DEF CON 33 - Dark Capabilities - When Tech Companies Become Threat Actors - Greg Conti, Tom Cross
Source: YouTube · DEFCONConference · published Oct 10, 2025 · 38:35
Tom Cross and Greg Kiy argue that corporations possess capabilities rivaling nation-states that can be weaponized during conflicts. They emphasize focusing on a system's actual capabilities rather than its stated purpose.
Key Takeaways:
• Major tech companies have market caps rivaling nations' stock exchanges, making them powerful, independent actors in cyberspace.
• During conflicts, private entities engage in "effects-based operations," from exiting markets to providing infrastructure or sabotaging their own software.
• Consumer tech like smart lightbulbs and robot vacuums possesses "dark capabilities" such as surveillance and physical mapping that can be exploited.
• Companies must threat model against misuse by executives or governments, as wartime pressures can make "unthinkable" actions seem necessary.
• Emerging technologies like AI and robotics require new government oversight frameworks beyond traditional critical infrastructure definitions.
The speakers urge organizations and users to evaluate technology based on what it can actually do to prevent potential abuse.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
As you have hopefully now are aware, I am Tom Cross. Uh this is Greg Kiy and this is very capability for company. Um so I'm the head of threat research at Get Real Security. Um and uh Greg is a former West Point professor uh and was also an Armenian cultural officer. Uh and um the uh we both principles at Gideon um and we teach uh classes here at Defcon training which I'm told you can still sign up for if you want to. So we're teaching um information operations as smart and Sunday and then on Monday and Tuesday we're teaching you adversarial thinking which is like sort of a deep dive on how to find vulnerabilities all kinds of things. So um moving forward to the next slide cyber science fiction gives us this understanding of it's like these this vision of evil mega corporations which have …