Corelight DefeNDRs
Gain clear, actionable intelligence from Corelight's network defense experts. Corelight DefeNDRs translates complex cybersecurity detection challenges into concise, practical episodes designed to support faster, smarter decision-making across modern security teams.
All Episodes
Episode 24 - Speaking Security So Leaders, Boards, and Buyers Actually Listen
In this episode, Richard Bejtlich talks with Julie Parrish, CMO at Corelight, about how security professionals can communicate more effectively with CISOs, boards, and buyers who each measure success differently. Julie explains why practitioners should frame requests in terms of risk instead of raw technology, why CISOs need to connect security investments to reputation, compliance, and business continuity, and why marketers lose credibility when they lean on buzzwords, analogies, or FUD instead of clarity and education. The conversation also explores persona-based messaging, the value of expert-led content, and how AI-driven search is changing the way security companies think about discoverability and trust. For anyone trying to influence decisions in security, this episode is a practical look at how better communication leads to better outcomes.Episode 23 - Inside Zeek 9: Modernizing Open Source Network Monitoring & Agentic Security Scanning
In this episode, host Richard Bejtlich sits down with Christian Kreibich, Zeek's technical lead, to unpack the upcoming Zeek 9 release and what it means for practitioners. Christian explains how the project structures its three-releases-a-year cadence and how the team has spent recent cycles modernizing Zeek—including the shift to ZeroMQ for cluster messaging and new systemd-based cluster orchestration. A major thread is security: alongside longstanding fuzzing and static analysis work, the team is now navigating a wave of agentic, LLM-driven security scanning, with preliminary internal efforts surfacing 50–70 high-severity findings and parallel initiatives from OpenAI/Trail of Bits and Anthropic. The conversation also covers the migration from BinPAC to Spicy for safer protocol parsing, why the team favors Spicy over Rust for writing analyzers (while eyeing Rust elsewhere), the ongoing Microsoft Defender for Endpoint collaboration bringing Zeek to Windows, and a clear roadmap toward cloud-native packet ingestion, better tunnel handling, and a simpler packaging ecosystem. It's a grounded look at how a mature open source project stays modern without breaking what works.
Episode 22 - The CTO's Case for AI: Fixing Bugs, Vibe Coding, and the Future of Dev Jobs
In this episode, host Richard Bejtlich sits down with Steve Smoot, Chief Technical Officer at Corelight, to explore how AI is reshaping the daily work of engineers and defenders alike. Steve traces his path from early employee to CTO and explains why the flexibility of Open NDR—where a simple ten-line Zeek or Spicy script can solve a customer's edge case without a full product release—remains a core advantage. The conversation digs into practical realities of working with large language models: using AI to navigate unfamiliar code bases, the persistent danger of hallucinations (including a memorable Suricata example), and the classic programming trap where a routine's label no longer matches what the code actually does. Steve and Richard also tackle the anxiety around entry-level technical jobs, offering a grounded, economics-informed counterpoint to doom forecasts, and make the case that architecture, maintainability, and truly understanding the business problem are the durable human skills in an AI-assisted world. It's a candid look at where development is heading—and why understanding the problem still matters more than writing the code.
Episode 21 - Building AI Harnesses to Unify Detection and Response
Corelight Senior Security Engineer Jordan Hair joins Richard Bejtlich to break down how defense teams can leverage agentic AI harnesses to transform traditional security operations. By wrapping deterministic code around large language models, Hare created automated agents for alert triage, threat hunting, and detection engineering that shrink routine investigations from 45 minutes down to seconds. He emphasizes the necessity of maintaining a human-in-the-loop verifier at critical decision points, while demonstrating how this AI-assisted workflow collapses traditional SOC silos—enabling a single engineer to seamlessly manage the entire lifecycle from initial threat hunt to incident response. Learn more about Corelight's use of TAC GPT-5.5: https://www.linkedin.com/posts/openai-for-business_corelight-uses-codex-security-to-move-faster-activity-7477439412524470272-oMWe