Black Hat 2026 Keynote Speakers: What to Expect from This Year's Opening Sessions

Black Hat Briefings opens with a keynote block on the morning of August 5, 2026. The keynote program typically spans two to three hours and includes two to four keynote addresses delivered sequentially in the main auditorium. All Briefings pass holders are invited to attend the opening keynotes, which are held in the largest conference hall available at Mandalay Bay to accommodate the full conference attendance. Each keynote address runs 30-50 minutes. Unlike Briefings session talks, which are allocated strict time slots with a moderator managing Q&A, keynotes have a more variable format. Some keynote speakers take questions from the audience; others deliver their address without Q&A. The tone of keynotes is different from research talks: keynotes are expected to frame big-picture themes and deliver perspective on the industry's direction, while research talks are expected to deliver specific findings with evidence. A keynote that fails to offer a compelling perspective on where security is heading is considered a disappointment regardless of the speaker's technical credentials. After the keynote block, the main Briefings session tracks open simultaneously in multiple rooms across the convention center.

The Black Hat keynote roster follows a pattern that has remained relatively consistent across recent conferences. Government keynotes: the Director of CISA has become a fixture in the Black Hat keynote program. The CISA Director's keynote is significant because it represents the U.S. government's most direct public engagement with the practitioner security community. These addresses have covered specific threat actor activity, policy initiatives, and calls to action for the private sector. NSA officials and senior Department of Defense cybersecurity leaders have also appeared in keynote slots in recent years. Research and industry keynotes: major security researchers who have produced significant findings, industry executives whose perspective on the field commands broad attention, and technology leaders addressing the intersection of business and security all appear in the keynote program. Jeff Moss: the Black Hat founder typically participates in the opening program. His addresses often have a conversational quality different from formal keynotes, and they frequently include his assessment of where the security community's values and priorities stand relative to the industry's commercial and governmental pressures.

Several Black Hat keynotes have shaped the security industry in ways that extended beyond the conference itself. The annual CISA Director appearances have been used to publicly attribute specific attacks to nation-state actors, announce new public-private partnership programs, and direct the practitioner community's attention toward specific threat categories. These policy announcements, delivered to a practitioner audience, often receive broader coverage than equivalent announcements made through government press releases. Jeff Moss's addresses over the years have tracked the evolution of the security community's relationship with government, industry, and technology. His framing of the security researcher as a legitimate professional, rather than a liability, has contributed to the normalization of vulnerability disclosure, bug bounty programs, and the practitioner's public role in the security ecosystem. Keynotes that have addressed specific major incidents (including major nation-state campaigns) at their first public acknowledgment at a major security conference have defined entire conference cycles. In 2026, the keynote most likely to achieve similar significance will engage most directly with the AI-powered discovery and exploitation capabilities that Project Glasswing has demonstrated.

The Black Hat keynote audience is not primarily the researchers and practitioners in the room. It is the much larger audience that watches the recordings, reads the coverage, and absorbs the industry's reaction to what is said. When the CISA Director says at Black Hat that a specific threat category is a priority, that statement reaches security teams at organizations that never send anyone to Las Vegas. When a major researcher delivers a keynote framing a new attack class, that framing becomes the vocabulary the industry uses to discuss the issue for the next year. The keynotes are industry-agenda-setting in a way that individual Briefings sessions, however technically excellent, typically are not. For practitioners, this makes keynotes more useful as strategic orientation than as technical instruction. A keynote will not teach you how to implement a specific defensive control. It will tell you which defensive challenges the security leadership class has decided matter most right now. That context is useful for understanding which Briefings sessions to prioritize, how to frame security investments to leadership, and what the threat landscape is expected to look like in the next 12-18 months.

The 2026 Black Hat keynotes will address the AI-powered vulnerability discovery landscape that Project Glasswing has placed at the center of the security conversation. The specific themes most likely to dominate include the following. AI as an adversary capability: the demonstration that Claude Mythos solved 21 of 41 ExploitBench V8 arbitrary code execution challenges while every other model scored zero represents a capability threshold that the security industry cannot ignore. Keynote speakers will frame what this means for the defensive community's obligations and timelines. The collapse of patch windows: Glasswing's demonstration that AI can find 17-year-old bugs and develop working exploits without human-written code compresses the timeline from 'vulnerability exists' to 'exploit in the wild.' Keynotes will address whether the security industry's current patch management practices are adequate for the AI era. Regulatory response to AI security: the SEC disclosure rules and emerging AI-specific regulatory frameworks intersect with the AI security capability question. Keynotes from government officials will likely address how regulators are thinking about AI-era security disclosure and compliance obligations. The defensive use of AI: keynotes will also address the other side of the equation, specifically how organizations are deploying AI for defensive purposes, and what the evidence shows about AI's effectiveness as a security tool.

Black Hat 2026 keynote speakers will be announced in the months before the conference. To follow announcements as they are made, use the following channels. The official Black Hat website at blackhat.com is the authoritative source. The Briefings and keynote schedule pages are updated as speakers are confirmed. The official Black Hat Twitter/X account announces speakers and agenda updates and is typically the fastest channel for breaking announcements. The Black Hat email newsletter, available via the website, sends direct announcements to subscribers as major speakers and sessions are confirmed. Security journalism from outlets including Dark Reading, The Register, Wired Security, and Ars Technica covers major Black Hat announcements, including keynote speaker confirmations, as they are made. Following these sources is the most reliable way to track the 2026 keynote lineup as it develops.

Practitioners and CISOs consume Black Hat keynotes differently. For practitioners, the keynotes provide strategic context for interpreting the technical sessions. When a keynote speaker identifies AI-discovered Linux privilege escalation as a priority defensive challenge, that context helps practitioners prioritize which Briefings sessions to attend, which Arsenal tools to investigate, and which defensive improvements to propose to their organizations after the conference. For CISOs, the keynotes provide board-room language for security investment justification. A CISA Director statement about AI-era patch management timelines, delivered at the largest practitioner security conference in the world, is a more compelling external reference for a board conversation about patch management investment than an internal security team recommendation. The keynotes give security leaders external validation and vocabulary for discussions that might otherwise be treated as internal security team opinion. Both audiences benefit from watching keynotes not as isolated presentations but as the opening move in a multi-day conversation: the keynotes frame the themes that the Briefings sessions, Arsenal demonstrations, and hallway conversations will all engage with across the two Briefings days.

Attending keynotes in person provides the full conference experience: the energy of the room, the ability to observe the audience's reaction, and the context of being in the same space as the security community's most significant annual gathering. For practitioners who are already attending Black Hat Briefings, attending the opening keynotes in person on August 5 morning is strongly recommended. The keynote auditorium fills quickly for high-profile speakers, so arrive early. For those who cannot attend in person, Black Hat publishes keynote recordings on its official YouTube channel in the weeks following the conference. The recordings are the full presentation without audience interaction, which is generally the most valuable part. Some keynotes from high-profile government speakers are livestreamed during the conference; check the Black Hat website for any 2026 livestream announcements. Following the conference hashtag on Twitter/X in real time during keynotes provides a community reaction layer that the recordings do not capture.

The complete Black Hat 2026 keynote preparation guide, including the AI vulnerability discovery briefing materials, a framework for translating keynote themes into board-ready language, and a post-keynote debrief template for security team discussions, is available in the Mythos Brief for Decryption Digest subscribers.