As cybersecurity professionals gear up for Black Hat USA 2025, taking place August 2-7 in Las Vegas, the industry’s most anticipated event promises to deliver cutting-edge research, innovative solutions, and critical insights into the evolving threat landscape. With thousands of cybersecurity professionals converging to evaluate a broad range of security products and solutions, the conference serves as both a showcase for technological advancement and a crucial forum for addressing the complex challenges facing organizations in 2025.
In this exclusive VMblog Q&A series, we sit down with leading cybersecurity companies to explore what’s driving innovation in the space, how they’re addressing today’s most pressing security challenges, and what attendees can expect to discover at their Black Hat booths. From emerging threat vectors and AI-powered security solutions to zero-trust architectures and supply chain security, these conversations provide valuable insights into the technologies and strategies that will shape the cybersecurity landscape in the coming year.
Whether you’re a seasoned security professional planning your Black Hat agenda or simply looking to stay informed about the latest developments in cybersecurity, these in-depth discussions offer a unique opportunity to understand not just what these companies are building, but why it matters for the future of digital security. Join us as we dive deep into the minds of the innovators working to stay ahead of an ever-evolving threat landscape.
Ahead of the show, VMblog received an exclusive interview with Chuck Herrin, Field CISO at F5, a global leader in delivering and securing every app and API. Make sure to add them to your MUST SEE list.
++
VMblog: For readers who may not be familiar, can you give us the elevator pitch on your company and what makes you stand out in today’s cybersecurity landscape?
Chuck Herrin: F5 helps the largest, most complex organizations in the world deliver and secure every app and API-whether on prem, in the cloud, at the edge, or hybrid. We stand out with our Application Delivery and Security Platform (ADSP), building on our legacy of rock-solid delivery and reliability to now delivering the only solution that unifies high-performance load balancing, API discovery/protection, and advanced app security in one fully converged offering. For security practitioners, this means reducing the complexity of your tech and security stacks, fewer blind spots, and faster threat mitigation without needing to stitch together a bunch of point solutions. ADSP was built to handle modern, distributed architectures, so teams can adapt quickly as their environments grow more complex and attack surfaces expand.
VMblog: What’s your Black Hat sponsorship story? Are you a veteran exhibitor or is this a debut year? What draws your company to invest in this particular audience?
Herrin: We’re a veteran exhibitor at Black Hat. The technical depth and practitioner focus of this audience aligns perfectly with our platform capabilities and innovation story. It’s a great place to showcase cutting-edge functionality and have real conversations with people solving tough security problems.
VMblog: If a CISO visits your booth and walks away remembering just one thing about your company, what should that key message be?
Herrin: It’s time to get 90% out of 10 tools, rather than 10% out of 90 tools, and if you can get best of breed solutions like F5’s advanced WAF and market-leading Bot protection already integrated into a platform from a single, stable, publicly traded vendor, it becomes kind of a no-brainer. F5’s ADSP isn’t just another point tool-it’s a unified, high-performance platform built for today’s AI-driven, API-sprawled environments. It gives CISOs the consistency and visibility they need, with one control plane to secure apps and APIs across any architecture.
We also want them to remember that F5 isn’t just solving today’s problems. We’re already helping organizations prepare for what’s next, including the massive shift to post-quantum cryptography. Whether it’s defending against prompt injection attacks or future-proofing encryption, we’re focused on making security scalable, adaptable, and real-world ready.
VMblog: What are some of the key takeaways of your solution that Black Hat attendees should be aware of?
Herrin: F5’s Application Delivery and Security Platform is designed to help organizations confidently scale and secure AI-era applications across any environment. Key takeaways for Black Hat attendees include:
- Unified App and API Security: The platform integrates AI-powered threat detection, DDoS mitigation, bot defense, and API security into a single control plane-helping reduce complexity and blind spots across hybrid and multicloud environments.
- Operational Agility: By combining app delivery and security functions, organizations can move faster without sacrificing control. The platform supports consistent policy enforcement and visibility across edge, core, and cloud.
- AI-Ready Infrastructure: As more apps embed AI and ML features, the need for resilient, scalable infrastructure is critical. F5’s platform is built to optimize performance and security for modern, high-throughput workloads, including those powering AI factories.
It’s a future-proof foundation designed to help security teams shift from reactive to proactive protection, without slowing innovation.
VMblog: With AI attacks, supply chain vulnerabilities, and cloud security challenges dominating headlines in 2025, which of these threat vectors does your solution specifically address or focus on?
Herrin: We tackle all three. Our AI-specific capabilities include LLM scanning and defense, plus AI Gateway for prompt injection. Our Distributed Cloud Services cover bot/DDoS/API threats in cloud and edge. And with BIG-IP and NGINX integration, we give full-stack observability and security for modern supply chains.
VMblog: The “AI security arms race” is a hot topic this year. How is your company leveraging AI defensively, and what’s your take on the AI-powered threats we’re seeing emerge?
Herrin: This is something I’m really passionate about: making sure we’re not just racing to build AI, but also thinking critically about how to secure it. At F5, we’re using AI defensively in several ways. It powers our bot mitigation, helps detect API abuse patterns in real time, and underpins our AI Gateway, which protects LLM endpoints against prompt injection, sensitive data leakage, and model manipulation. These aren’t theoretical threats-they’re already happening in the wild.
But the real challenge isn’t just in the attacks themselves. It’s in how fast they’re evolving. Attackers are using AI to supercharge phishing, generate polymorphic malware, and identify vulnerabilities faster than ever before. I’ve written about this idea that if we treat AI like just another feature, we’re going to lose ground quickly. Security needs to be built into the AI development lifecycle from the start. At F5, we’re focused on making that possible by converging AI-native defenses with application and API security, so organizations can keep up without having to bolt on yet another point solution.
VMblog: What’s your company’s most compelling differentiator in a market where everyone claims to have the “next-generation” solution?
Herrin: We have a genuinely differentiated platform: the F5 Application Delivery and Security Platform (ADSP). In a market flooded with “next-gen” claims, what makes us stand out is convergence that actually delivers. ADSP is the only offering that unites high-performance app delivery (BIG-IP), API management and gateway functionality (NGINX), multicloud security services (Distributed Cloud WAAP), and AI-powered defenses into a single, scalable platform with unified policy and visibility across environments.
Most vendors are still stitching together point products. We’re giving organizations a way to simplify and secure their application ecosystem without tradeoffs, whether that means defending against emerging threats like prompt injection and LLM abuse, ensuring consistent API posture across hybrid architectures, or preparing now for challenges like post-quantum cryptography. And because ADSP spans traditional data centers, public cloud, SaaS, and the edge, it’s built to support where applications are going, not just where they are today.
F5 isn’t just talking about innovation. We’re delivering the infrastructure backbone that helps enterprises build fast, stay secure, and adapt in real time. That’s what true next-generation looks like.
VMblog: Zero-trust architecture has evolved significantly since 2024. How has your approach to zero-trust implementation changed, and what practical advice do you have for organizations still in the planning stages?
Herrin: Zero trust can’t stop at identity anymore. Not in a world where AI is generating code, making decisions, and even impersonating users. At F5, our approach has evolved to include deep app and API context, because the attack surface has shifted. It’s not just users accessing data, it’s AI agents calling APIs, triggering workflows, and potentially making unauthorized decisions. That changes the game.
We recommend organizations treat every API as untrusted until proven otherwise-especially those used by or exposed to AI systems. Build in crypto agility now, as harvest now / decrypt later attacks are already underway and post-quantum threats grow closer. Segment based on the trust level of the system making the request, not just the user. And automate discovery continuously, because AI systems are dynamic and can unintentionally generate shadow APIs or misconfigured endpoints. With F5 ADSP, you get the visibility and control to enforce zero-trust policies in real time, even as your architecture becomes more autonomous and AI-driven.
VMblog: What’s the biggest cybersecurity blind spot you’re seeing organizations struggle with in 2025, and how does your solution illuminate that gap?
Herrin: It’s API sprawl. In 2025, most organizations are still blind to hundreds-or even thousands-of API endpoints across their environments. That’s not just a visibility issue, it’s a security liability. At F5, we often say, “you can’t protect what you can’t see,” and that’s never been more true than now. The explosion of microservices, third-party integrations, and now AI-driven systems has created a perfect storm of unmanaged APIs, zombie endpoints, and undocumented LLM interfaces being spun up faster than security teams can track them.
The charge to “AI all the things” exacerbates this problem, as the average organization investing in GenAI – which is pretty much everyone AND everyone’s supply chains – increases their API count by about 5x, according to an IDC report on the topic last November.
The biggest blind spot we’re seeing is the assumption that all APIs are accounted for. They aren’t. And when those APIs are being accessed or generated by AI agents-often with elevated privileges or dynamic behavior-the risk increases dramatically. LLM endpoints in particular are emerging as a new class of exposed surface, often left unmonitored or protected by legacy tools that weren’t built for this use case.
F5’s ADSP helps close this gap with continuous discovery, classification, and enforcement, whether your APIs live on-prem, in the cloud, or are part of dynamic AI systems. It gives security teams a real-time map of their exposure, backed by policy controls that actually scale. You can’t reduce risk until you eliminate the unknowns, and that’s exactly what we help organizations do.
VMblog: Looking toward 2026 and beyond, what emerging threat or technology trend keeps you up at night, and how is your company preparing for it?
Herrin: The post-quantum era and the scale of AI-generated attack surfaces: it’s going to get messy fast. Quantum computing is the parallel geopolitical race condition with AI between the US and China, as AI dominance means potential global or regional dominance. The same thing goes for Quantum dominance, and China holds over 50% of the patents in that space. They are never slowing down, and there’s no exit ramp in sight, so Defenders need to be ready for this dual tornado of innovation to impact their enterprise more quickly than many people think. That’s why we’re doubling down on crypto agility and post-quantum cryptography readiness.
Whether it’s hybrid, AI, or quantum-every new axis is another layer to defend. The future won’t be about securing one stack or one environment, it will be about defending dynamic, machine-driven systems across every surface. We’re building for that future now, so organizations aren’t left scrambling when theoretical threats become real.
VMblog: Beyond your product pitch, what’s one piece of actionable cybersecurity wisdom you’d share with every Black Hat attendee who stops by your booth?
Herrin: Protect your APIs and AI endpoints just like you would your most critical applications. They’re often the real way attackers get in-not the login page or front-end UI. If something is handling sensitive data or triggering business logic, it deserves real security controls: monitoring, authentication, rate limiting, and anomaly detection. Too many teams overlook these layers, but that’s exactly where the biggest breaches are happening now. Don’t assume it’s safe just because it’s behind the scenes.
VMblog: Does your team have any speaking engagements, workshop sessions, or research presentations at Black Hat that attendees should prioritize?
Herrin: Yes, I’ll be speaking at the AI Summit at Black Hat USA on Tuesday, August 5, as part of the full-day pre-event focused entirely on AI security. My panel session is titled “Addressing Real-World AI Security Challenges,” and it’s something I’m genuinely excited about.
We’ll dig into how enterprise AI infrastructure is evolving, and how the attack surface is evolving with it. I’ll cover real examples of threats we’re already seeing in production, like prompt injection, model exfiltration, LLM hallucinations being exploited for fraud, and blind spots created by API sprawl. I’ll also share practical guidance on how to secure these systems without slowing innovation, from AI gateways and traffic filtering, to continuous policy enforcement and crypto agility. If you’re building or defending AI systems, especially in enterprise environments, this session will be highly relevant.
VMblog: The post-quantum cryptography transition is no longer theoretical. What practical steps should organizations be taking now, and how complex is this migration really going to be?
Herrin: The transition to post-quantum cryptography (PQC) is no longer just a theoretical concern-it’s a foundational security shift that requires immediate, proactive planning. Organizations should begin by inventorying their cryptographic assets and understanding where quantum-vulnerable algorithms are currently in use across their environments. This includes third-party dependencies and APIs, which are often overlooked but represent a major exposure point. Equally important is implementing crypto agility: the ability to swap algorithms without having to rip and replace systems. Forward-thinking organizations are also starting to test PQC algorithms in non-production environments to understand performance implications and compatibility.
This migration won’t be a simple patch or toggle. It’s a multi-year transformation that cuts across infrastructure, governance, and application layers. It’s not just about hardening encryption; it’s about preparing for a broader re-architecture of how trust and identity are enforced in a quantum world. With guidance and standards still evolving, the real complexity lies in making sure your systems are adaptable. That’s why organizations should start now, while they still have the luxury of time, rather than scrambling once the threat becomes urgent. My number one rule for managing critical risks is the best time to manage it is while there’s still time to do so, but that time is already running very short as harvest now / decrypt later attacks are already happening, and once Q-Day arrives, that data will have to be considered breached.
VMblog: If you had to predict the cybersecurity conversation we’ll all be having at Black Hat 2026, what topic or challenge do you think will dominate the discourse?
Herrin: Post-quantum AI standoffs and dealing with an even more dynamic attack surface. As people and companies start using AI agents in earnest, we’re going to find a lot of basics matter more than ever. Visibility gaps, non-deterministic systems dynamically spinning up and spinning down software and APIs, and the continuing innovations of attackers are going to be center stage, and companies that haven’t acted between now and then to get their APIs and application attack surfaces under control are going to be even more behind the curve than they are today.
That’s the collision course we’re heading toward, and it’s going to dominate the conversation at Black Hat 2026. As LLMs become deeply embedded in enterprise systems and even autonomous decision-making, the security of those models-and the data they rely on-becomes mission-critical. At the same time, advances in quantum computing are getting close enough to pose a real threat to today’s encryption standards.
So the next frontier won’t just be about securing AI, or preparing for quantum. It’ll be about the intersection of the two: using quantum-resistant cryptography to protect data and LLM pipelines, training data, and API communication at scale. We’ll be talking about how to encrypt data-in-use inside AI agents, how to prevent exfiltration via model outputs, and how to embed post-quantum readiness into AI infrastructure from the start.
It’s no longer enough to bolt on defenses. We’re heading into a world where security, performance, and trust have to be designed together. And the organizations that figure out how to do that first will have a serious advantage.
##
