Episode 18 of the Corelight podcast is live. I speak with Senior Sales Engineers Adam Donadeoto and Nico Roosenboom about their experiences at Locked Shields, the world’s largest international live-fire cyber defense exercise. We dive into the friction of defending a massive virtualized network against waves of red teamers.

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362

Episode 17 of the Corelight podcast is live. I speak with Ricky Lin about how he uses Zeek and Corelight to monitor his home network, and how networking has changed over the last 30 years.

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362

I enjoyed hearing my friends Kevin Mandia and Ron Bushar share their perspectives at the Northern Virginia Technology Council (NVTC) yesterday. We had a mini-Mandiant reunion.

It looks like we're finally making progress towards an independent US Cyber Force:

https://www.csis.org/programs/strategic-technologies-program/projects/commission-us-cyber-force-generation

However, this bill by Sen Gillibrand to put it under the Army isn't the best idea.

https://www.airandspaceforces.com/new-push-for-separate-cyber-force-builds-but-questions-remain/

I get it -- Navy has the Marine Corps, Air Force has the Space Force, Army has... nothing? But the Coast Guard doesn't slot under anyone either. It would be a step backwards to put Cyber under Army.

Episode 16 of the Corelight podcast is live. Dave Getman and I discuss the evolution of Corelight Investigator, the role of agentic triage in security operations, and how Corelight brings receipts to intrusion analysis.

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362

RE: https://infosec.exchange/@briankrebs/116661298779426573

I’m not surprised at all. This has always sounded like a personal vendetta by a former employee or contractor. I don’t buy the “mistreated independent genius researcher” angle either. This person is probably leaking the MS internal vuln catalog. Unfortunately the “infosec community” is dominated by vocal fans of offense, who earn their living by breaking things, proving my 2021 proposition that “Digital offense capabilities are currently net negative for the security ecosystem.”

https://taosecurity.blogspot.com/2021/02/digital-offense-capabilities-are.html

Episode 15 of the Corelight podcast is live. Greg Bell and I talk about Mythos and AI-accelerated vulnerability discovery and remediation. This was one of my favorite discussions thus far!

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362

Episode 14 of the Corelight podcast is live. I speak with Vince Stoffer on post-quantum cryptography. We discuss how network security monitoring can help defensive teams understand and manage this technology.

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362

Here's another incident where checking your NSM data would tell you if you were compromised, assuming you're collecting and storing the right evidence for a sufficient duration. https://www.techspot.com/news/112318-hackers-used-daemon-tools-own-website-silently-install.html

This is really interesting, and although there are no network IOCs in the post, this malware was active on target networks: https://hackingpassion.com/fast16-pre-stuxnet-cyber-sabotage/

Episode 13 of the Corelight podcast is live. I speak with our VP of research, Ali Islam. We discuss how a research lab functions within a modern security company. Ali has advice for anyone who wants to get into this fun technical field.

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362

Mythos has definitively disproven this: “Given enough eyeballs, all bugs are shallow," known as Linus's Law, asserts that with a large enough base of beta-testers and co-developers, almost every software problem will be identified and fixed quickly. Coined by Eric S. Raymond in The Cathedral and the Bazaar (1999) to describe open-source development, it suggests collective scrutiny makes bugs easier to find.”

https://arstechnica.com/ai/2026/04/mozilla-anthropics-mythos-found-271-zero-day-vulnerabilities-in-firefox-150/

"Those two words which the writer set together have produced an effect which will never die, as long as [people] can read with understanding." - Shelby Foote, The Correspondence of Shelby Foote and Walker Percy

Who else is glad to see that Windows Smart App Control can now be enabled and disabled as needed without a Windows reinstall? Now I just need a way to whitelist select apps. For example, I vibe coded my own screencap program, but it has triggered SAC in the past because it’s not signed.

Episode 12 of the Corelight podcast is live. I speak with our AI leader, Stan Kiefer. He discusses AI as a knowledge multiplier for analysts. AI doesn't replace investigators, but it can help analysts if the underlying data is suitable.

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362

Do you see that crescent at the far right of the image? That’s US! The larger crescent in the middle is the moon, and the left is the Artemis II mission spacecraft.

Episode 11 of the Corelight podcast is live. I speak with our product lead, Vijit Nair. We explore what it takes to mature AI in security operations, from the importance of high-quality, unopinionated data to the rise of agent-based systems and connected workflows.

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362

Oh snap. My single most important cybersecurity metric deteriorated again.

In the M-Trends report for calendar year 2024, Mandiant’s global median dwell time metric worsened from 10 to 11 days. In the newest report, released today, for calendar year 2025, that metric worsened again, from 11 to 14 days.

In other words, organizations are taking even longer to detect and respond to intrusions. 10 days was already still too much, in a world where teams need to detect and contain in an hour to be effective.

I’m not a doomer. We made amazing progress since 2011, when median global dwellers time was over 400 days. But, two bad years in a row has never happened. Before last year, the metric had always improved!

It’s possible Mandiant is just dealing with ever tougher cases. I have to dig into the full report.

Iranian state TV uses unactivated version of Windows as seen by “Activate Windows” warning under picture. 😂

Episode 10 of the Corelight podcast is live. I speak with our co-founder, Greg Bell, about what it's like to start a network security monitoring company and how to thrive in the long term.

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362