Black Hat NOC findings: what cleartext traffic exposed in practice

TL;DR: Black Hat NOC monitoring found multiple cleartext control channels, including endpoint telemetry, app telemetry, and an exposed MCP token, according to Corelight, showing how self-hosted systems and AI tooling can leak sensitive data when encryption and authentication are not enforced. In identity terms, transport security failure becomes privilege exposure the moment control planes and agent tooling ride on it.

Editorial analysis by NHI Mgmt Group, based on content published by Corelight: “Corelight in the Black Hat USA NOC: A playlist of attendee mistakes”.

Key questions

Q: What breaks when endpoint management traffic is left unencrypted?

A: Unencrypted management traffic exposes hostnames, account identifiers, software inventory, and sometimes operational context that attackers can use to map the environment.

Q: Why does cleartext telemetry matter for IAM and NHI programmes?

A: Because telemetry often contains identity-bearing data such as usernames, device IDs, internal service names, and token-adjacent metadata.

Q: How can security teams tell whether a custom protocol is leaking sensitive data?

A: Inspect packet captures for readable fields, repeated identifiers, timestamps, and configuration values embedded in streams that are not obviously plaintext.

Practitioner guidance

• Audit privileged control channels Inventory endpoint management, telemetry, and AI tool traffic that carries identifiers, tokens, or configuration data, then mark those flows as protected control-plane traffic.
• Enforce TLS on self-hosted management paths Require encryption and authentication for every self-hosted management or telemetry channel, including internal-only deployments and mobile clients on untrusted networks.
• Capture and inspect packet traces Sample representative traffic and look for embedded plaintext inside custom protocols, not only HTTP, FTP, or Telnet.

Bottom line: The core issue is not just plaintext on the wire, but privileged identity and control data travelling without confidentiality or authentication.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →