Our Addiction to Shiny New Tools
Walk the convention floor at Mandalay Bay and you'll be blinded by the promise of next-generation solutions. Vendors hawk AI-powered platforms that promise to solve every security problem imaginable. Yet, as a recent CrowdStrike report released for the conference
highlights, attackers are using that same AI to accelerate their own efforts, often by exploiting well-known weaknesses in software supply chains. The mistake isn't the existence of tools, but the belief that a tool can fix a broken process. Companies are buying sophisticated scanners and platforms while their developers still have weak credentials, pull unvetted code from public repositories, and lack basic security training. The conference buzzes with talk of agentic AI systems, but reports from firms like BeyondTrust emphasize that 75% of security breaches still trace back to old-fashioned identity and privilege problems—the digital equivalent of leaving the front door unlocked.
The Illusion of the SBOM
The Software Bill of Materials, or SBOM, has become a cornerstone of the supply chain security conversation. The idea is simple: create an ingredients list for your software to track every component and dependency. Following a 2021 presidential executive order, they have become standard practice for government vendors and, by extension, much of the industry. The problem, made clear in sessions and hallway chats at Black Hat, is that many organizations treat the SBOM as a compliance checkbox. They generate the list to satisfy a requirement but lack the process to actually use it. A key Microsoft session titled "Poisoned at the Source" underscores this very problem, detailing ongoing attacks on the npm package manager that succeed because knowing a component is present isn't the same as knowing if it’s secure or has been maliciously altered. The SBOM is a map, but a map is useless if no one is looking at it to navigate.
Chasing Novel Threats While Forgetting the Basics
This year, AI is the topic dominating keynotes and briefings. We're hearing about AI autonomously discovering vulnerabilities and the threat of AI supply chain compromises. These are real and serious concerns. However, the painful mistake is the industry's tendency to chase the novel threat at the expense of mastering the basics. Research shows that attackers are still overwhelmingly reliant on phishing, stolen credentials, and exploiting known, often old, vulnerabilities in third-party code. According to one report, attackers are exploiting flaws even before they are publicly disclosed, shrinking the response window to less than zero. This speed is enabled not by super-advanced AI attacks, but by exploiting the low-hanging fruit that organizations consistently fail to patch. The focus on a hypothetical AI super-villain is distracting from the very real burglar jimmying the window we forgot to lock years ago.
Trusting Code We Don't Control
Modern applications are built like collages, assembled from open-source libraries, third-party APIs, and cloud services. This accelerates innovation, but as Microsoft's security team points out, threat actors are increasingly targeting these trust relationships. They aren't just breaking into systems; they're poisoning the well by compromising the software, developer workflows, and trusted tools that organizations depend on. One training session at Black Hat is bluntly titled "Mastering Third-Party Risk Management: Vendor & Software Supply Chain," acknowledging that modern breaches rarely start at the front door anymore. They come through a trusted vendor, a SaaS tool, or an open-source package. The mistake is a cultural one: developers and businesses treat these external components as trusted and safe by default, when in reality, every dependency is a potential attack vector that requires vetting and constant monitoring.
