Black Hat USA
- Next edition
- Jul 31 to Aug 5, 2027
- Where
- Mandalay Bay Convention Center, Las Vegas, NV, USA
- Usually
- Early August
- Format
- In-Person
- Organizer
- Black Hat
- Attendance
- 23,000+ in 2026 (reported by TSNN)
Editions
- Jul 31 to Aug 5, 2027 · Mandalay Bay Convention Center, Las Vegas, NV, USA
- Aug 1 to 6, 2026 · Mandalay Bay Convention Center, Las Vegas, NV, USA · concluded · our recap
What this conference is for
Black Hat USA is the largest vendor-neutral offensive-security research conference in North America, drawing more than 23,000 verified attendees to Las Vegas in August 2026, as reported by trade publication TSNN, for a program built around original vulnerability research, red-team methodology, and hands-on training rather than product pitches. It runs alongside DEF CON the same week and functions as the year's biggest venue for disclosing new attack techniques, including the ones that target authentication, passkeys, and non-human identity.
Who should attend
Security researchers and red teamers who want deep technical briefings, and identity and security leaders tracking which attack techniques are moving from research to real-world exploitation. The Business Hall also concentrates a year's worth of identity and access management product launches into two days.
What we cover
Black Hat's program spans the entire security stack, most of it outside identity. Our coverage is narrow and deliberate: the briefings, research disclosures, and vendor launches that are specifically about authentication, identity infrastructure, machine and non-human identity, and access control. See our Black Hat USA 2026 recap for what stood out this year.
Coverage
This is independent community coverage of identity-relevant themes, not an official summary of the conference. Always confirm specific research and product claims with the original researchers, vendors, or the official site.
Listen: episodes from or about Black Hat USA
- Pass-the-Passkey: What Michael Grafnetter's Black Hat Research Means for Entra Admins · Entra.Chat · 2026-08-17
Why passkey phishing resistance relies on the browser, and how local malware bypassed it via event log signature replay, native Windows APIs, browser hooking, and exported synced passkeys.
Related on Start with Identity
- BlogPass-the-Passkey: a Black Hat researcher found the WebAuthn implementation bugs, not the standard
At Black Hat USA 2026, SpecterOps principal security researcher Michael Grafnetter presented a family of passkey attacks including cleartext YubiKey signatures
- GlossaryAttack Path
A chain of individually legitimate permissions and relationships that together let a low-privileged identity reach a high-privileged one. Each link is a valid c
- GuideIdentity Threat Detection and Response (ITDR) Guide
A complete guide to implementing Identity Threat Detection and Response, covering detection rules for identity-based attacks, lateral movement detection, respon