> ## Content Index
> Fetch the complete content index at: https://www.cybrsecmedia.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Beyond the Black Box: Demanding Inspectability for Cyber Visibility
- URL: https://www.cybrsecmedia.com/beyond-the-black-box-demanding-inspectability-for-cyber-visibility/
- Published: 2026-10-19T23:39:43.000Z
- Updated: 2026-10-20T12:55:13.000Z
- Description: Attackers are exploiting blind spots in firewalls, VPNs and critical infrastructure. Blake Gilson explains how security teams can fight back by demanding greater inspectability, visibility and verification. (includes video and infographic)
- Author: Bill Brenner
- Tags: Firewall and VPN security visibility, CYBR.SEC.CON. 2026

Cybersecurity teams have spent two decades learning how to see inside the systems they defend. They can track suspicious processes, reconstruct attacks, investigate endpoint activity and detect malicious behavior before it spreads. Yet some of the most critical devices protecting enterprise networks remain black boxes, with defenders unable to determine what's happening beneath the surface.

Firewalls, VPN concentrators, load balancers and industrial controllers sit at the heart of modern infrastructure. They're supposed to keep attackers out. But when attackers compromise those devices, security teams often lack the telemetry, forensic access and visibility needed to recognize an intrusion, much less investigate it.

That's the problem Blake Gilson wants the cybersecurity industry to confront. In his presentation, *Beyond the Black Box: Demanding Inspectability for Cyber Visibility*, at CYBR.SEC.CON 2026, Gilson argued that the next major improvement in cybersecurity defense won't come from another vulnerability scoring system, faster patching or additional endpoint protection. It will come from demanding greater transparency into the devices organizations have long been forced to trust without verification.

**Watch the full presentation:**

The stakes are growing as adversaries increasingly target the very infrastructure designed to protect enterprise environments.

## Attackers are going where defenders can't see

Gilson traced the evolution of modern security operations from the days when antivirus alerts and firewall logs offered fragmented evidence of malicious activity. Technologies such as Sysmon, endpoint detection and response (EDR), centralized logging and behavioral analytics fundamentally changed that equation.

Security teams gained the ability to reconstruct process execution, track authentication activity, investigate registry modifications and identify suspicious behavior before an attack reached its final stages.

Those advances made endpoint compromise harder to hide. But many of the devices at the network edge never experienced an equivalent visibility revolution. While SOC analysts can investigate unusual processes on a Windows endpoint, they often lack comparable access to the underlying operating systems, firmware and runtime behavior of a firewall or VPN appliance.

Gilson argued that attackers are exploiting that asymmetry.

Rather than depend on phishing or malicious attachments, adversaries can exploit vulnerabilities in internet-facing infrastructure, sometimes without any user interaction. Once inside, they may operate in environments where conventional endpoint monitoring tools cannot follow.

The expansion of software-defined networking, SASE and cloud-first connectivity complicates matters further. These architectures deliver real operational and financial benefits, but they also expand the internet-facing infrastructure that security teams must defend.

Gilson wasn't advocating a return to expensive private networking architectures. He was arguing that the security industry's visibility capabilities must evolve alongside its infrastructure.

[Subscribe to the CYBR.SEC.Media newsletter](#/portal/signup/free)

## Patching alone won't save security teams

One of Gilson's more provocative arguments was that vulnerability management, however important, cannot serve as the primary defense against attacks on critical infrastructure.

His concern is partly driven by artificial intelligence. AI-assisted vulnerability research could allow attackers to discover exploitable weaknesses faster than vendors and defenders can address them. Gilson was less concerned with futuristic autonomous attack swarms than with the immediate possibility that skilled adversaries could use AI to accelerate conventional vulnerability discovery.

That creates a fundamental timing problem. Attackers may exploit a previously unknown vulnerability long before a vendor releases a patch. Even when researchers discover suspicious activity, investigation and disclosure processes can take time.

Gilson also raised a hypothetical scenario in which national security investigations and coordinated disclosure considerations delay public remediation. He explicitly acknowledged that he could not establish how frequently such circumstances occur.

His broader point remains: Organizations cannot build their defenses around the assumption that a patch will exist before an attacker arrives. Instead, security teams need the ability to detect malicious behavior inside infrastructure devices even when the underlying vulnerability remains unknown.

That's precisely the capability EDR brought to traditional endpoints. Gilson wants to extend that principle to network appliances and embedded systems.

## Five changes security teams should make now

![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/2026/10/2f7032c5-4cbe-4473-91ed-b7b770d487e7.png)

Click to enlarge

Gilson's guidance points toward a significant change in how security leaders evaluate, purchase and monitor critical infrastructure.

**1\. Make inspectability a procurement requirement.**

Security teams should stop accepting vendor assurances as substitutes for evidence. Requests for proposals, supplier reviews and contract discussions should demand meaningful visibility into device operations, including security-relevant events, runtime behavior and configuration changes.

Gilson stressed that this doesn't require vendors to disclose proprietary source code. Customers need enough information to verify that systems are behaving as intended.

**2\. Establish minimum observability standards for critical devices.**

Firewalls, VPNs, controllers and other infrastructure should provide telemetry that helps defenders establish normal operating conditions and identify deviations.

That means going beyond logs showing the traffic a firewall permits or blocks. Security teams also need evidence about the health, integrity and behavior of the firewall itself.

**3\. Require device integrity verification.**

Gilson advocated stronger use of cryptographic attestation, firmware validation and secure boot to help organizations determine whether critical systems have been modified or compromised.

These capabilities should become standard expectations for infrastructure security, rather than optional features or specialized research activities.

**4\. Bring firmware and embedded-device analysis into the SOC.**

Security operations teams need to expand their expertise beyond Windows processes and conventional endpoint telemetry.

Gilson envisioned capabilities resembling EDR for network appliances, potentially supported by third-party monitoring technologies and AI-assisted analysis. The goal is to identify suspicious behavior without depending entirely on the device manufacturer to investigate an incident.

That will require new training, detection engineering and integration with existing security platforms.

**5\. Demand software transparency and evidence before incidents happen.**

Software bills of materials (SBOMs), component inventories, dependency information and vendor-provided security evidence should be accessible when defenders need them.

Gilson wasn't suggesting that organizations simply dump every SBOM into an already overloaded configuration management database. The priority is ensuring that the information exists, remains accessible and can support investigations when something goes wrong.

Together, these changes would move infrastructure security away from a model built largely on vendor trust and toward one grounded in independent verification.

## Vendors need to stop treating visibility as a premium feature

Gilson connected his recommendations to CISA's 2024 Secure by Design Pledge, particularly its commitment to providing customers with evidence of intrusions.

That principle calls for security logging that supports detection and investigation, including visibility into identity, network and configuration activity.

Gilson questioned why such expectations have not become equally prominent for network appliances and operational technology.

Security logs, he argued, should be available by default, not locked behind premium licensing or inaccessible management interfaces.

He also described conversations with manufacturers exploring better diagnostic capabilities, including onboard recording systems that could preserve device activity for later forensic analysis.

But Gilson wants to go further.

A device that records its own compromise but requires shipment back to the manufacturer for examination doesn't solve the fundamental problem. Defenders need practical ways to retrieve and analyze that evidence themselves.

The procurement process offers one potential source of leverage. If customers consistently demand inspectability, manufacturers have an incentive to make it a competitive differentiator.

## The next SOC must see beyond the endpoint

Gilson acknowledged that expanding infrastructure monitoring creates another challenge for already overwhelmed security operations teams.

Analysts are struggling to process the telemetry they receive today. Adding detailed firmware, appliance and embedded-system data could increase that burden considerably.

He suggested AI-assisted security operations may eventually help teams correlate the additional evidence and identify meaningful deviations without overwhelming analysts.

But AI isn't the foundation of his argument. Visibility is.

The industry's earlier investments in endpoint telemetry succeeded because they gave defenders the ability to investigate what systems were actually doing, rather than simply trusting that installed security products would prevent compromise.

Gilson believes that same approach must now extend to the infrastructure on which modern networks depend.

For CISOs and security leaders, the immediate implication is practical: Ask what evidence your team could collect if a critical firewall, VPN appliance or network controller were compromised tonight. Could analysts examine running processes, validate firmware integrity, identify unexpected changes and reconstruct the attack without waiting for the manufacturer?

If the answer is no, Gilson's warning applies.

The security industry has spent decades demanding visibility into the systems it protects. It's time to demand the same visibility from the systems doing the protecting.

[![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/2026/10/2027-Events-Banner-44.png)](https://www.cybrsecmedia.com/conference/)