6 years of Adversary Village Keeping up with the adversaries and why it takes a village

This panel marks the sixth year of Adversary Village, a DEF CON space for people who study and test adversary tradecraft. The organizers recall the village's cramped first meeting, when fire marshals had to clear an overfilled room, and explain how submissions are reviewed so that talks stay focused on adversary behavior instead of overlapping with other villages.

A recurring theme is the difference between simulation and emulation. One panelist describes simulation as reproducing the indicators and commands seen in a real campaign, which pays off early but goes stale quickly. Emulation instead models how a particular threat would act against a specific organization, using knowledge of its motives, business units and weak points. The group argues that the industry still lacks clarity on these terms, and that practitioners need to explain the distinction to executives who decide how testing is funded.

On AI, the speakers see generative models as a multiplier that amplifies the skill of whoever directs them. They caution that using models to choose the right next step after initial access is hard, that generated attack code often repeats the same flaws, and that command and control and post-compromise techniques have changed little. They close by asking for work that goes beyond rehashing known techniques, including honest accounts of what did not work, and invite attendees to the village's hands-on labs and full-scope CTF.