Top companies to visit at Black Hat USA 2026

Black Hat USA 2026 returns to Mandalay Bay with a re-engineered six-day program designed to spark innovation, challenge assumptions, and unite the global security community.

The event opens with four days of immersive, expert-led Trainings (August 1-4), continues with Summit Day on Tuesday, August 4, and closes with a two-day main conference featuring Briefings, open-source tool demos in Arsenal, a Business Hall, and opportunities to learn and connect.

From cutting-edge innovators to industry veterans launching new offerings to rising stars shaking up the status quo, these exhibitors are bringing something special to the floor this year. Make time in your schedule to stop by, because your next big opportunity might be waiting.

BlackCloak

Booth #5926 | Book a demo

BlackCloak provides Digital Executive Protection, safeguarding the personal digital lives of executives, board members, high-access employees, and their families. Working alongside corporate cybersecurity and security teams, the company secures executives’ personal devices, home networks, and digital footprints in the spaces that fall outside the corporate perimeter, where privacy laws and information exposure leave traditional enterprise tools unable to reach. Its platform, used by Fortune 500 companies, combines purpose-built technology with concierge-level personalized service and U.S.-based incident response.

Stairwell

Booth #5006

Stairwell is a cybersecurity company building the future of threat intelligence. It empowers security teams with continuous, private malware analysis and threat detection, helping enterprises gather, store, and analyze files at scale to uncover hidden threats and outsmart attackers. Private by design and continuous by default, the platform combines automated malware analysis, AI triage, and variant discovery so teams can spend less time chasing the threat of the day and more time focused on their mission.

Novee

Booth #5323 | Book a demo

Novee is an AI-powered penetration testing platform that continuously simulates real-world cyberattacks to help organizations find and fix vulnerabilities before hackers do. Unlike traditional annual pentests or generic scanners, Novee deploys a hive-mind of AI agents trained on offensive security tradecraft to map environments, uncover exploit chains, and identify business logic flaws. It can begin with zero knowledge, mirroring how real attackers operate, then expand into deeper coverage. For every issue discovered, Novee validates the finding and delivers personalized, step-by-step remediation guidance.

Stellar Cyber

Booth #5542 | Book a demo

Stellar Cyber delivers the platform security teams have been waiting for. Legacy SIEMs only collected logs and buried analysts in noise. Stellar Cyber does more, combining SIEM with built-in NDR+, ITDR, TIP, UEBA, and Multi-Layer AI. The result is a SecOps platform that unifies detection, investigation, triage, and response from day one. Because it’s open and unifying, Stellar Cyber works with everything you already run, including any EDR, so you maximize existing investments while cutting complexity.

Teleport

Booth #5114

Teleport is an infrastructure identity company that provides a unified platform for securing access across classic and AI infrastructure. Its platform consolidates identity for humans, machines, workloads, and AI agents using cryptographic identity and short-lived certificates, eliminating static credentials and standing privileges. Key capabilities include zero trust access, identity governance, privileged access management, machine and workload identity, and security for agentic AI and Model Context Protocol tooling.

Crash Override

Booth #6205

Crash Override embeds context into software at build time and tracks it into production, so teams can automate the hard stuff. Development teams run dozens of tools, but none of them share context. The build system is still a black box and the artifacts carry no information about what they are, where they came from, or what they contain. You can’t coordinate what you can’t connect. Their product sits inside the build, inspects every artifact, embed cryptographically signed provenance, and tracks it into production. No agents. No platform migration. Five lines of YAML.

Verno Labs

Booth #6103

Verno Labs is the red team for AI agents. Custom offensive LLMs, purpose-built for adversarial work, operating against a proprietary taxonomy of 150+ original attack classes built bottom-up from real engagements. They attack production AI agents in black box, across APIs, voice, messaging, and email surfaces. They chain multi-step exploits, evade runtime defences, and surface the agentic-specific classes most testing tools never reach: excessive agency, multi-agent collusion, MCP abuse, persistent-memory implants. No privileged access. No agent code change.

ControlMonkey

Booth #6013

ControlMonkey provides Cloud Disaster Recovery for infrastructure and SaaS configuration, helping teams protect, version, and recover the critical configuration behind cloud environments, identity systems, networking, security, monitoring, and third-party platforms. ControlMonkey focuses on restoring how the environment was configured: cloud resources, DNS, IAM, routing rules, security groups, Okta/Entra ID, Datadog, Cloudflare, and more.

Row Zero

Booth #6116

Row Zero is a secure, cloud spreadsheet engineered for high-performance self-serve analytics while ensuring robust data governance. By operating entirely in the cloud, it mitigates risks associated with local downloads by keeping sensitive data off employee laptops. The platform offers direct, secure connections to data warehouses, enforcing OIDC/SAML 2.0 SSO, network isolation, and strict, granular control over data exporting and clipboard usage. It maintains high compliance standards as a SOC 2 Type II certified and HIPAA-compliant solution.

Mars Security

Booth #6002

Mars is an automated threat hunting and detection engineering platform that continuously converts threat intelligence into production-ready detections across your existing security stack. The platform connects directly to your SIEM, EDR, and cloud telemetry via API. No data ingestion. No tool replacement. No additional headcount. The team behind Mars spent years designing the attacks now targeting enterprise networks.