Chloe Maraina is a specialist who thrives in the intersection of big data and visual storytelling, turning overwhelming streams of information into actionable intelligence. As a Business Intelligence expert with a deep-seated passion for data science, she has spent her career mastering the art of integration and management in environments where a single missed data point can spell disaster. Her vision for the future of data management is not just about collection, but about the sophisticated interpretation of signals within the noise. In the context of the Black Hat conference in Las Vegas, Chloe provides a unique lens into how a massive, high-stakes network is built from the ground up to survive an onslaught of the world’s most capable hackers. This interview explores the rigorous demands of the Black Hat Network Operations Center, the evolution of threat hunting at scale, and the custom AI innovations keeping 23,000 attendees safe.
The conversation covers the strategic decision to replace all existing network infrastructure upon arrival at the venue and the logistical feat of scaling a team from three members to over 100 specialists. We examine the methodology behind filtering 285 million informational alerts down to a handful of critical blocks and how the team distinguishes between legitimate security research and malicious intent. Furthermore, the discussion highlights the development of bespoke tools like FragglePacket and the implementation of multiagent LLM platforms such as NOCgentic and SOCgentic. Finally, the expert shares insights into the role of AI as a force multiplier for human analysts and provides a forecast for the changing nature of automated network threats.
When establishing a network for thousands of security-conscious attendees, you replace every piece of existing hardware; what is the strategic reasoning behind such a radical overhaul?
The decision to rip out every existing router, switch, firewall, and access point at Mandalay Bay is born out of a necessity for absolute, granular control over the environment. In a typical corporate setting, you might rely on a third-party facility’s infrastructure, but when you are hosting more than 23,000 of the world’s most elite security professionals and hackers, the risk profile changes entirely. We cannot afford the luxury of opening a support ticket and waiting 90 minutes for a response from the venue’s team when something goes wrong, because in this environment, something hitting the fan is a statistical certainty rather than a possibility. By deploying our own handpicked vendor products from partners like Arista, Palo Alto Networks, and Cisco, we ensure that we have the immediate visibility and mitigation capabilities required to protect the network. This “control freak” approach allows us to respond instantly to threats, which is vital when you realize that this year, the internal servers were attacked within just 15 minutes of the network being established.
The Black Hat conference has grown significantly over the last two decades; how has the Network Operations Center evolved to handle this massive increase in scale and complexity?
The evolution of the NOC is a testament to the staggering growth of the cybersecurity industry itself, moving from a small operation of three people to a sophisticated team of over 100 members. In the early days, the team used open-source scripts and basic hardware to secure a show with only 1,500 attendees and 15 training classes, but we are now securing more than 15 times that many people. We currently manage over 100 training classes, many of which max out at 100 students each, creating a high-density environment that demands massive throughput and stability. To keep up with these demands, we have transitioned from simple scripts to a powerhouse of integrated technology, including AI-enabled security platforms that aggregate SIEM, SOAR, and XDR alerts. It is no longer just about standing up infrastructure; it is about managing an enterprise-grade network that functions as a live laboratory for ethical hackers while remaining robust enough to withstand constant external probing.
In an environment where almost every user is actively probing the network, how do you manage the “needle in a needle stack” challenge of identifying truly malicious actors?
The data management challenge at Black Hat is truly unparalleled, as we are essentially looking for malicious activity within a sea of traffic that would be considered hostile in any other setting. To give you a sense of the scale, during the most recent show, our systems generated 285 million informational alerts, which required a massive amount of automated and manual filtration to process. We whittled that staggering number down to 17.1 million actual threats, but the real work happened when we isolated the 383 specific threats that actually required blocking. This process is about identifying the outliers—the specific IP or MAC addresses that represent a single actor trying to exploit the network beyond the scope of the sanctioned activities. By building profiles on these individuals, we maintain a 100% success rate in identifying who they are and where they work, often allowing us to simply walk into a classroom and tell them to stop their illegal activity before law enforcement needs to be involved.
The term “Black Hat positives” is used to describe a unique phenomenon at this event; could you elaborate on how your team differentiates between authorized research and genuine threats?
Differentiating between a researcher demonstrating a zero-day exploit and a malicious actor trying to steal data is one of the most nuanced tasks the NOC team performs. We call the expected but aggressive behavior “Black Hat positives,” and these are the millions of threats that are technically “attacks” but are actually part of the 100+ training classes or live presentations happening on site. Our strategy involves a heavy reliance on context; for instance, if we see a flurry of exploit traffic coming from a specific classroom where that exact technique is being taught, we categorize it as a positive and let it continue. However, when the traffic patterns deviate from the curriculum or target the internal NOC infrastructure, it trips our sensors and we zoom in on that specific outlier. This is where the human-in-the-loop becomes essential, as an analyst must weigh the sensory details of the traffic against the conference schedule to decide whether to slap the user on the wrist or initiate a full-scale mitigation.
You mentioned the development of a custom tool called FragglePacket; what specific gaps in commercial technology led to the creation of this “network troubleshooting monster”?
FragglePacket was born out of pure necessity when we realized that even the most advanced commercial tools couldn’t handle the unique loads and specific feature requirements of the Black Hat environment. We needed something that didn’t just monitor the network but could actively carve through it to find every single point of failure in real-time. This year, we leveraged AI to accelerate the development of this Rust-based tool, adding 71 new features including packet fuzzing, attack path probing, and staged HTTPS analysis. It has evolved into a rule-based diagnosis engine that can perform PCAP replays and handle deep network diagnostics that go far beyond what a standard enterprise tool offers. By writing our own code, we ensure that the tool fits the specific “Minority Report” style of proactive monitoring we require, where we can see problematic behaviors before they even fully manifest on the wire.
AI agents like Trevor and NOCgentic have become part of the team; how do these platforms change the daily workflow for a threat hunter in the NOC?
The introduction of AI agents like Trevor and the multiagent LLM platform NOCgentic has acted as a significant force multiplier, allowing our analysts to move much faster through mountains of telemetry. Trevor interfaces directly with the Palo Alto security platform, allowing an analyst to query a specific address and have the agent dig through millions of logs in seconds, a task that would manually take a human significantly longer. NOCgentic takes this a step further by acting as a “hand-holdy” mentor, routing complex questions to specialist agents and providing level 1 threat hunters with the expertise of a level 3 or 4 analyst. These tools don’t replace our people, but they do handle the tedium and “brute force” data retrieval that often leads to analyst burnout during the high-stress environment of the show. We even gave the SOCgentic version a jaded, comically cynical personality because we believe that making an exhausted analyst smile is just as important as the technical data the tool provides.
Despite the heavy integration of AI and automation, why is it still critical to maintain a “human in the loop” within the network operations center?
The human element is irreplaceable because AI, for all its speed, still lacks the ability to make nuanced ethical and situational judgments in an environment as complex as Black Hat. AI attacks, while fast, are often very “loud” and lack the stealth required to bypass our deception technologies, often tripping every wire and falling into honeypots simply because they “don’t care.” A human analyst can see a “Black Hat positive” and understand the intent behind the code, whereas an automated system might see the exploit and shut down a legitimate, high-value research presentation. We use our “Precogs”—sensors that alert us to problematic behavior—to feed information to our analysts, but the final decision to block a user or contact their employer always rests with a person. Our goal is to make our smart people more efficient, not to outsource the critical thinking that keeps a network of 23,000 hackers from descending into total chaos.
What is your forecast for the evolution of AI-driven threats and the defense strategies required to counter them over the next few years?
My forecast for the near future, specifically looking toward 2027, is that we will see a significant shift from “loud” AI attacks to highly stealthy, adaptive automated threats that are specifically designed to mimic legitimate user behavior. Currently, AI-powered threats are relatively easy to spot because they are aggressive and lack the subtlety of a human hacker, but they are improving at a rate that will soon make them much harder to trap with standard canaries and honeypots. To counter this, defense strategies will have to move away from simple pattern matching and toward deep, multiagent LLM platforms that can engage in “post-cognition” and “pre-cognition” to predict an attacker’s next move. We are already hardening our own models and releasing them on platforms like Hugging Face and GitHub to ensure the community has the tools to fight back. The arms race will continue, but as long as we continue to build “harnesses” and custom skills for our AI agents, we will stay ahead of the curve in protecting even the most targeted networks.
