Corelight DefeNDRs

Richard Bejtlich

Gain clear, actionable intelligence from Corelight's network defense experts. Corelight DefeNDRs translates complex cybersecurity detection challenges into concise, practical episodes designed to support faster, smarter decision-making across modern security teams.

  1. 3日前

    Episode 22 - The CTO's Case for AI: Fixing Bugs, Vibe Coding, and the Future of Dev Jobs

    In this episode, host Richard Bejtlich sits down with Steve Smoot, Chief Technical Officer at Corelight, to explore how AI is reshaping the daily work of engineers and defenders alike. Steve traces his path from early employee to CTO and explains why the flexibility of Open NDR—where a simple ten-line Zeek or Spicy script can solve a customer's edge case without a full product release—remains a core advantage. The conversation digs into practical realities of working with large language models: using AI to navigate unfamiliar code bases, the persistent danger of hallucinations (including a memorable Suricata example), and the classic programming trap where a routine's label no longer matches what the code actually does. Steve and Richard also tackle the anxiety around entry-level technical jobs, offering a grounded, economics-informed counterpoint to doom forecasts, and make the case that architecture, maintainability, and truly understanding the business problem are the durable human skills in an AI-assisted world. It's a candid look at where development is heading—and why understanding the problem still matters more than writing the code.

    Episode 22 - The CTO's Case for AI: Fixing Bugs, Vibe Coding, and the Future of Dev Jobs

  2. 8月17日

    Episode 21 - Building AI Harnesses to Unify Detection and Response

    Corelight Senior Security Engineer Jordan Hair joins Richard Bejtlich to break down how defense teams can leverage agentic AI harnesses to transform traditional security operations. By wrapping deterministic code around large language models, Hare created automated agents for alert triage, threat hunting, and detection engineering that shrink routine investigations from 45 minutes down to seconds. He emphasizes the necessity of maintaining a human-in-the-loop verifier at critical decision points, while demonstrating how this AI-assisted workflow collapses traditional SOC silos—enabling a single engineer to seamlessly manage the entire lifecycle from initial threat hunt to incident response. Learn more about Corelight's use of TAC GPT-5.5: https://www.linkedin.com/posts/openai-for-business_corelight-uses-codex-security-to-move-faster-activity-7477439412524470272-oMWe

    Episode 21 - Building AI Harnesses to Unify Detection and Response

  3. 7月30日

    Episode 20 - NDR Essentials: Why Network Data Still Defines Detection

    Richard Bejtlich joins Vince Stoffer to unpack the ideas behind his new book on network detection and response, starting with a practical distinction: NSM is a strategy, while NDR is a product. The conversation explores what teams should expect from network data, how alerts and threat hunting work together, why prevention eventually fails, and how AI can help practitioners investigate unfamiliar logs, alerts, and artifacts without replacing human judgment. Richard also reflects on the writing process, the pressure of creating technical material while doing the work, and why the future of NDR depends on trustworthy data, clear investigation paths, and analysts who know when to question the machine. Download the NDR Essentials book: https://corelight.com/cp/ndr-essentials

    Episode 20 - NDR Essentials: Why Network Data Still Defines Detection

  4. 7月16日

    Episode 19 - The Cap on Inference: Proving How Network Data Quality Drives AI Security ROI

    In this episode, host Richard Bejtlich sits down with Corelight Co-founder and Chief Strategy Officer Greg Bell to unpack groundbreaking research that quantifies exactly how data quality impacts AI-driven security automation. Moving past qualitative industry hype, Greg shares hard evidence from an empirical experiment pitting leading AI agents against real-world Capture the Flag (CTF) challenges and incident response report writing. The findings reveal a dramatic truth: basic firewall and flow logs place a hard cap on inference, throttling an LLM's capacity for deep insight. By upgrading to higher-fidelity, densely linked network data, teams can boost automated threat hunting accuracy, eliminate costly LLM hallucinations, and dramatically reduce token consumption budgets by enabling security agents to solve problems twice as fast. Read the full research paper: https://corelight.com/blog/data-quality-limits-ai-soc-performance

    Episode 19 - The Cap on Inference: Proving How Network Data Quality Drives AI Security ROI

  5. 7月2日

    Episode 18 - Live Fire Defense at Locked Shields

    In this episode, host Richard Bejtlich sits down with Corelight Senior Sales Engineers Adam Donadeo and Nico Roosenboom to unpack their firsthand experiences at Locked Shields, the world’s largest international live-fire cyber defense exercise. The conversation dives deep into the chaotic, real-world friction of defending a massive virtualized network alongside 4,000 global experts against aggressive red team waves. Adam and Nico share crucial insights on navigating vendor interoperability, the critical value of contextual log enrichment, and deploying specialized SCADA protocol packages to monitor critical infrastructure under intense pressure. For enterprise defenders, this episode highlights why a transparent, open-foundation network detection and response (NDR) strategy is essential for surviving real-world tactical friction and modern cyber threats.

    Episode 18 - Live Fire Defense at Locked Shields

  6. 6月18日

    Episode 17 - Home Labs and Tinted Windows: Why Network Visibility Starts at Your Front Door

    In this episode, host Richard Bejtlich and guest Ricky Lin explore the practical—and often personal—side of network defense: monitoring the home network. Ricky shares how he uses Corelight and Zeek to track everything from his children's YouTube habits to the constant chatter of IoT devices like Tesla vehicles and smart appliances. They delve into the "tinted windows" analogy to explain why visibility into encrypted traffic is still possible through network metadata, even when the contents are hidden. By reflecting on 30 years of networking history—transitioning from the physical complexity of T1 lines to the dominance of Ethernet and IP—the conversation reveals why building with visibility in mind is the most essential, yet often overlooked, step in modern security architecture and troubleshooting.

    Episode 17 - Home Labs and Tinted Windows: Why Network Visibility Starts at Your Front Door

  7. 6月4日

    Episode 16 - Beyond the Black Box: Solving Data Overload with Agentic Triage

    In this episode, host Richard Bejtlich sits down with Dave Getman to discuss the evolution of Corelight Investigator and the paradigm shift from delivering raw sensor data to providing agentic triage. They explore how AI can synthesize millions of log lines into concise, actionable determinations—categorizing activity as malicious or benign—while maintaining transparency by "bringing the receipts" of raw evidence. Dave explains why the security pendulum is swinging back toward network detection to counter sophisticated EDR evasion and shares a roadmap for the future of auto-containment. By moving beyond the "black box" approach, this conversation reveals how AI serves as both a defender and a teacher, accelerating time-to-value for analysts and drastically reducing median dwell times on the network.

    Episode 16 - Beyond the Black Box: Solving Data Overload with Agentic Triage

  8. 5月21日

    Episode 15 - The Right Eyes: Mythos, and the Future of Vulnerability Discovery

    The emergence of advanced large language models like Anthropic's Mythos represents an epochal shift in cybersecurity, fundamentally altering how zero-day vulnerabilities are surfaced and remediated. In this episode, host Richard Bejtlich sits down with Corelight Co-founder Greg Bell to analyze the security implications of this AI-driven bug explosion, highlighting recent AI-assisted vulnerability discoveries across infrastructure mainstays like FreeBSD and Firefox. Together, they challenge the classic open-source maxim that "with enough eyes, all bugs are shallow," arguing instead that the arrival of the right automated eyes exposes an overwhelming pool of latent software flaws. Moving beyond the immediate operational chaos, Richard and Greg discuss the economics of declining token costs, the critical survival need for an assume-breach mentality, and how Corelight’s new agentic triage capabilities help defenders automate mind-numbing log review to achieve a resilient, human-led cybersecurity equilibrium.

    Episode 15 - The Right Eyes: Mythos, and the Future of Vulnerability Discovery
すべて見る（22）

番組について

Gain clear, actionable intelligence from Corelight's network defense experts. Corelight DefeNDRs translates complex cybersecurity detection challenges into concise, practical episodes designed to support faster, smarter decision-making across modern security teams.

情報

  • クリエイター
    Richard Bejtlich
  • 配信期間
    25年 - 26年
  • エピソード
    22
  • 制限指定
    不適切な内容を含まない

その他のおすすめ