Black Hat 2026: What should you be allowed to talk to AI about?

My Black Hat came to about 16,500 steps a day and 24 meetings. In almost every one of those meetings, the same question came up from security leaders. Not whether their people are using AI, that ship has sailed, but what those people are actually typing into it, and what to do about it. That is the question I got twenty minutes on stage to answer, and this is the short version.

The reason it is hard is a change in where work starts. It used to start in a search box you could log. Now it starts in a chat window, on a system you do not run, and the useful part of the interaction, the prompt itself, never touches your network in a form you can read. Your employees are moving real data into AI faster than anyone can see it, and blocking the tools stopped being an option the moment the business needed them.

To me governance is two things. Knowing what is going on, and setting the rules for what is allowed. Whatever the right speed of AI adoption is for your organization, your controls should match it.

Three ways to govern AI

Watching how organizations actually do this, we see three levels.

Block everything. Point your EDR, SASE or secure web gateway at every AI tool. It holds until the business needs AI, and then it does not. I spoke with the now former CISO of a California bank whose policy was a hard no. He called it the most career-limiting move of his career, and he made it at sixty, looking for his next role.

Allow some. Approve a short list of providers and block the rest, the classic Microsoft shop all in on Copilot. Better, but the control stops at the login screen. It answers which tool, and says nothing about what people do once they are inside.

Allow or deny anything. Govern what people can and cannot do inside any tool, by topic. This is where the value is, and where teams get stuck.

Why the third level only works at the topic

Take insurance. You are happy for AI to help with almost anything, except a policy or claims decision, because there is case law showing that automating those can end badly. How do you know a conversation has crossed from a general question into a claims decision? Not from the provider, not from a PII match, not from whether a file was uploaded. Only from the intent of the prompt itself.

That is what topic guardrails do. You describe a topic in plain language, sensitive, off-limits or regulated, and it is enforced on prompts and responses by meaning rather than by keyword or vendor. Three forces make this non-optional.

Regulation. The EU AI Act bans eight practices outright, things like subliminal manipulation and untargeted facial scraping, and you are liable if you serve European customers. You cannot catch those with a regex, only by intent. Connecticut's AI act is already live, California's is arriving, and more states will follow.

Cost. LLM providers moved to utility pricing and do not show you your token spend in real time. Uber burned its 2026 AI budget in four months, one two-hour session cost $1,200, and it now caps staff at $1,500 per tool per month. Without capture at the prompt level you cannot even estimate this, and you keep paying for prompts that have nothing to do with work.

Intelligence. Your prompts are a data source. Satya Nadella called it the exhaust, and he is right. Read what a department actually uses AI for and you learn where people are missing a tool, missing training, or fighting a broken process. We wrote about reading that aggregate safely in what your workforce's AI prompts reveal.

Why your current tools miss it

The tools you would reach for, EDR and SASE, intentionally drop the payload. A sample log line reads: here is Jeremy, a request to ChatGPT, 256 kilobytes, end of entry. No idea what was inside. To govern by intent you have to capture the thing those tools throw away.

The Hugging Face incident showed why that matters. An OpenAI model running as an autonomous agent built its own attack chain and breached Hugging Face, and both sides came out ahead only because the logs were fully intact, metadata, prompts and responses. You can feed that into another model and reconstruct the whole event. Miss that layer and you get none of it. We broke it down in the first real agentic attack.

From written policy to real enforcement

Today's problem is the workforce, the AI your employees use across browser, workspace and endpoint. Tomorrow's is the workload, the AI you build into your own applications and agents. One set of controls should cover both.

At Black Hat I showed two live blocks. A prompt starting "I am a lawyer working on a contract" stopped in line, because contracts are written as a topic. And one we launched that week, a prompt from a disgruntled employee preparing to take data with them, caught on intent before anything left. Both enforced through a browser extension or an endpoint agent on Mac and Windows.

That is governing by intent in practice. Not blocking a vendor, not matching a pattern, but reading what a prompt is trying to do and applying your rule to that. The spectacle end of these conferences comes and goes. The real work, governing AI at the level where the decisions happen, is only starting.

The full talk and slides are below.

Get the slides - The slides walk through the whole thing, from the three levels to topic guardrails in action.