Black Hat 2026: The Security Assumptions That No Longer Hold

Every year, Black Hat forces a reckoning.

The threat landscape moves, and the assumptions security teams built their tools on gradually stop holding.

I'll be there with the IPinfo team at Booth 2867 along with a broad cross-section of the security community. From practitioners dealing with thousands of alerts a day, fraud teams trying to stay ahead of more and more sophisticated adversaries, vendors showcasing new approaches, researchers challenging long-held assumptions, and plenty of conversations that start with a simple question and end with a completely new way of looking at a problem.

That's the real value of events like this. They remind us that security is ultimately about understanding how the internet actually behaves.

That behavior is more dynamic than it has ever been, with changing infrastructure, IP addresses moving between organizations, and residential proxies continuing to grow in scale and sophistication. Meanwhile, AI is lowering the barrier to entry for attackers while increasing the speed at which campaigns can evolve. The assumptions we made even a few years ago about networks, location, or anonymized traffic must be revisited.

One thing we know to be true from looking at the data is that geolocation as a standalone signal no longer cuts it. Additional IP context that pairs service layer signals is now critical.

Decisions Based on Evidence

Evidence is becoming even more valuable in security. 

One of the themes I expect to hear repeatedly this year is confidence in decision-making. Security teams are under immense pressure to move quickly, automate more, and make decisions with fewer resources. At the same time, nobody wants to increase false positives or create additional friction for legitimate users.

That puts a premium on context you can trust. It tells an analyst whether an impossible travel alert is actually impossible. It reveals whether traffic is coming from a hosting provider, a VPN exit node, or a residential proxy. And it gives fraud models and SIEM workflows the signal quality they need to make smarter decisions.

Over the last year we've continued expanding ProbeNet, our internet measurement platform, which now performs live measurements from more than 1,300 points of presence around the world. That measurement foundation helps us continuously verify and refresh our understanding of internet infrastructure, from geolocation and network ownership to anonymization signals and changing behaviors across IPv4 and IPv6. It's how we ensure the context we provide is grounded in observed network behavior, not assumptions that may no longer reflect how the internet actually works.

See You Soon

Every year we leave Las Vegas with a better understanding of the challenges security teams are facing and the problems they are trying to solve. Those discussions directly shape how we think about the future of our products and, more broadly, how we can help make the internet a little easier to understand.

So if you're attending Black Hat this year, please come and say hello. The team will be at Booth 2867 throughout the event, giving live demonstrations of our data (our methodology, ProbeNet, residential proxy and VPN detection, and more!), discussing the latest trends in IP intelligence, and hearing firsthand about the challenges you're seeing in your own environments.

And if you'd prefer something a little less formal, we'd love to see you at our Top Golf after party as well.

I suspect this year's event will feature plenty of discussion around AI, automation, and the rapidly changing threat landscape. But, for us, the crux of these conversations will be that as the internet becomes more complex, understanding the context behind every connection is more important than ever.

See you in Las Vegas.