Many companies are showcasing their cybersecurity products and services this week at the 2026 edition of the Black Hat conference in Las Vegas.
To help cut through the clutter, the SecurityWeek team is publishing a digest summarizing vendor announcements at Black Hat USA 2026, including new products and services, updates to existing offerings, reports, and other initiatives.
This is the fourth part of the series. You can also read Part 1, Part 2, and Part 3 if you haven’t already.
1Password research into AI-generated patches
1Password’s new security research team, Off-By-1 Labs, has released its inaugural research, which found that AI-generated vulnerability patches often fail to fully resolve the original vulnerability and sometimes introduce new ones in the process. After evaluating over 6,000 patches across recently disclosed, complex vulnerabilities in open source software, researchers found that 54% of analyzed patches did not remediate the target vulnerability. They failed to resolve the original vulnerability, introduced a new vulnerability, or both. Only 26% of patches fully resolved the vulnerability without materially changing application behavior, while 20% resolved the vulnerability while changing application behavior.
In addition, 1Password launched 1Password Privileged Access, which extends its Unified Access platform into the PAM market. 1Password Privileged Access removes standing access altogether rather than continuously guarding it like traditional PAM tools. The account is created when access is requested, scoped to the task and deleted automatically when the work is done.
Cogent releases Mythos-class AI model
Cogent Security has released what it claims to be a frontier AI model to match Anthropic’s Mythos. The company says a frontier model like Mythos can reason about security in the abstract, but it does not deeply understand the environment it is defending, including business context, identities, and runtime controls. Cogent claims its VR-1 model correlates this data into a machine-readable representation of an enterprise’s security posture, with a security harness that keeps its reasoning grounded in the organization’s actual environment.
CyberProof threat research
CyberProof published research detailing an investigation involving a browser-downloaded software installer disguised as a free utility. The attack relies on user interaction without exploiting software vulnerabilities, and demonstrates a prevalent trend: attackers leveraging convincing landing pages, valid code-signing certificates, and server-side control. CyberProof’s analysis details the complete delivery chain and the potential downstream impact if prevention had failed.
Cyble updates Titan platform with hardware attestation and automated response
Cyble announced an update to its Cyble Titan endpoint security platform that integrates silicon-rooted attestation. The platform combines endpoint activity with threat intelligence, behavioral analytics, and automated attack reconstruction (powered by BlazeAI) to form complete Indicators of Attack. It also consolidates device controls, exposure management, and auditable response workflows into a single interface.
KnowBe4 rolls out enhanced Real-Time Coaching capabilities
Training and workforce security firm KnowBe4 is rolling out enhanced Real-Time Coaching capabilities, delivering an instant, bite-sized SecurityTip when risky behavior is detected. The new capabilities help create secure habits, reduce repeat incidents, and get factored into an organization’s Risk Score.
NeuralTrust introduces gateway-based runtime security for AI agents
NeuralTrust has launched a runtime security mesh designed to protect AI agents without requiring custom integrations. Operating through its Agent Gateway, the platform directly inspects agentic traffic across the entire interaction lifecycle. The system actively monitors agent reasoning to detect drift, validates tool authentication policies, and flags malicious payloads like prompt injections and exposed credentials. All captured alerts, audit logs, and analytics can be synced directly to an enterprise SIEM.
Optiv introduces Agentic Security Operations
Optiv has introduced Optiv Agentic Security Operations, a managed service model that integrates Google Security Operations and Wiz. The platform leverages agentic AI to analyze incoming alerts and surface environment-wide risks, which are then contextually enriched with cloud, identity, and exposure telemetry from Wiz Cloud, Wiz Code, and Wiz Defend.
RapidFort launches continuous threat elimination solution
Software supply chain security firm RapidFort launched RapidFort Runtime, a real-time-based security solution that extends the company’s platform to create an end-to-end continuous threat elimination solution that includes curated open source software, continuous CVE monitoring, and tamper detection in live production environments. RapidFort Runtime operates inside an organization’s production environment, continuously monitoring deployed software, detecting unauthorized or unexpected changes, and proactively tracking newly discovered CVEs.
Synack details NatJack attack
Synack Red Team researcher Malcolm Stagg revealed NatJack, a new class of attacks that exploits trust assumptions built into network address translation (NAT). Testing found the underlying weakness across independently developed NAT implementations in Windows, Linux and macOS. The research, conducted over several years, identified four techniques attackers can use against NAT devices: hijacking active TCP connections, poisoning DNS responses, identifying the ports assigned to other connections, and forcing denial of service by exhausting a device’s NAT table. Two CVEs have been assigned to date: CVE-2026-56181, affecting Microsoft Windows NAT in Hyper-V, and CVE-2026-63913, affecting the Linux netfilter conntrack subsystem.
Vectra AI launches AI Pro
Security and observability firm Vectra AI has launched Vectra AI Pro, a new offering designed to help organizations adopt AI safely across the SOC through trusted signal intelligence. Vectra AI Pro continuously correlates network, identity, cloud, SaaS, EDR, and SASE signals into a unified understanding of attacker behavior, giving AI agents the context they need to reason accurately and act confidently.
Zenity warns of malicious skills campaign and launches free service
In addition to its PleaseFix research, AI security company Zenity detailed an active malicious skills campaign distributed through Vercel’s skills.sh. The affected skill family amassed over 1.7 million aggregate installs. The campaign, disrupted by Zenity and Vercel, was investigated using AI Total, a new free threat intelligence service that dynamically executes AI agent skills inside a contained environment and analyzes their runtime behavior.
