Topic starter
21/10/2026 2:46 pm
TL;DR: Cleartext control channels exposed endpoint telemetry, app telemetry, and an MCP token in the Black Hat NOC, according to Corelight. Transport security, token governance, and control-plane exposure have to be treated as one risk because a visible channel can undercut access controls.
Editorial analysis by NHI Mgmt Group, based on content published by Corelight: “Corelight in the Black Hat USA NOC: A playlist of attendee mistakes”.
Key questions
Q: Why does cleartext telemetry matter for IAM and NHI programmes?
A: Because telemetry often contains identity-bearing data such as usernames, device IDs, internal service names, and token-adjacent metadata.
Q: How can security teams tell whether a custom protocol is leaking sensitive data?
A: Inspect packet captures for readable fields, repeated identifiers, timestamps, and configuration values embedded in streams that are not obviously plaintext.
Q: What breaks when endpoint management traffic is left unencrypted?
A: Unencrypted management traffic exposes hostnames, account identifiers, software inventory, and sometimes operational context that attackers can use to map the environment.
Practitioner guidance
- Audit privileged control channels Inventory endpoint management, telemetry, and AI tool traffic that carries identifiers, tokens, or configuration data, then mark those flows as protected control-plane traffic.
- Enforce TLS on self-hosted management paths Require encryption and authentication for every self-hosted management or telemetry channel, including internal-only deployments and mobile clients on untrusted networks.
- Capture and inspect packet traces Sample representative traffic and look for embedded plaintext inside custom protocols, not only HTTP, FTP, or Telnet.
Bottom line: The core issue is not just plaintext on the wire, but privileged identity and control data travelling without confidentiality or authentication.
Glossary terms: Control Plane Disclosure, Delegated tool privilege, Cleartext Telemetry, Privileged Access Channel
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
21/10/2026 7:00 pm
Cleartext control traffic is an identity governance failure, not just a network hygiene issue. When endpoint management or telemetry channels carry host identifiers, account data, and security posture in the clear, the organisation has already lost control of the identity data it is trying to govern. That exposure undermines both confidentiality and accountability because the control plane itself is visible to anyone on the path. Practitioners should treat transport security as part of the identity boundary.
A question worth separating out:
Q: What should teams do when an exposed token can reach multiple tools?
A: Treat the token as privileged delegated access, not as a single application credential. Revoke the token, restrict network exposure, and review every downstream system the token can touch, because the real risk is the chain of actions the token enables. In identity terms, the blast radius is defined by tool reach, not token length.
👉 Read our full editorial: Black Hat network traffic exposed cleartext control channels and MCP risk
This post was modified 3 days ago by NHI Mgmt Group