Make the most of your time at AWS re:Invent with direct access to Palo Alto Networks executives, technical leaders, and cloud security experts.
Join us for focused, high-value conversations around your priorities, from reviewing your current cloud architecture and strengthening your security strategy to discussing emerging threat trends and planning for the year ahead.
The Wynn Hospitality Suite | Nov 30–Dec 4
Step away from the crowds for a more relaxed conversation over a drink. Connect with our team to discuss your 2027 priorities, cloud strategy, and evolving security needs.
Sala 118 at The Venetian | Dec 2–3
Our dedicated destination for deeper strategy sessions, executive briefings, and hands-on conversations tailored to your business.
Frontier AI is transforming cyber threats, acting as a force multiplier across the kill chain. Adversaries leverage AI to scale social engineering, accelerate vulnerability discovery, and iterate malicious code. In this session, we highlight Palo Alto Networks’ approach to securing the frontier, by combining AI-powered Next-Generation Firewalls (NGFW) and Frontier Virtual Patching (FVP) to preemptively block zero days, alongside identity controls and Secure AI Coding to protect developer workflows. Attendees will learn how threat intelligence and proactive defense outpace machine scale adversaries.
 While Windows System Calls have become a popular method for evading antivirus detection, they present considerable challenges beyond simple shellcode encryption/decryption. Unlike Linux, executing Windows System Calls often necessitates extensive setup, due to the need for specific C structures, which makes the code more complex and prone to errors compared to typical API calls. As a result, many developers turn to high-level languages like C to avoid the complexities of Assembly, particularly in malware development.
Â
SHELLSILO addresses these challenges by offering an innovative solution for System Call shellcode generation.
Cloud Offensive Breach and Risk Assessment (COBRA) is an open-source tool designed to empower users to simulate attacks within multi-cloud environments, offering a comprehensive evaluation of security controls. By automating the testing of various threat vectors including external and insider threats, lateral movement, and data exfiltration, COBRA enables organizations to gain insights into their security posture vulnerabilities. COBRA is designed to conduct simulated attacks to assess an organization's ability to detect and respond to security threats effectively.
Google Drive in recent years has become one of the most abused platforms for threat actors to conduct illegal and malicious activity. Threat actors use Google accounts to launch, store, and log malware, effectively turning Drive into a command and control center. On the side of legal and ethical activity, Google Drive remains a popular platform for security researchers to store these artifacts in summarized write-ups and spreadsheets of malicious and illegal activity observed. Much like an archaeologist looks for artifacts providing clues of the history of civilization, security researchers look for Indicators of Compromise (IOCs), which are clues to what a threat actor has done. Security engineers have worked across decades to build out tooling to analyze hard drives and network resources; however, similar advances to analyze Google Drive resources have remained underdeveloped. Along the same line, tools that aggregate and summarize collections of records on IOCs stored in Google Drive by researchers are also lacking.
The GDIOCSpider (Google Drive IOC Spider) provides a tool for both of these use cases.Â
Frontier AI is transforming cyber threats, acting as a force multiplier across the kill chain. Adversaries leverage AI to scale social engineering, accelerate vulnerability discovery, and iterate malicious code. In this session, we highlight Palo Alto Networks’ approach to securing the frontier, by combining AI-powered Next-Generation Firewalls (NGFW) and Frontier Virtual Patching (FVP) to preemptively block zero days, alongside identity controls and Secure AI Coding to protect developer workflows. Attendees will learn how threat intelligence and proactive defense outpace machine scale adversaries.
Â
Â
Join us on Tuesday evening for an intimate gathering with Unit 42 threat researchers, incident responders and security consultants and Palo Alto Networks product leaders. Enjoy great food, drinks, and music from our live DJ as we kick off the week.
Date: Tuesday, August 4, 2026
Time: 4:00 PM - 7:00 PMÂ
Location: Azure at Mandalay BayÂ
Â
The clock is ticking. Do you have what it takes?
Â
Step into the arena at Black Hat and test your threat-hunting and incident response skills in our interactive SOC Transformation Capture the Flag (CTF) challenge.
Go head-to-head with your peers and fight AI-powered threats with AI-driven security. Use the intelligence and automation of Cortex XSIAM® to detect, investigate, and respond to complex attacks and secure your spot at the top of the leaderboard. Â
Â
Â
Dates:
Wednesday, August 5, 2026
Thursday, August 6, 2026
Time: 11:15 AM – 4:00 PMÂ
Location: Azure at Mandalay Bay
Â
Space is limited per session claim your spot and accept your mission!
Â
Understanding AI vulnerabilities requires seeing them in action. That’s why we’re sponsoring a special event with Huntr , the AI security platform driven by 19,000+ ethical hackers—to bring a live, interactive AI hacking competition to Black Hat launching August 1. Through a simulated chat interface, you’ll get hands-on experience attempting to bypass AI agent guardrails.Â
How to play.
- Head to the Comprehensive AI Security demo station.
- Pick Your Target: Launch the simulated chat interface on the Huntr platform on your personal device.
- Hack the Bot: Force the system to bypass safety controls or leak restricted data.
$15,000 Global Prize Pool: Compete live at the booth or online—competition remains open through late August / mid-September.
Adversarial AI has super-charged cybercrime, letting even low-skill actors craft convincing deepfakes and run end-to-end campaigns at machine speed—often 10× faster than traditional methods. Drawing on insights from hundreds of Unit 42 incident-response engagements, our experts will unpack the latest AI-driven tactics across the attack chain and deliver field-tested defenses you can deploy now to stay ahead of accelerated threats.
 While Windows System Calls have become a popular method for evading antivirus detection, they present considerable challenges beyond simple shellcode encryption/decryption. Unlike Linux, executing Windows System Calls often necessitates extensive setup, due to the need for specific C structures, which makes the code more complex and prone to errors compared to typical API calls. As a result, many developers turn to high-level languages like C to avoid the complexities of Assembly, particularly in malware development.
Â
SHELLSILO addresses these challenges by offering an innovative solution for System Call shellcode generation.
Cloud Offensive Breach and Risk Assessment (COBRA) is an open-source tool designed to empower users to simulate attacks within multi-cloud environments, offering a comprehensive evaluation of security controls. By automating the testing of various threat vectors including external and insider threats, lateral movement, and data exfiltration, COBRA enables organizations to gain insights into their security posture vulnerabilities. COBRA is designed to conduct simulated attacks to assess an organization's ability to detect and respond to security threats effectively.
Google Drive in recent years has become one of the most abused platforms for threat actors to conduct illegal and malicious activity. Threat actors use Google accounts to launch, store, and log malware, effectively turning Drive into a command and control center. On the side of legal and ethical activity, Google Drive remains a popular platform for security researchers to store these artifacts in summarized write-ups and spreadsheets of malicious and illegal activity observed. Much like an archaeologist looks for artifacts providing clues of the history of civilization, security researchers look for Indicators of Compromise (IOCs), which are clues to what a threat actor has done. Security engineers have worked across decades to build out tooling to analyze hard drives and network resources; however, similar advances to analyze Google Drive resources have remained underdeveloped. Along the same line, tools that aggregate and summarize collections of records on IOCs stored in Google Drive by researchers are also lacking.
The GDIOCSpider (Google Drive IOC Spider) provides a tool for both of these use cases.Â
Hours of Operation
NOC Visiting Hours (Surf EF, Level 2)
Saturday, August 1 – Thursday, August 6: 9:00 AM – 6:00 PM
Â
NOC Presentations
Wednesday, August 5: 11:30 AM - 12:00 PM; 1:30 PM - 2:00 PM
Thursday, August 6: 10:30 AM - 11:00 AM; 1:30 PM - 2:00 PM
Â
Live Stream Hours
The NOC will be streamed live via our Twitch channel too!
Saturday, August 1 – Thursday, August 6: 9:00 AM – 6:00 PM
Adversarial AI has super-charged cybercrime, letting even low-skill actors craft convincing deepfakes and run end-to-end campaigns at machine speed—often 10× faster than traditional methods. Drawing on insights from hundreds of Unit 42 incident-response engagements, our experts will unpack the latest AI-driven tactics across the attack chain and deliver field-tested defenses you can deploy now to stay ahead of accelerated threats.
 While Windows System Calls have become a popular method for evading antivirus detection, they present considerable challenges beyond simple shellcode encryption/decryption. Unlike Linux, executing Windows System Calls often necessitates extensive setup, due to the need for specific C structures, which makes the code more complex and prone to errors compared to typical API calls. As a result, many developers turn to high-level languages like C to avoid the complexities of Assembly, particularly in malware development.
Â
SHELLSILO addresses these challenges by offering an innovative solution for System Call shellcode generation.
Cloud Offensive Breach and Risk Assessment (COBRA) is an open-source tool designed to empower users to simulate attacks within multi-cloud environments, offering a comprehensive evaluation of security controls. By automating the testing of various threat vectors including external and insider threats, lateral movement, and data exfiltration, COBRA enables organizations to gain insights into their security posture vulnerabilities. COBRA is designed to conduct simulated attacks to assess an organization's ability to detect and respond to security threats effectively.
Google Drive in recent years has become one of the most abused platforms for threat actors to conduct illegal and malicious activity. Threat actors use Google accounts to launch, store, and log malware, effectively turning Drive into a command and control center. On the side of legal and ethical activity, Google Drive remains a popular platform for security researchers to store these artifacts in summarized write-ups and spreadsheets of malicious and illegal activity observed. Much like an archaeologist looks for artifacts providing clues of the history of civilization, security researchers look for Indicators of Compromise (IOCs), which are clues to what a threat actor has done. Security engineers have worked across decades to build out tooling to analyze hard drives and network resources; however, similar advances to analyze Google Drive resources have remained underdeveloped. Along the same line, tools that aggregate and summarize collections of records on IOCs stored in Google Drive by researchers are also lacking.
The GDIOCSpider (Google Drive IOC Spider) provides a tool for both of these use cases.Â
Want to take a deeper dive into what's next? Request a 1:1 meeting with one of our leaders or technical experts.
Â
Here are a few topics our cybersecurity experts can cover, though we can tailor the conversation to any of your top security priorities:
Cloud Threat Intel, IR & Risk Managed Services on AWS
Secure AI Coding on AWS
Network Security for Frontier AI & AWS Core Perimeter
Next-Gen Identity Security: Human & Agentic Workforce on AWS
Next generation, AI-Driven observability platform on AWS
Stop by the Palo Alto Networks Lounge at Sala 118 at the Venetian Resort lobby and learn more about the latest developments across the full Palo Alto Networks platform of security products.
Cortex:Â
Autonomous Security Operations (XDR) & Real-Time Cloud Security (Cortex Cloud)
Unit 42:
Threat Intel, Incident Response, Cyber Risk Expertise, and Managed Services
NetSec:
Future of Frontier AI Network Security
Identity:
Next-Generation Identity Security
Â
Want to take a deeper dive into what's next? Request a 1:1 meeting with one of our leaders or technical experts.
Â
Â
Here are a few topics our cybersecurity experts can cover, though we can tailor the conversation to any of your top security priorities:
- Preparing for Frontier AI-powered attacks
- The Future of Threat intelligence
- Understanding the Threat Landscape in the AI Era
- The New Unit 42 Threat Intelligence Services
- Modernizing the SOC
- Securing AI Across the Enterprise
- Building Cyber Resilience
- Protecting Identity in an AI-Driven World
- Reducing Cloud Risk
- Preparing For Your Next Cyber Crisis
Â
GENERAL ACCESS & CHECK-IN
Access to the Sponsor Hospitality Suites is available only from the Casino Level of the Wynn. A Check-In Desk is located outside the villa entrance; please check in with the Ambassador to be escorted to the elevators.
The Check-In Desk will be on your right. Wynn staff will assist with escorting you to the private elevators.
Â
ENTRY REQUIREMENT
All sponsor guests must have a valid AWS re:Invent 2026 badge to be allowed access to the suite.
Â
DIRECTIONS FROM MAIN ENTRANCE (15 -20 MINUTE WALK)Â
Enter the Wynn and turn left toward the Bell Desk.
Turn right toward the Overlook Lounge, then immediately turn left through the Wynn Casino.
Continue straight until the walkway reaches Zero Bond, then turn left.
From The Venetian Lobby:
Walk straight through the Grand Colonnade and Sala 118 will be on your left, just after the Concierge desk.
Â
From The Palazzo Lobby:
Enter The Palazzo casino floor and turn right, using the right-hand walkway until you reach the Waterfall Atrium. Go past the Waterfall Atrium and through Restaurant Row until you reach The Venetian casino floor. Take the left-hand walkway and continue straight through the casino until you reach the Grand Colonnade. Go toward the Front Desk, Sala 118 will be on your right.
FROM THE VENETIAN LOBBY:
Walk straight through the Grand Colonnade and Sala 118 will be on your left, just after the Concierge desk.
Â
FROM THE PALAZZO LOBBY:
Enter The Palazzo casino floor and turn right, using the right-hand walkway until you reach the Waterfall Atrium. Go past the Waterfall Atrium and through Restaurant Row until you reach The Venetian casino floor. Take the left-hand walkway and continue straight through the casino until you reach the Grand Colonnade. Go toward the Front Desk, Sala 118 will be on your right.
From The Venetian Lobby:
Walk straight through the Grand Colonnade and Sala 118 will be on your left, just after the Concierge desk.
Â
From The Palazzo Lobby:
Enter The Palazzo casino floor and turn right, using the right-hand walkway until you reach the Waterfall Atrium. Go past the Waterfall Atrium and through Restaurant Row until you reach The Venetian casino floor. Take the left-hand walkway and continue straight through the casino until you reach the Grand Colonnade. Go toward the Front Desk, Sala 118 will be on your right.