Mohamed Rajraji
VP of Information Security & Acting CISO
Dynanet Corporation
Dr. Mohamed Rajraji is a cybersecurity executive and researcher with 24 years of experience supporting U.S. federal agencies in information technology and cloud security. He is Vice President of Information Security and Compliance and acting Chief Information Security Officer at Dynanet Corporation. He co-founded Beyond Bytes, a firm that tests and hardens production AI applications and industrial control systems. Before that, he was Director of Cyber Risk Advisory at Deloitte. He holds a Ph.D. in Systems Engineering and has published peer-reviewed research on zero trust, human factors in vulnerability analysis. At Black Hat MEA, he presents GUARDIAN, his framework for closing the gap between exploit weaponization and defender response.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
Protect Now, Validate Later: Weaponizing Model Disagreement to Close the Exploit Window in Critical Infrastructure
Attackers exploit 28% of CVEs within 24 hours of disclosure, and Log4Shell was exploited within nine minutes. Defenders in critical infrastructure need more than 60 hours to coordinate security, operations, and compliance teams on a single vulnerability, and regulation extends this further: NERC CIP-007-6 allows up to 70 calendar days for patch evaluation. The exploitation window is structural, and it cannot be closed by additional staffing or faster processes.The prevailing response, building more accurate prediction models, has reached its limit. Analysis of 279,056 CVEs (NVD, 2002-2024) across six architecturally diverse models shows balanced accuracy capped between 47.5% and 69.3%, with under 1% variation across 23 years. The ceiling is informational rather than algorithmic: public vulnerability data lacks the determinants of exploitation, including network topology, asset criticality, compensating controls, and attacker economics.This session presents GUARDIAN, a framework that operationalizes uncertainty instead of pursuing further accuracy. Jensen-Shannon Divergence across the ensemble provides a calibrated risk signal (ECE 0.023 after temperature scaling; disagreement predicts accuracy degradation at ? = ?0.92 and exploitation likelihood at ? = 0.89). This signal drives four graduated isolation levels, from enhanced monitoring to complete quarantine, in 47 seconds in the testbed, without per-event human coordination. Across 6,000 simulated attacks on a 15-PLC water utility testbed using 12 MITRE ATT&CK for ICS variants, GUARDIAN delivered 56-94% risk reduction while holding availability above 72%. Multi-signal rollback reduced premature de-isolation from 18.4% to 1.6%. The session concludes with practitioner acceptance data from a 15-person advisory-mode study and a staged deployment pathway.
- 17:50
- Thu
- 03 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote