Corelight DefeNDRs

Episodes

• 
  Episode 26 - Zeek at 30: The Measure-First Mindset That Shaped Zeek (Part 2) 22.10.2026 22m

  Richard Bejtlich sits down with Vern Paxson to celebrate Zeek's 30th anniversary and explore the discipline of measurement that underpins modern network visibility. They discuss the tension between configuration and data mindsets, why there is no such thing as a typical network, and how open source and community funding helped Zeek become a durable research and security resource. Vern reflects on the empirical discipline he brings from physics, the impact of AI tools on Zeek development, and practical guidance for researchers and practitioners navigating rapid change. The conversation also touches on NSF support, the evolution of Zeek as a project, and what motivates long-term work in instrumentation and telemetry.
• 
  Episode 25 - Zeek at 30: Vern Paxson on Origins and Enduring Logs (Part 1) 08.10.2026 21m

  Richard Bejtlich sits down with Vern Paxson, Corelight co-founder and Chief Scientist, to explore Zeek's 30-year journey from a Berkeley Lab research project to a data-rich backbone of modern NDR. They unpack how Zeek evolved from early TCP health measurements into a flexible, scriptable network analysis platform, the value of neutral, long-term logs over real-time alerts, comparisons to intrusion-detection approaches like Snort, and the challenges and opportunities of visibility in enterprise gear. The conversation also touches on the origins of libpcap, tcpdump, and BPF, the role of academia in building enduring tooling, and what this history means for defenders aiming to understand and defend today’s networks.
• 
  Episode 24 - Speaking Security So Leaders, Boards, and Buyers Actually Listen 24.09.2026 24m

  In this episode, Richard Bejtlich talks with Julie Parrish, CMO at Corelight, about how security professionals can communicate more effectively with CISOs, boards, and buyers who each measure success differently. Julie explains why practitioners should frame requests in terms of risk instead of raw technology, why CISOs need to connect security investments to reputation, compliance, and business continuity, and why marketers lose credibility when they lean on buzzwords, analogies, or FUD instead of clarity and education. The conversation also explores persona-based messaging, the value of expert-led content, and how AI-driven search is changing the way security companies think about discoverability and trust. For anyone trying to influence decisions in security, this episode is a practical look at how better communication leads to better outcomes.
• 
  Episode 23 - Inside Zeek 9: Modernizing Open Source Network Monitoring & Agentic Security Scanning 10.09.2026 21m

  In this episode, host Richard Bejtlich sits down with Christian Kreibich, Zeek's technical lead, to unpack the upcoming Zeek 9 release and what it means for practitioners. Christian explains how the project structures its three-releases-a-year cadence and how the team has spent recent cycles modernizing Zeek—including the shift to ZeroMQ for cluster messaging and new systemd-based cluster orchestration. A major thread is security: alongside longstanding fuzzing and static analysis work, the team is now navigating a wave of agentic, LLM-driven security scanning, with preliminary internal efforts surfacing 50–70 high-severity findings and parallel initiatives from OpenAI/Trail of Bits and Anthropic. The conversation also covers the migration from BinPAC to Spicy for safer protocol parsing, why the team favors Spicy over Rust for writing analyzers (while eyeing Rust elsewhere), the ongoing Microsoft Defender for Endpoint collaboration bringing Zeek to Windows, and a clear roadmap toward cloud-native packet ingestion, better tunnel handling, and a simpler packaging ecosystem. It's a grounded look at how a mature open source project stays modern without breaking what works.
• 
  Episode 22 - The CTO's Case for AI: Fixing Bugs, Vibe Coding, and the Future of Dev Jobs 27.08.2026 15m

  In this episode, host Richard Bejtlich sits down with Steve Smoot, Chief Technical Officer at Corelight, to explore how AI is reshaping the daily work of engineers and defenders alike. Steve traces his path from early employee to CTO and explains why the flexibility of Open NDR—where a simple ten-line Zeek or Spicy script can solve a customer's edge case without a full product release—remains a core advantage. The conversation digs into practical realities of working with large language models: using AI to navigate unfamiliar code bases, the persistent danger of hallucinations (including a memorable Suricata example), and the classic programming trap where a routine's label no longer matches what the code actually does. Steve and Richard also tackle the anxiety around entry-level technical jobs, offering a grounded, economics-informed counterpoint to doom forecasts, and make the case that architecture, maintainability, and truly understanding the business problem are the durable human skills in an AI-assisted world. It's a candid look at where development is heading—and why understanding the problem still matters more than writing the code.
• 
  Episode 21 - Building AI Harnesses to Unify Detection and Response 17.08.2026 15m

  Corelight Senior Security Engineer Jordan Hair joins Richard Bejtlich to break down how defense teams can leverage agentic AI harnesses to transform traditional security operations. By wrapping deterministic code around large language models, Hare created automated agents for alert triage, threat hunting, and detection engineering that shrink routine investigations from 45 minutes down to seconds. He emphasizes the necessity of maintaining a human-in-the-loop verifier at critical decision points, while demonstrating how this AI-assisted workflow collapses traditional SOC silos—enabling a single engineer to seamlessly manage the entire lifecycle from initial threat hunt to incident response. Learn more about Corelight's use of TAC GPT-5.5: https://www.linkedin.com/posts/openai-for-business_corelight-uses-codex-security-to-move-faster-activity-7477439412524470272-oMWe
• 
  Episode 20 - NDR Essentials: Why Network Data Still Defines Detection 30.07.2026 18m

  Richard Bejtlich joins Vince Stoffer to unpack the ideas behind his new book on network detection and response, starting with a practical distinction: NSM is a strategy, while NDR is a product. The conversation explores what teams should expect from network data, how alerts and threat hunting work together, why prevention eventually fails, and how AI can help practitioners investigate unfamiliar logs, alerts, and artifacts without replacing human judgment. Richard also reflects on the writing process, the pressure of creating technical material while doing the work, and why the future of NDR depends on trustworthy data, clear investigation paths, and analysts who know when to question the machine. Download the NDR Essentials book: https://corelight.com/cp/ndr-essentials
• 
  Episode 19 - The Cap on Inference: Proving How Network Data Quality Drives AI Security ROI 16.07.2026 19m

  In this episode, host Richard Bejtlich sits down with Corelight Co-founder and Chief Strategy Officer Greg Bell to unpack groundbreaking research that quantifies exactly how data quality impacts AI-driven security automation. Moving past qualitative industry hype, Greg shares hard evidence from an empirical experiment pitting leading AI agents against real-world Capture the Flag (CTF) challenges and incident response report writing. The findings reveal a dramatic truth: basic firewall and flow logs place a hard cap on inference, throttling an LLM's capacity for deep insight. By upgrading to higher-fidelity, densely linked network data, teams can boost automated threat hunting accuracy, eliminate costly LLM hallucinations, and dramatically reduce token consumption budgets by enabling security agents to solve problems twice as fast. Read the full research paper: https://corelight.com/blog/data-quality-limits-ai-soc-performance
• 
  Episode 18 - Live Fire Defense at Locked Shields 02.07.2026 16m

  In this episode, host Richard Bejtlich sits down with Corelight Senior Sales Engineers Adam Donadeo and Nico Roosenboom to unpack their firsthand experiences at Locked Shields, the world’s largest international live-fire cyber defense exercise. The conversation dives deep into the chaotic, real-world friction of defending a massive virtualized network alongside 4,000 global experts against aggressive red team waves. Adam and Nico share crucial insights on navigating vendor interoperability, the critical value of contextual log enrichment, and deploying specialized SCADA protocol packages to monitor critical infrastructure under intense pressure. For enterprise defenders, this episode highlights why a transparent, open-foundation network detection and response (NDR) strategy is essential for surviving real-world tactical friction and modern cyber threats.
• 
  Episode 17 - Home Labs and Tinted Windows: Why Network Visibility Starts at Your Front Door 18.06.2026 15m

  In this episode, host Richard Bejtlich and guest Ricky Lin explore the practical—and often personal—side of network defense: monitoring the home network. Ricky shares how he uses Corelight and Zeek to track everything from his children's YouTube habits to the constant chatter of IoT devices like Tesla vehicles and smart appliances. They delve into the "tinted windows" analogy to explain why visibility into encrypted traffic is still possible through network metadata, even when the contents are hidden. By reflecting on 30 years of networking history—transitioning from the physical complexity of T1 lines to the dominance of Ethernet and IP—the conversation reveals why building with visibility in mind is the most essential, yet often overlooked, step in modern security architecture and troubleshooting.
• 
  Episode 16 - Beyond the Black Box: Solving Data Overload with Agentic Triage 04.06.2026 16m

  In this episode, host Richard Bejtlich sits down with Dave Getman to discuss the evolution of Corelight Investigator and the paradigm shift from delivering raw sensor data to providing agentic triage. They explore how AI can synthesize millions of log lines into concise, actionable determinations—categorizing activity as malicious or benign—while maintaining transparency by "bringing the receipts" of raw evidence. Dave explains why the security pendulum is swinging back toward network detection to counter sophisticated EDR evasion and shares a roadmap for the future of auto-containment. By moving beyond the "black box" approach, this conversation reveals how AI serves as both a defender and a teacher, accelerating time-to-value for analysts and drastically reducing median dwell times on the network.
• 
  Episode 15 - The Right Eyes: Mythos, and the Future of Vulnerability Discovery 21.05.2026 21m

  The emergence of advanced large language models like Anthropic's Mythos represents an epochal shift in cybersecurity, fundamentally altering how zero-day vulnerabilities are surfaced and remediated. In this episode, host Richard Bejtlich sits down with Corelight Co-founder Greg Bell to analyze the security implications of this AI-driven bug explosion, highlighting recent AI-assisted vulnerability discoveries across infrastructure mainstays like FreeBSD and Firefox. Together, they challenge the classic open-source maxim that "with enough eyes, all bugs are shallow," arguing instead that the arrival of the right automated eyes exposes an overwhelming pool of latent software flaws. Moving beyond the immediate operational chaos, Richard and Greg discuss the economics of declining token costs, the critical survival need for an assume-breach mentality, and how Corelight’s new agentic triage capabilities help defenders automate mind-numbing log review to achieve a resilient, human-led cybersecurity equilibrium.
• 
  Episode 14 - Harvest Now, Decrypt Later: The Shift to Post-Quantum Cryptography 07.05.2026 16m

  The emergence of quantum computing has introduced a definitive expiration date for classical encryption, fueling a "harvest now, decrypt later" strategy among sophisticated nation-state actors. In this episode, Vince Stoffer joins Richard Bejtlich to demystify Post-Quantum Cryptography (PQC) and explain why organizations must move beyond a "set it and forget it" mentality regarding their encryption standards. They explore the critical role of Automated Cryptography Discovery and Inventory (ACDI) and how Network Detection and Response (NDR) provides a unique, passive vantage point to identify vulnerable cipher suites and track the real-time negotiation of quantum-resistant algorithms. By maintaining a clear picture of the cryptographic assets on the wire, defenders can proactively secure sensitive data against future decryption and meet the rising demands of modern regulatory standards.
• 
  Episode 13 - Battle-Hardened Research: Navigating the Intersection of AI and Open Source 23.04.2026 15m

  Richard Bejtlich sits down with Ali Islam to pull back the curtain on how a security research lab functions within a modern security company. Moving beyond the "ivory tower" of academia, Ali explains why researchers must be battle-hardened by real-world threat actor techniques to remain effective in the field. The conversation dives into Corelight’s unique commitment to the open source community through the direct funding of Zeek and Suricata developers, ensuring that community-driven tools can scale to meet massive enterprise traffic demands. Finally, they explore the accelerating role of artificial intelligence in cybersecurity, weighing its ability to reduce analyst fatigue against the growing sophistication of AI-powered phishing and malware development.
• 
  Episode 12 - The Agentic SOC: Upleveling Analysts with AI Knowledge Multipliers 09.04.2026 17m

  Richard Bejtlich sits down with Stan Kiefer, Corelight’s Senior Manager for Data Science, to discuss how AI serves as a vital "abstraction layer" and "knowledge multiplier" for security analysts. Stan explains that while AI can synthesize complex information, it remains untrustworthy without high-fidelity network data at its center to provide verifiable evidence. The episode explores the shift toward an "agentic ecosystem" and a tiered architecture where a central orchestrator manages specialized sub-agents to accelerate detection and investigation. Looking toward the future, Stan envisions a hybrid SOC environment where adaptive systems learn an analyst's specific workflows to automate routine tasks, acting as a professional companion that can cut the time needed to reach competency in half.
• 
  Episode 11 - The AI Maturity Journey: Data, Agents, and the Shift from Craft to Art 26.03.2026 17m

  Richard Bejtlich talks with Vijit Nair, VP of Product at Corelight, about the evolving "AI Maturity Journey" for modern security teams. Vijit outlines a three-level spectrum of AI adoption, moving from basic human-driven assistance to automated swarms of agents, and eventually toward fully autonomous systems. They discuss why high-quality, unopinionated data remains the essential foundation for building trust in AI and how technologies like the Model Context Protocol (MCP) are turning human language into the primary interface for tool integration. The conversation explores the partnership between Corelight and CrowdStrike Charlotte AI as a real-world example of this connected ecosystem. Finally, Vijit and Richard reflect on how AI is "eating the craft" of security—automating away the mind-numbing manual tasks of a SOC—to allow analysts to focus on the "art" of judgment, creativity, and strategic defense.
• 
  Episode 10 - From Lab Research to Founder: Grit and The Leap into Cybersecurity 12.03.2026 18m

  Richard Bejtlich sits down with Greg Bell, Corelight co-founder and Chief Strategy Officer, to explore the transition from elite academic research to the world of venture-backed startups. Greg shares the "light bulb moment" at Lawrence Berkeley National Laboratory that led a group of scientists to turn Zeek (formerly Bro) into a commercial reality. The conversation covers the "virtuous cycle" between open-source projects and sustainable business models, explaining why professional maintenance is critical for mission-critical software. Greg also offers practical perspective for the next generation of defenders, discussing the role of "applied curiosity" in a shifting job market and his personal experience with the "grit" required to leave a secure career for the uncertainty of a startup. Whether you are a network operator or interested in the mechanics of tech entrepreneurship, this episode offers a candid look at the challenges of bridging the gap between research and industry.
• 
  Episode 9 - Federal Cyber Defense: Legacy Debt, Cloud Shifts, and Network Truth 26.02.2026 15m

  Richard Bejtlich sits down with Jean Schaffer, Corelight’s Federal CTO, to discuss the unique hurdles facing government agencies in an era of escalating state-sponsored threats. Jean highlights the persistent challenge of legacy IT infrastructure and the "technical debt" that complicates modernization efforts across the Department of Defense, the intelligence community, and the civilian sector. The conversation explores the strategic shift toward cloud adoption as a means to decommission vulnerable on-premise hardware and the evolving "whole of nation" defense strategy that requires deeper public-private partnerships. Jean also offers her perspective on the risks and rewards of open-source software in government environments, emphasizing the importance of code provenance. Finally, they delve into why Zero Trust architectures still require robust network telemetry as a foundational element to verify that security policies are actually working in the real world.
• 
  Episode 8 - Enterprise Nervous System: Using Network Signal to Direct Business Strategy 20.02.2026 18m

  In this episode of Corelight Defenders, I'm joined by Bernard Brantley, Chief Information Security Officer at Corelight, as we delve into the concept of the enterprise nervous system. Bernard shares insights from his extensive experience in network analysis, explaining how organizations can leverage their network traffic data to enhance security and drive business outcomes. We discuss the importance of understanding the interdependencies between assets, processes, and goals, and how security teams can position themselves as integral to business success rather than just risk mitigators. Join us as we explore how security can effectively align with business strategies, fostering a culture of proactive engagement and intelligence sharing.
• 
  Episode 7 - Practical AI for Zeek, MITRE, and Security Docs 29.01.2026 15m

  In Episode 7 of Corelight DefeNDRs, join me, Richard Bejtlich, as I sit down with Dr. Keith Jones, Corelight's principal security researcher, to discuss the practical applications of AI in enhancing network security. We delve into how large language models (LLMs) can assist in cleaning up documentation and generating Zeek scripts, sharing insights from our extensive experience in incident response and coding. Keith reveals the challenges and successes he has encountered using LLMs to streamline processes, including their role in analyzing MITRE techniques. Whether you're a seasoned coder or new to the field, this episode offers valuable perspectives on leveraging AI tools to improve efficiency and effectiveness in security operations. Tune in for a thought-provoking conversation that bridges AI innovation with real-world cybersecurity challenges.