EP 93: Teaching IoT Root Access to Strangers at DEF CON 34

Last summer 30+ Minnesota water utilities got hacked. No zero-days. No malware. Just default passwords on internet-exposed PLCs exposed. Eric Stride, Chief Security Officer at Huntress, discusses how AI now lets anyone attack US critical infrastructure.

Gaining root on an IoT device can open doors to cloud and remote networks, and make an adversarial attack relatively easy.  Deral Heiland, Principal Security Researcher for IoT at Rapid 7, discusses his training at the IoT Village at DEF CON 34, where even beginners can understand how this is done so they can better prepare for these attacks.

At DEF CON 34, Bob Botezatu, Senior Director Of Threat Research At Bitdefender,  discusses AI’s challenges in uncovering firmware vulnerabilities, highlighting the growing threat as criminal groups weaponize smart homes and connected devices.

At Black Hat USA 2026, cybersecurity experts issued a stark warning: we may have just three years to shore up the invisible web of keys and certificates that keeps power grids, billing systems, and critical infrastructure secure. Ellen Boehm of Keyfactor explains why the clock is ticking—and what must happen now with post-quantum cryptography.

Why one vendor breach can take down dozens of banks — third-party risk, AI-driven attacks, and why patching fast may beat patching safe today.  Jeffrey Wheatman, Senior Vice President, Cyber Risk Strategist at Black Kite, explains.

AI is rewriting the OT attack playbook. Growing cloud exposure and CVE backlogs are testing the energy sector—and regulation alone won't save it. Jori VanAntwerp, CEO and founder of Ember OT, discusses AI-driven attacks, NERC CIP 15, and why segmentation still matters.

Critical infrastructure is under attack. AI just made it easier. Legacy devices can't be patched. Piotr Kupisiewicz, CTO at Elisity, describes how your best defense is the basics that you're ignoring.

An AI agent wiped out an entire company’s data in just 9 seconds — no hacker, no ransomware involved. Todd Thorsen, Chief Information Security Officer at CrashPlan, explains how a misconfigured AI agent operating without safeguards may have caused the incident — and asks a troubling question: could your organization be next?

Cellular modules in your IoT devices are trusted and that trust can be an insecure  pivot point into your network for attackers. Deral Heiland, Principal Security Research for IoT at Rapid 7 discusses his presentation at RSAC 2026 on AT command exploits and supply chain risk.

Let’s face it, the Purdue model's DMZ is gone. Trevor Dearing, Director of Critical Infrastructure Solutions at Illumio, explains how zero trust, micro-segmentation, and explicit policy are now the only reliable defense for critical infrastructure OT.