Tuesday

This recording covers a run of sessions from one BSides Las Vegas day. It opens with an analysis of small businesses that closed after a cyber incident. The speaker built a list of roughly three dozen companies and examined what actually drove them under, finding that recovery speed, recovery cost, lost customers, and lawsuits mattered more than company size, and that a widely repeated statistic about business closures has no solid basis.

Later sessions focus on AI agents. One presenter proposes giving agents portable cryptographic identities and using fine-grained authorization to decide what each agent may do. The demo is a live multiplayer word game in which agents from separate servers take turns, and unauthorized actions are denied in real time. Another session presents an open-source scanner for Model Context Protocol servers that combines static analysis with dynamic testing, so that a suspected injection path only counts once it is confirmed by running it. A lighter session walks through a company that delegated decisions to AI tools and the problems that followed.

The day also includes an Electronic Frontier Foundation panel covering license plate readers, age verification, interoperability under the Computer Fraud and Abuse Act, and how to run community security training. A talk on encryption flaws in internet-connected intimate devices and their companion apps closes the block. Practitioners should take away the value of evidence-driven priorities, verifying what agents are permitted to do, and treating surveillance as a harm to be designed against.