Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In this episode, host Richard Bejtlich and guest Ricky Lin explore the practical—and often personal—side of network defense: monitoring the home network. Ricky shares how he uses Corelight and Zeek to track everything from his children's YouTube habits to the constant chatter of IoT devices like Tesla vehicles and smart appliances. They delve into the "tinted windows" analogy to explain why visibility into encrypted traffic is still possible through network metadata, even when the contents are hidden.

Balancing AI Threat Detection: Optimizing False Positive Rates In this clip, Arjoyita Roy and Product Manager Luca Labardini from A10 Networks discuss the critical balance between maximizing AI-driven threat detection and minimizing false positives.

Network security depends on clear visibility across every digital asset. This detailed walkthrough covers Corelight's new Network Performance and Asset Classification logs. You will learn about these two logs, how to configure them, and how to use them during cyber investigations. Network Performance and Asset Visibility logs are available as part of the Sensor v29.1 general availability release to customers with Sensor and Investigator Bundle licenses.

Network security depends on clear visibility across every digital asset. In this brief demo, we will see how Corelight's new Network Performance and Asset Classification logs can be referenced when doing a threat hunt. You will learn about the logs and what information they contain. Network Performance and Asset Visibility logs are available as part of the Sensor v29.1 general availability release to customers with Sensor and Investigator Bundle licenses.

Our Red Team handed OpenClaw a penetration testing toolkit and pointed it at one of our own legacy Active Directory networks. 23 findings across 11 attack paths... But the findings aren't the interesting part. What's interesting is how it got there. Work that takes our human team three days took the agent three hours. Mid assessment it hit a wall, reasoned about its own limitations and proposed spinning up an EC2 GPU instance to crack a password hash. Nobody told it to.

In this episode, host Richard Bejtlich sits down with Dave Getman to discuss the evolution of Corelight Investigator and the paradigm shift from delivering raw sensor data to providing agentic triage. They explore how AI can synthesize millions of log lines into concise, actionable determinations—categorizing activity as malicious or benign—while maintaining transparency by "bringing the receipts" of raw evidence. Dave explains why the security pendulum is swinging back toward network detection to counter sophisticated EDR evasion and shares a roadmap for the future of auto-containment.

Manage multi-factor authentication (MFA) methods in Sophos Central, including how to add, edit, remove, and reset authentication options to restore secure access.

Every security vendor says their data is better. Corelight decided to test that claim directly. Using real nation-state attack scenarios, including Salt Typhoon-related activity, the same AI model was evaluated against multiple security data sources to measure investigation accuracy, threat visibility, and incident response coverage. The only variable was the data.

A step-by-step tutorial showing how to configure and use NDR Active Threat Intelligence in Sophos Firewall, simulate detections, and investigate high-risk activity in Sophos Central.