Black Hat USA returns to Mandalay Bay in Las Vegas this August, bringing together security practitioners, researchers, and leaders from around the world. Rapid7 will be there in the Business Hall, with new capabilities, live demonstrations, expert-led sessions, and two days of activities at the Border Grill.

This year, our focus is preemptive security: helping security teams anticipate credible risk, respond at machine speed, and maintain an accurate view of their security and compliance posture as their environment changes.

Visit the Rapid7 booth at Black Hat USA

You can find Rapid7 at booth #2445 in the Mandalay Bay Business Hall, open and running on the following days and times:

• Tuesday, August 4: 4:00–7:00 p.m.

• Wednesday, August 5: 9:00 a.m.–6:00 p.m.

• Thursday, August 6: 9:00 a.m.–4:00 p.m.

The booth will include two demonstration stations, seating, giveaways, and our friendly team of Rapid7 experts – there to help you explore the challenges most relevant to your organization. A chess-inspired theme reflects the principle behind preemptive security: understanding what may happen next and acting before risk becomes an incident.

Live demonstrations will cover four connected areas of the Rapid7 platform:

Predictive risk and vulnerability management: See how attacker behavior and exposure context can help teams focus remediation on vulnerabilities that present credible risk.

Agentic threat detection and response: Explore how the Rapid7 AI Engine and technology from Kenzo Security support adaptive investigations and reduce the time analysts spend gathering context.

Continuous compliance automation: See how Cyber GRC connects governance workflows with live security data, automates evidence collection, and identifies control drift.

Preemptive MDR: Learn how continuous SOC operations, exposure context, and Rapid7 Labs threat intelligence can extend the coverage of internal security teams.

Explore the latest Rapid7 launches at Black Hat

Black Hat will provide a closer look at several additions to the Rapid7 platform, including the general availability of Cyber GRC.

Cyber GRC brings security operations and governance teams closer together by connecting GRC workflows with live security data. The solution draws evidence from SecOps telemetry into compliance dashboards, helping teams maintain a current view of their controls, while AI-assisted workflows reduce the manual inputs involved in third-party risk questionnaires and other repetitive tasks.

Attendees can also learn more about Preemptive MDR Alerts, predictive vulnerability management, and enhanced agentic SOC investigations. These capabilities combine exposure data, asset criticality, threat intelligence, and detection context to help teams identify where attackers are most likely to act. Some will be presented as early-access previews, so availability will vary.

Join us at Border Grill

Rapid7 will take over the Border Grill at Mandalay Bay on Wednesday, August 5 and Thursday, August 6. The space will include additional demonstrations, meeting areas, expert presentations, breakfasts & lunches, and opportunities to speak with Rapid7 leaders and product teams.

Highlights from the agenda include:

Preemptive Security for the Age of AI

Wednesday, August 5, 12:00–12:45 p.m.

Rapid7 Executive Chairman Corey Thomas will discuss how AI-driven threats are changing security operations and what it takes to move toward a more preemptive model.

Agentic SOC: Threat Detection and Response

Thursday, August 6, 9:30–10:15 a.m.

Lisa Washburn, Senior Director of Product Management, will explore how AI agents can investigate alerts at machine speed while keeping expert judgment involved.

Cyber GRC in the Age of AI

Thursday, August 6, 11:30 a.m.–12:15 p.m.

Jon Schipp, Senior Director of Product Management, will show how live security data and automated evidence can support continuous audit readiness.

Border Grill will also host live demos, customer and executive meetings, and the Rapid7 Happy Hour on Wednesday. VIP access begins at 4:00 p.m., followed by general admission from 5:00–7:30 p.m.

Hear from Rapid7 security researchers

Rapid7 researchers Jack Heysel and Spencer McIntyre will present The Metasploit Framework 6.5: Malleable C2 Payloads, New Relay Capability and Protocol Session Upgrades at Arsenal Station 4 in the Business Hall on Wednesday, August 5 from 4:00–5:00 p.m.

Book time with Rapid7 at Black Hat

Whether your priority is reducing exposure, giving SOC analysts better context, improving response speed, or strengthening audit readiness, you can book a meeting or tailored demonstration with the Rapid7 team.

Visit us at booth #2445, join us at Border Grill, or reserve time in advance. Register for the Rapid7 Black Hat experience here.

The shift toward preemptive security is underway, but most organizations are still navigating the realities of limited resources, fragmented tools, and emerging AI risk. At Rapid7’s recent Global Security Summit, we surveyed attendees to better understand where security leaders and practitioners stand today, what is shaping their priorities, and what they need to move forward. Their responses offer a candid view into the current state of security operations: ambitious, increasingly AI-aware, and ready for change, but still working through the practical challenges of getting there.

For many teams, the direction is clear: security needs to become more proactive, more connected, and more resilient. Attackers are moving quickly, environments are expanding, and teams are under pressure to reduce risk before it turns into business disruption. But the survey results show that most organizations are still somewhere in the middle of that journey.

Where organizations are today

One of the clearest findings is that security operations are increasingly collaborative. According to the survey, 57% of respondents operate in a hybrid internal and MDR model. That reflects a reality many teams know well: internal expertise remains essential, but external support can help extend coverage, add specialist knowledge, and support faster response when internal resources are stretched.

This hybrid model also speaks to the complexity security teams are managing. Modern environments span cloud, identity, endpoints, applications, third parties, and expanding attack surfaces. Keeping watch across all of it requires more than tooling alone. It requires the right mix of people, process, visibility, and support.

At the same time, many organizations are still working to connect the dots across their security ecosystem. Two-thirds of respondents said their security capabilities are only partially integrated. For analysts, partial integration often means more manual work: switching between tools, stitching together context, and making decisions with an incomplete picture. When teams are jumping between systems, manually stitching together context, or working from incomplete data, it becomes harder to act at the speed modern threats demand.

The survey also showed that only 10% of respondents describe their organization as “highly proactive” in predicting and preventing threats, which points to the reality of where many teams are today. The ambition is there, but becoming truly preemptive takes time, integration, and operational maturity. Most organizations are still balancing the day-to-day demands of reactive response with the longer-term work of building a more proactive security model.

Confidence levels tell a similar story. 59% of respondents said they are only somewhat confident in their organization’s ability to prevent attacks before impact. Security teams understand what is at stake, but many still lack full confidence that they can consistently stop threats before they affect the business.

AI is a priority, but trust matters

AI was, of course, another major theme in the survey. Interest is high, especially when it comes to improving efficiency, accelerating triage, and helping teams manage growing volumes of data and alerts, but adoption is still developing. 52% of respondents said AI is in early-stage exploration within their security operations.

AI has clear potential in the SOC and across security operations, from summarizing investigations to enriching alerts, supporting prioritization, and helping analysts move faster. But security teams have to be deliberate about how they apply it. In high-pressure environments where accuracy, context, and accountability matter, AI needs to earn trust.

The survey results show that trust is still a key consideration. 57% of respondents cited securing AI usage as a top AI and security concern, while 44% cited lack of transparency or trust. These responses reflect a practical mindset. Security leaders are thinking about both sides of AI: how it can help defenders move faster, and how to manage the new risks it introduces. Internally, for AI to become operationally valuable, it has to fit into existing workflows, provide explainable outputs, and support human expertise.

What security teams want next

When respondents were asked what is preventing them from becoming more proactive, the top challenges were practical and familiar. 54% cited limited staff or expertise, making capacity one of the biggest barriers to progress. Teams may have the ambition to become more preemptive, but many are already balancing daily alert queues, incident response, vulnerability backlogs, compliance pressure, and business-as-usual security demands.

Visibility is another major factor. 31% of respondents cited lack of visibility across the environment as a barrier to becoming more proactive. Without a clear view of assets, identities, exposures, and attacker activity, teams struggle to prioritize what matters most. This is especially important as organizations look to move from broad detection toward more risk-aware, preemptive action.

The priorities respondents selected show where they want to go next. 41% selected preemptive security as a top security leadership priority, while improving resilience, strengthening incident response, reducing complexity, and improving risk visibility also appeared as recurring themes.

The findings from our Global Security Summit make one thing clear: security teams are ready to move toward more proactive, integrated, and AI-enabled operations, but they need the right visibility, expertise, and confidence to do it well.

To hear more from the experts and practitioners who joined us at the summit, catch up on the on-demand sessions. And to learn how Rapid7 is helping organizations move toward preemptive security, explore Rapid7 Managed Detection and Response, built to disrupt attackers earlier with broad ecosystem coverage, risk visibility, expert guidance, and an AI-powered SOC.

AI is now part of almost every conversation in security operations. Most teams are already investing in it, experimenting with it, or trying to understand where it fits. The challenge is not whether to adopt AI, but how to apply it in a way that actually improves outcomes.

At the Rapid7 Global Cybersecurity Summit, the session The AI Dilemma: Automating Defense Without Surrendering Judgment explores how AI is being used in the SOC today, and where it creates real value in practice.

The discussion centers on a set of assumptions that often shape how teams approach AI, and why those assumptions do not always hold up in real environments.

Myth 1: AI will replace analysts

Across the session, there is a consistent focus on how AI supports investigation workflows by reducing repetitive work and surfacing relevant context, allowing analysts to focus on decisions that require judgment. AI helps teams move faster, but responsibility and accountability still sit with people. TL;DR, the role of the analyst is evolving, but it is not disappearing.

Myth 2: More automation means better security outcomes

Automation is valuable when it is applied in the right places. In practice, teams are finding the most benefit in areas such as enrichment, summarization, and triage, where large volumes of data need to be processed quickly. High-impact actions such as containment or configuration changes still require oversight, particularly when they can affect production systems or business operations.

Myth 3: Speed is more important than transparency

As adoption increases, trust becomes more important and analysts need to understand how a conclusion was reached before they act on it, especially in high-pressure situations. The session highlights how explainability builds confidence over time, allowing teams to rely on AI outputs without losing control of the decision-making process.

Myth 4: AI is only about efficiency gains

Efficiency is part of the story, but the impact runs deeper. AI helps connect signals across fragmented environments, reduces cognitive load, and supports more consistent decision-making. It also changes how teams approach investigation by making it easier to surface patterns and identify relationships that would be difficult to see manually.

Myth 5: Attackers benefit more from AI than defenders

Both attackers and defenders are learning how to use AI, and both are moving quickly. What matters for security teams is how they apply it within their own workflows. The session explores how AI strengthens detection, investigation, and response when it is integrated into existing processes rather than treated as a standalone capability.

Where AI creates real value in the SOC

Across the discussion, a clear pattern emerges. AI delivers the most value when it is applied to high-volume, context-heavy tasks, where it can process data, highlight signals, and recommend next steps. Analysts remain central to interpreting those signals, understanding intent, and deciding how to respond.

This balance between automation and oversight is what allows teams to scale their operations without losing confidence in their decisions. It also reflects how AI is being adopted across the industry, with most organizations maintaining moderate to high levels of human involvement as they build trust in these systems.

For SOC leaders, practitioners, and teams exploring AI, the session offers a grounded view of how these technologies are being applied today, and how that approach is continuing to evolve.

Watch the full session to explore how transparent AI supports better decisions in the SOC and how teams are applying it in practice.

Security leaders are facing an unusual set of circumstances. The drumbeat for better security prioritization has been rising for years in boardrooms around the world. The desire is there, but the processes of the past aren’t meeting the needs of the new moment we find ourselves in. 

That gap is not a technology problem. It's an operating model problem.

At the opening keynote of Rapid7’s 2026 Global Cybersecurity Summit, Craig Adams, Chief Product Officer, Rapid7, Brian Castagna, CSO, Rapid7 and IDC’s Research VP, Craig Robinson framed a simple idea: cyber defense needs to start earlier.

For more on this, download our new ebook, Preemptive Security: From Resilience to Action.

Complexity is outpacing control

Security environments have never been more connected or more difficult to manage. Cloud adoption, SaaS sprawl, third-party dependencies, and identity growth have expanded the attack surface in ways most programs were not designed to handle. Many teams have responded by adding more tools and more telemetry. This has resulted in more fragmentation, more dashboards, and more opportunities for important information to slip through the cracks. 

Teams are spending more time stitching context together than they are effectively reducing risk. This shows up in daily operations with analysts moving between multiple systems to validate alerts, and leaders lacking the clear picture to explain risk to the business. In a time when exposure management and detection & response can live on one platform, that level of fragmentation makes no sense.

Reactive security creates operational drag

The traditional model still dominates most security programs. It goes like this (stop us if you’ve heard this before): 1) Detect an alert. 2) Investigate. 3) Contain. 4) Recover. 5) Repeat, forever. 

Sounds simple, right? And it worked great when environments were simpler and attackers moved slower. That is no longer the case.

Today, initial access often happens quietly through identity abuse or misconfiguration. Attack paths form before an alert even fires. By the time a signal reaches the security team, attackers may already be moving laterally or accessing sensitive systems. This creates a cycle of constant response without consistent risk reduction. Teams get better at handling incidents but struggle to remove the conditions that enable them.

Security operations centers can receive thousands of alerts per day, many of which are low value or false positives. This leaves analysts spending hours triaging signals instead of focusing on the exposures most likely to lead to impact.

More alerts do not make you safer. They create drag. Better context creates better outcomes. 

The issue is prioritization, not visibility

Most organizations are not lacking data. They are lacking the clarity needed to understand the data they have and contextualize it as it relates to their business. Telemetry alone does not answer the question that matters most: what should we do first?

Attackers look for the most effective path into an environment, often combining smaller weaknesses across assets, identities, and systems until they create meaningful access. Security teams need a similarly connected view, one that helps them understand which exposures are exploitable, which assets are most critical, and how those risks relate across the environment. When teams can see that full picture, they can focus remediation on the issues most likely to be used in a real attack, making risk reduction more targeted, efficient, and defensible. 

The result is effort without impact.

Why security needs to start earlier

The summit’s keynote message is direct: meaningful action must move earlier in the lifecycle.

Preemptive Security introduces an operating model designed for that shift. It connects four core elements:

• Exposure management to identify and prioritize risk

• Managed detection and response (MDR) to monitor and act

• Artificial intelligence to reduce noise and accelerate analysis

• Human expertise to validate and decide

Together, these capabilities create a system that acts before risk becomes impact. Instead of waiting for alerts, teams identify likely breach paths. Instead of reacting to incidents, they reduce exposure ahead of time. Instead of managing disconnected tools, they operate with shared context and clear priorities. Detection and response becomes one leg of the stool with exposure management taking the lead in reducing risk before it becomes an emergency. 

What changes for security leaders

For CISOs and security leaders, this shift means designing programs around likely attack paths, not isolated findings. It means prioritizing investments based on risk reduction, not tool coverage and enabling teams to act decisively without increasing headcount or complexity.

It also changes how success is measured. The goal is fewer surprises, faster containment and reduced exposure before exploitation. It means starting earlier, to increase the likelihood of success. These are outcomes the business understands.

A new starting point for security

Ultimately, the environment has changed faster than the operating model. So the operating model needs to change. Luckily, there’s a proven path forward that can prevent the attacks from bad actors already moving in earlier, using technology to scale their operations, and exploiting small weaknesses to get a foothold. 

Preemptive Security provides the framework to close that gap. It helps teams reduce noise, focus on what matters, and act with confidence before disruption occurs. Security does not start with an alert. It starts with understanding risk early enough to do something about it.

Watch the keynote on demand or download the eBook, Preemptive Security: From Resilience to Action, to explore the model in more detail.