Wednesday

This Proving Ground recording bundles four short talks, each addressing a different defensive problem. The first covers detecting attacks on air-gapped IoT devices. A proof-of-concept collects and normalizes device logs, groups them into templates, flags new or shifting patterns and volume spikes, then uses a small local language model to draft a summary for an analyst. The presenter acknowledged the setup consumes most of the device's CPU and memory, and that the model recommends actions rather than taking them.

The middle talks move to software supply chains and cloud exposure. One speaker walked through recent npm compromises, where malicious install scripts harvested developer credentials, and described a pipeline that watches newly published packages, runs open-source scanners, has AI triage the results, and pushes verdicts to a developer-side firewall with a minimum package age. A second speaker showed how to catch internet-exposed services within minutes by combining inventory snapshots and cloud change events with targeted port scans, instead of waiting for scheduled sweeps.

The final talk described an experiment that builds code graphs, slices paths from user input to sensitive sinks, and hands them to LLM agents that test a live WordPress plugin. It surfaced a blind SQL injection in a widely installed plugin, though it also produced many low-impact findings. The shared takeaways are to keep developer endpoints and untrusted inputs in scope, shorten the gap between a change and its verification, and keep AI output checkable with pass-or-fail tests.