At Black Hat USA 2026, Tenable hosted SWARM, a 48-hour hackathon where nearly 100 security practitioners built open-source AI agents to automate defensive security work. Three winning teams emerged: Chokepoint Finder (1st place) collapses thousands of findings into a handful of prioritized remediation actions; ThreatCorraling (2nd place) correlates static and dynamic scanner results to determine if code flaws are reachable in production; and Evidence-Backed Vulnerability Investigator (3rd place) generates auditor-ready evidence that a finding was already mitigated. All builds are published open source on Tenable's CyberAgents Exchange, a free vendor-agnostic registry for AI agents, skills, MCP servers, and playbooks aimed at giving defenders the same distribution advantages attackers have long enjoyed.
Table of contents
Key takeawaysAnother security team already built the AI agent you needAgentic AI doesn’t just arm attackersWe gave defenders a mission and two days to buildThe agentic AI builds the judges put on the podiumSWARM was two days, the CyberAgents Exchange lives onYour turn to build an AI agentQuestions this post answers
What did the first-place team build at the Black Hat USA 2026 SWARM hackathon?
The first-place team (Team Vauban) built Chokepoint Finder, an MIT-licensed agentic tool that ranks fixes rather than findings. It groups findings by the single action that resolves them, then computes the shortest ordered list that mitigates the most weighted risk across eight stages with a human decision in the middle. In a demo estate with 3,734 synthetic findings across 783 assets, it produced seven concrete remediation actions. Security teams triaging thousands of findings can track tools like this on daily.dev.
What is the Tenable CyberAgents Exchange and how does it work?
The CyberAgents Exchange is an open-source, vendor-agnostic registry for cybersecurity AI agents, skills, MCP servers, and multi-agent playbooks. Every component links to its source repository with no bundled binaries, so users can inspect provenance, see who built it, and whether it has been reviewed. It is free to list and use. SentinelOne and Recorded Future joined as founding members. Developers building or evaluating defensive AI tooling can follow the CyberAgents Exchange ecosystem on daily.dev.
How does ThreatCorraling correlate static and dynamic scanner results to find reachable vulnerabilities?
ThreatCorraling correlates Checkmarx static analysis results against Tenable Web Application Scanning findings for the same scoped assets, letting teams identify which flagged code flaws are actually exposed in the running application. It then maps findings to SOC 2 and ISO 27001 controls and generates stack-specific remediation and regression-testing patterns. It ships as both a local app and an MCP server compatible with clients like Claude Code. Teams choosing between scanner correlation approaches can follow vulnerability management tooling discussions on daily.dev.