Walking the Floor: What Black Hat's Vendor Hall Taught Me

About Buy-In

Hacker summer camp isn't just talks and badges. It's also miles of expo floor, hundreds of booths, and a lot of "let me tell you about our platform." This year, walking the Black Hat vendor floor gave me as much to think about as any session did.

The Good: Reps Who Actually Talked to Me

A handful of vendors stood out for the right reasons. They weren't reciting a script; they were listening. They asked what problems I was actually trying to solve, answered honestly when a feature wasn't a fit, and sent me off with a one-pager I could actually use later instead of a QR code and a hope. That's a small thing, but it's rare, and it's the difference between a booth visit I remember and one that blurs into the next fifty.

The Noise: Everyone's Selling AI

If I had a dollar for every pitch that opened with "powered by AI" or "AI-driven," I could've funded my own trip. The majority of vendors this year leaned hard into AI integrations, some with real substance behind the term, plenty riding the buzzword because it's what gets a badge scan. After a while, the floor started to sound like one long, repetitive pitch deck. It's not that AI doesn't belong in security tooling; it absolutely does. It's that "AI-powered" has become a stand-in for differentiation instead of a description of it. I found myself asking harder questions just to cut through it: What does the model actually do? What's the human still responsible for? What breaks if it's wrong? I know the future is AI. I'm not arguing that. But knowing where we're headed doesn't mean we need to drown in it to get there.

The Standout: AIR

One vendor cut through all of it: AIR. Their focus is securing the AI agent add-on supply chain: skills, plugins, MCPs, and subagents. Full visibility into what's installed across the agent fleet, continuous vetting before and after deployment, and the ability to actually block or remove an add-on when it's unsanctioned, unsupported, or behaving in a way it shouldn't, rather than just flagging it and hoping someone follows up. It's the AI-native version of a problem I already live in: shadow IT, except now it's shadow AI, and the "extensions" are skills and MCPs an agent can install on its own. That's a real, specific answer to a real, specific gap, and it's the pitch that stuck with me days later, long after the generic "AI-powered" slides had blurred together.

The Reminder: Buy-In Doesn't Have One Face

Here's the part I keep coming back to. Not every person with influence over a buying decision looks the way vendors expect. I watched reps size people up on that floor, deciding in a glance who was worth the full pitch and who got the quick brush off. That calculus is usually wrong, and it's a bad habit for anyone in sales to keep. The person walking the floor in comfortable shoes and no lanyard flair might be the one writing the requirements doc next quarter. Treat every conversation like it could be the one that matters, because on a floor that size, you genuinely can't tell which one is.

Walked the floor at Black Hat this year? I'd love to hear what stood out to you: good, bad, or "AI-powered."

All opinions are my own and are not a reflection of my employer or any organization I am associated with.