Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Edge exploits, EDR blind spots, 51-second breakouts
For every advancement in defense, attackers supply the equal and opposite adaptation. In the last few years EDRs have become so effective that adversaries have radically shifted gears. That shift shows up unmistakably in three heavyweight reports—Verizon’s DBIR, Mandiant’s M-Trends, and CrowdStrike’s Global Threat Report. Here’s how I’m stitching their data together.
Cloud your way: Expanding threat visibility to meet the unique needs of your business
Let’s face it: The cloud has become the go-to platform for modern infrastructure—and for good reason. Scalability, flexibility, and speed are hard to beat. But as organizations increasingly rely on the cloud to run their critical operations, the threat landscape is evolving just as fast. And attackers? They’re getting smarter, stealthier, and more cloud-savvy by the day. That’s why monitoring cloud network traffic is no longer optional—it’s essential.
Your Network Evidence, Your SIEM, your way: Corelight's open SIEM strategy empowers SOCs with a unified experience
Security operations centers (SOCs) are under constant pressure to keep their organizations secure, while battling alert fatigue, tool sprawl, and ever-rising demands for speed and precision. Analysts today face an overwhelming landscape where context is thin, telemetry is inconsistent, and critical signals are buried in noise. At Corelight, we’re focused on one simple idea: Your network evidence should work wherever your SOC team does.
Corelight's Vincent Stoffer on Why Enterprises Can't Rely Only on Endpoint Security
The cybersecurity industry's heavy reliance on endpoint detection and response tools has created significant vulnerabilities, particularly around IoT devices and operational technology that cannot be monitored using traditional security tools, according to Vincent Stoffer, field CTO at Corelight. This growing attack surface, combined with sophisticated threat actors who exploit any available entry point, has pushed organizations to reevaluate their security strategies and consider more comprehensive network monitoring approaches.
How Corelight's anomaly detection enhances network security
Signature-based detections provide fast, effective defense against known attacks. But the threat landscape is rapidly changing: Attackers are utilizing novel, sophisticated techniques that can bypass traditional, signature-based detection methods and also weaponizing legitimate tools and processes to avoid established detection tools, including endpoint detection. In this dynamic environment, organizations must in turn deploy new detection techniques to keep pace.
Leveraging map-reduce and LLMs for enhanced cybersecurity network detection
In my security research role at Corelight, I often have to go through large, complex data sets to detect subtle anomalies and threats. It reminds me of a famous quote by Abraham Lincoln: Give me six hours to chop down a tree and I will spend the first four sharpening the axe. For me, that means investing time up front to build tools that allow a large language model (LLM) to do the heavy lifting on key tasks, namely those that teams of analysts would have handled in the past.
Quick FIX log management: How metadata simplifies financial protocol tracking (and how Corelight's platform can help)
Financial institutions, such as banks and trading houses, have a strong interest in recording key transaction activity within their networks. In the face of daunting data storage requirements, many are finding that Corelight’s network metadata—notably metadata produced by Zeek—is the key to a simplified tracking and storage process. Many of our customers used to rely on packet capture (PCAP).
How metadata wrestled control of FINRA's colossal data archiving requirements
The financial industry is known for its rigorous and sometimes quirky data retention requirements that can challenge even the most seasoned security expert. For example, FINRA Rule 4511 requires members to "preserve for a period of at least six years those FINRA books and records for which there is no specified period under the FINRA rules or applicable Exchange Act rules." Keeping six years of records: That's no small feat. But it's certainly doable.
For Science! - Threat hunting with SCinet at SC24
In November 2024, I participated in SCinet with the Network Security team at SC24. My job was supporting Corelight sensors and threat hunting using the data the sensors produced. This engagement allowed for a very constructive comparison between the networking challenges at SC and Black Hat USA, where I had the honor of working in the Network Operations Center (NOC) a few months earlier. At SC, I felt immersed in the cutting-edge world of research computing with people showcasing the fastest everything.