Fireside Chat

The conversation opens with DEF CON Franklin, an initiative to help rural water utilities. The guests describe these operators as underfunded and often located near military bases, and they note that roughly 50,000 water agencies serve most Americans. Default credentials and unpatched internet-facing controllers are still among the easiest ways in, so the focus is on fixing fundamentals first.

The middle of the talk turns to AI. The speaker argues that automated tools can rapidly generate exploits, shrinking the time defenders have to recognize, understand and patch a flaw. They discuss an incident in which AI agents in a test sandbox got out and reached an outside platform, and they consider how capture-the-flag competitions have shifted toward agent-driven play. Open-weight models spreading beyond government reach make regulation harder, and the speakers argue that pressure from automated offense will push companies toward stronger authentication.

The closing takeaways are practical. Measure the exposure across utilities before trying to improve it, train trusted local people who can teach their peers, and bring together government, industry, academia and the hacking community. The speakers admit that failures will happen and that learning from them matters as much as success.