Sometimes the biggest discoveries start with a simple question: What happens if I try this? At BlueHat Asia, Vaisha Bernard (@the1bernard), a two-time Microsoft Most Valuable Researcher (MVR) from Eye Security, and Cameron Vincent (@secretlyhidden1), Senior Security Researcher, MSRC shared how a seemingly small test, swapping a GET request for a PUT request, ultimately led to five critical vulnerabilities and a broader effort to help secure Microsoft's ecosystem. The talk discussed how curiosity, persistence, and a deep understanding of cloud infrastructure uncovered a pattern involving Azure Front Door, Azure Blob Storage, and overprivileged managed identities. What began as a single finding evolved into a larger variant hunting effort across Microsoft, helping teams identify and remediate similar issues at scale. A recurring theme throughout the talk was the importance of challenging assumptions. Even when a test seems unlikely to succeed, that one unexpected result can reveal something much larger. The presentation also reinforced a fundamental security principle: apply least privilege wherever possible and avoid granting managed identities more access than they truly need. Key takeaways for researchers: • Follow the breadcrumbs. Small discoveries can uncover much larger security issues. • Look beyond the initial vulnerability. Understanding how systems are architected can reveal additional attack paths and impact. • Pay attention to patterns. Multiple findings can point to broader systemic risks that warrant deeper investigation. • The most impactful research doesn't just find a bug. It helps drive security improvements across an entire ecosystem.

BlueHat Asia Call for Papers deadline extended! You now have until September 14 to submit your talk for BlueHat Asia in Bengaluru, India on November 5–6! Share your insights on security research, emerging threats, and more. Don’t miss your chance to be part of the community. Submit now: aka.ms/bhasia25cfp #BlueHatAsia #SecurityResearch #CFP

Don’t miss your chance to be part of the BlueHat Asia community in Bengaluru this November! Submit your talk by September 5 to share your insights on emerging security threats, novel research findings, and more. ⬇️Submit your paper by September 5 ⬇️ aka.ms/bhasia25cfp #BlueHatAsia

The Call for Papers is now open for BlueHat Asia in Bengaluru, India, taking place on November 5 - 6, 2025! This is your chance to showcase your thought leadership in vulnerability and mitigation, emerging security threats and techniques, novel research findings, calls-to-action for the security community, and more. ⬇️Submit your paper by September 5 ⬇️ aka.ms/bhasia25cfp Here are some suggested topics to inspire your submission (but don’t feel limited by them—we’re excited to see what you bring to the community!): ▸AI, Machine Learning, & Data Science ▸Applied Cryptography ▸Cybersecurity Careers ▸Cybersecurity Policy ▸Data Forensics & Incident Response ▸Detection Techniques at Scale ▸Exploit Development ▸Human Factors ▸IoT/OT & Critical Infrastructure Security ▸Physical Security ▸Quantum Security ▸Red Team/Blue Team Lessons Learned ▸Reverse Engineering ▸Virtualization and Container Security Don’t miss this opportunity to be part of BlueHat Asia. #BlueHatAsia

Save the Date: BlueHat Asia We’re bringing BlueHat back to India, this time in Bengaluru on November 5 - 6, 2025. Stay tuned for more details. We hope to see you there! #BlueHatAsia

Missed BlueHat India 2025? Catch up now! Talks from Microsoft & global security experts are live on the @msftsecresponse YouTube channel: youtube.com/@msftsecresponse From AI threats to ransomware ops, mobile red teaming and more, don’t miss these deep-dive sessions. #BlueHatIndia

Thank you to everyone who joined us this week. BlueHat is more than just a conference, it’s a community. One where the security community from inside and outside Microsoft come together as peers to share, challenge, and learn from one another. From deep technical talks to hallway debates, this year’s BlueHat India showed how collaboration fuels progress in cybersecurity. Together, we're helping build a safer, more secure world for everyone. Special shoutout to the BlueHat organizers and volunteers. This event would not be possible without your energy, dedication, and behind-the-scenes magic. Until next year. 💙 #BlueHatIndia

We kicked off Day 2 of BlueHat India with opening remarks from Charu Srinivasan, CVP of Engineering at Microsoft, who explored the rise of Agentic AI: autonomous agents that will soon play a role in nearly every system we build. Her message was clear: defenders must secure these agents and use them to strengthen security itself. Ram Shankar Siva Kumar (@ram_ssk), Data Cowboy & Head of Microsoft’s AI Red Team, delivered a powerful keynote unpacking lessons from red teaming over 100 generative AI systems. From model manipulation to psycho-social harms, Ram showed how attackers are evolving and why security must evolve with them. The rest of the day featured powerful sessions from across the community: • Shriya Maniktala introduced Agentic AI red teaming, where LLM-powered adversaries adapt in real-time using live feedback and tools like AETHR • Manish Gupta & Yash Bharadwaj showed how adversaries are using serverless platforms to build stealthy phishing kits that slip past traditional defenses • Omkar Joshi & Pallavi Deshmukh revealed just how easily LLM safety guardrails can be bypassed, calling for adversarial testing and layered defenses • Rituraj Jodha discussed how graph-based detection and Graph Neural Networks can surface malicious OAuth apps that hide in plain sight • Sagar Bhure showed how deepfake detection systems can be defeated with subtle tweaks and adversarial image prompts • Ashish Dhone (@ashketchum_16) shared lessons from earning over $50K in blind XSS bounties, highlighting overlooked surfaces like feedback forms and custom dashboards To every attendee, speaker, and partner: thank you. Your dedication to learning together, sharing openly, and supporting one another is what makes BlueHat special. #BlueHatIndia

Tom Gallagher (@secbughunter), VP of Engineering at MSRC, opened BlueHat India with a question: “Anyone here a threat actor?” 👀 He went on to highlight the recent Microsoft Zero Day Quest, which saw over 100 researchers qualify. Today, we're proud to welcome three standout researchers from India—Niraj, Ashish, and Anto. And we’re just getting started. Submit your vulnerabilities to MSRC and join us in protecting customers, Microsoft, and the global community. #BlueHatIndia