Agentic AI for cyber defenders: What security teams built at Black Hat USA 2026

Agentic AI armed attackers first, but it also put real building power in defenders’ hands. Here’s what security practitioners built in two days at Black Hat USA 2026, and how the CyberAgents Exchange keeps that work compounding long after the event.Key takeawaysBuilding defensive cybersecurity tooling no longer requires a developer. Agentic tooling drove the cost of finding and exploiting a vulnerability down to 1990s levels; it also removed the engineering barrier that kept defenders from building the automation they’ve always wanted. The unglamorous work won the room: triage, reconciliation, toil. Given two days and a requirement to publish, practitioners at SWARM developed agents for prioritization, cross-tool reconciliation, and the unglamorous toil they recognize from their own environments. All SWARM builds live on the CyberAgents Exchange, source repos attached. Every component built at SWARM is published open source with its source repository attached, so the next team facing the same problem starts from working code instead of a blank editor.Another security team already built the AI agent you needYou may not realize it, but somewhere out in the ether, there’s a security …