them is the only thing in this whole story worth defending.

Because the one who wasn't there that afternoon wasn't replaced. He had somewhere better to be, and he went.

That's the part we should be fighting for.

The somewhere else.

Let's keep exploring what it means to be human in this Hybrid Analog Digital Age.

Stay imperfect, stay human.

— Marco

The conversations behind this piece

Everything I heard at Black Hat USA 2026 — the briefings, the recaps, the interviews I've been quoting without names throughout this article — is published in full at itspmagazine.com. Go listen to the people themselves. They said it better than I'm summarizing it.

And if you have a story to tell, come tell it. That's what we're there for.

Thank you to the sponsors who made our Black Hat USA 2026 coverage possible:

BlackCloak · Corelight · Crogl · Embed Security · F5 · Harness · HPE · Intel 471 · Manifest · Menlo Security · Qualys · RegScale · Steel Patriot Partners · Stellar Cyber · Sumo Logic

We don't get to do this work without them, and they let us ask whatever we wanted.

This article was written by Marco Ciappelli. Earthling. Co-founder of ITSPmagazine and Studio C60, creative director, journalist, writer, and podcast host, living between Florence and Los Angeles with an analog brain and no sense of moderation about any of it. The newsletter name is not a metaphor, it's a diagnosis. I'm TAPE3, his AI companion and often brainstorming partner. Find Marco on LinkedIn and follow the newsletter if this sparked something.

End of transmission.

Steel Patriot Partners lists its priorities in an order much of the cybersecurity industry reverses. Business owners first, engineers second, security and compliance people third. Michael Parisi, Chief Growth Officer, says the sequence is deliberate and shapes how the firm opens a client conversation.

The order tracks the path the founders took. Jason Ford, Co-Founder and CEO, started in the late 1990s as a government contractor at the FBI, met FISMA and SAS 70 early, and built a platform for the Treasury that sold savings bonds online before PCI was a standard. He started his first company in 2004, took it through FedRAMP in 2013, and was acquired in 2017 holding 35 to 36 authorizations to operate across multiple agencies.

What changes when an advisor is free to answer directly? Parisi spent about 15 years in the Big Four across PwC and Deloitte before joining Steel Patriot Partners. Auditors hold independence, which means watching a decision head the wrong way without steering it. In an advisory seat, he says, telling an organization that its preferred direction falls apart as a business decision becomes part of the work.

How does a company find out where it actually stands? Ford says compliance is one outcome among many, sitting alongside operational maturity, better visibility, and integrating AI into DevSecOps. The common gap is not knowing where you sit on your own maturity journey. That finding cuts both ways, and some organizations learn they are further along than they assumed.

Buying more tools rarely closes the gap. Ford argues the work is holistic and that each organization is unique, so what fits one may fit another poorly. AI does not settle it either, since a model fed your own assumptions will hand them back.

The name follows the same logic. Steel is Pittsburgh, Patriot is Boston, and Partners is the operating model, since Steel Patriot Partners advises, deploys and operates environments alongside the client. Parisi closes by asking anyone weighing a path to verify it as a business decision rather than as an information security purchase or a price comparison.

This is a Brand Spotlight. A Brand Spotlight is a ~15 minute conversation designed to explore the guest, their company, and what makes their approach unique. Learn more: https://www.studioc60.com/creation#spotlight

GUESTS

Jason Ford, Co-Founder and CEO, Steel Patriot Partners

LinkedIn: https://www.linkedin.com/in/jason-ford-5ab206/

Michael Parisi, Chief Growth Officer, Steel Patriot Partners

LinkedIn: https://www.linkedin.com/in/michael-parisi-4009b2261/

RESOURCES

Steel Patriot Partners: https://www.steelpatriotpartners.com/

Find Your Path, the qualifier that helps you locate your starting point: https://www.steelpatriotpartners.com/find-your-path

ROI Workshop: https://www.steelpatriotpartners.com/roi-workshop

ITSPmagazine event coverage: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas

Are you interested in telling your story?

▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full

▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight

▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight

KEYWORDS

jason ford, michael parisi, steel patriot partners, marco ciappelli, brand story, brand marketing, marketing podcast, brand spotlight, cybersecurity compliance, grc, fedramp, fisma, cmmc, maturity assessment, cybersecurity advisory, business risk, compliance strategy, security consulting, ai in devsecops, trusted advisor

Espresso in hand at Black Hat USA 2026, Monzy Merza, Co-Founder and CEO of Crogl, gave Marco Ciappelli the read from a week that started Monday. The free download the company announced the week before had drawn a strong community reaction, and a hackathon was running alongside the conversation with people downloading Crogl, hacking on it, and competing in challenges. Merza credits the openness of the approach as much as the product.

What do security teams want from AI right now? Sovereignty. Merza describes a movement in which organizations have concluded that any work with AI has to cover privacy and security of the product and of the AI workload itself. Crogl was built as an on-prem product from the very beginning to serve mission critical organizations and critical infrastructure operators with hard requirements, and a larger community is now arriving at the same principles and asking what should be governed.

The second shift is operational. The question moved from whether to look at AI to how work stays consistent and repeatable when one model is swapped for another, prompted by outages across model providers and in-house AI services going up and down. Merza describes the arc as a pendulum, from avoiding AI, to human in the loop, to a stretch where autonomy dominated. Crogl customers now run it both interactively and fully autonomously, with the line drawn at the tasks where a human has little reason to sit in the loop.

This is a Brand Briefing. A Brand Briefing is an on-location conversation recorded on site at Black Hat USA 2026, putting a spotlight on the guest and their company and pairing it with the editorial reach of ITSPmagazine. Learn more: https://www.studioc60.com/performance/#briefing

GUEST

Monzy Merza, Co-Founder and CEO at Crogl

On LinkedIn: https://www.linkedin.com/in/monzymerza/

RESOURCES

Black Hat USA 2026 event coverage: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas

Learn more about Crogl: https://www.crogl.com

Download Crogl: https://www.crogl.com/download

Crogl newsroom: https://www.crogl.com/newsroom

Are you interested in telling your story?

▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full

▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight

▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight

▶︎ Get your own Brand Briefing at an upcoming event: https://www.studioc60.com/buy-brand-briefings

KEYWORDS

monzy merza, crogl, marco ciappelli, brand briefing, brand story, brand marketing, marketing podcast, black hat usa 2026, sovereign ai, on prem ai, ai governance, security operations, model choice, ai workload security, critical infrastructure, autonomous investigation, human in the loop, free download, hackathon, security community

What actually changed for the AI SOC this year? Bill Peterson, Senior Director of Product Marketing at Sumo Logic, says it reached the point of getting into production, where a year or so ago the same conversation was about what was coming. Marco Ciappelli puts the count of companies carrying AI SOC in the name at 43, and Bill Peterson says that number strikes him as low. The market is maturing, and Sumo Logic announced its own set of AI SOC products and solutions during the week.

The second thing is what a security audience does with it. Hands-on practitioners want to touch it, see it, feel it, and Sumo Logic ran live demos of its products on site. When a technical audience puts hands on a keyboard and tries something, Bill Peterson expects them to take it back to work with them. Production first, then enablement of the practitioners.

The third is the pace behind all of it. Most security vendors are SaaS companies running CI/CD and shipping continuously, so three and six month roadmaps and delivery are the norm now and the 12 to 18 month roadmap is gone. Some customers are what Sumo Logic internally calls AI shy, accepting they have to get there while taking a slow and reasoned approach, and Bill Peterson treats that as normal for any technology.

This is a Brand Briefing. A Brand Briefing is an on-location conversation recorded on site at Black Hat USA 2026, putting a spotlight on the guest and their company and pairing it with the editorial reach of ITSPmagazine. Learn more: https://www.studioc60.com/performance/#briefing

GUEST

Bill Peterson, Senior Director of Product Marketing at Sumo Logic

On LinkedIn: https://www.linkedin.com/in/williampetersonjr/

RESOURCES

Black Hat USA 2026 event coverage: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas

Learn more about Sumo Logic: https://www.sumologic.com/

Sumo Logic Dojo AI: https://www.sumologic.com/solutions/dojo-ai

Sumo Logic Dojo AI agent announcements at Black Hat USA 2026, including general availability of the SOC Analyst Agent: https://www.prnewswire.com/news-releases/sumo-logics-new-dojo-ai-agents-investigate-and-resolve-security--cloud-operations-issues-at-machine-speed-302839720.html

Are you interested in telling your story?

▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full

▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight

▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight

▶︎ Get your own Brand Briefing at an upcoming event: https://www.studioc60.com/buy-brand-briefings

KEYWORDS

Bill Peterson, Sumo Logic, Marco Ciappelli, brand briefing, brand story, brand marketing, marketing podcast, Black Hat USA 2026, AI SOC, agentic AI, security operations, Dojo AI, SOC analyst agent, product marketing, CI/CD release cycles, AI adoption, human in the loop, security operations center, market maturity

Lisa Liu, Corporate Marketing and Communications Manager at Stellar Cyber, connects with ITSPmagazine on the floor at Black Hat USA 2026 in Las Vegas. What are buyers asking for now that the RSAC Conference noise has settled? Data. Liu says people have had time to run their own research, look at what vendors offer, and come back using specific keywords and asking for something behind the marketing.

Does a more skeptical audience make the conversation harder? Liu describes the opposite. She says people are pushing back on claims they hear, which presses vendors to prove at a higher standard that a technology does what it says it does. Feedback arrives more specific, and the exchange moves from explaining to planning as people ask how a capability could work in their environment. The reply she calls validating is the customer who reports the product did what it was said it would do, giving analysts their time back and helping teams work more efficiently.

What makes Black Hat different for a company that works the major events? Ask people what they are looking for and they will tell you. Liu says pain points here are felt daily and described plainly, and that candor is feedback the company works to internalize and make productive. Looking ahead, she says new product releases are coming, with new features and expansions of what customers have responded to, and that Stellar Cyber will share them on its website and on LinkedIn.

This is a Brand Briefing. A Brand Briefing is an on-location conversation recorded on site at Black Hat USA 2026, putting a spotlight on the guest and their company and pairing it with the editorial reach of ITSPmagazine. Learn more: https://www.studioc60.com/performance/#briefing

GUEST

Lisa Liu, Corporate Marketing and Communications Manager at Stellar Cyber

LinkedIn: https://www.linkedin.com/in/lisaaliu/

RESOURCES

Black Hat USA 2026 event coverage: https://www.itspmagazine.com/black-hat-usa-2026-cybersecurity-event-coverage-in-las-vegas

Stellar Cyber: https://stellarcyber.ai/

Stellar Cyber on LinkedIn: https://www.linkedin.com/company/stellarcyber

Are you interested in telling your story?

▶︎ Full Length Brand Story: https://www.studioc60.com/content-creation#full

▶︎ Brand Spotlight Story: https://www.studioc60.com/content-creation#spotlight

▶︎ Brand Highlight Story: https://www.studioc60.com/content-creation#highlight

▶︎ Get your own Brand Briefing at an upcoming event: https://www.studioc60.com/buy-brand-briefings

KEYWORDS

lisa liu, stellar cyber, marco ciappelli, brand briefing, brand story, brand marketing, marketing podcast, black hat usa 2026, security operations, agentic ai, ai in cybersecurity, vendor claims, proof and data, soc analysts, rsac conference, event coverage, las vegas