Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Antivirus just isn’t enough anymore — not even close. Ransomware attacks constantly grow more sophisticated, zero-day vulnerabilities appear frequently and attackers increasingly rely on legitimate tools already inside a network rather than just on traditional malware. Antivirus alone just can’t protect organizations from all of those threats.

From hunting threats to solving complex problems to coding on a couch, adventures in the Black Hat NOC (Network Operations Center) are always interesting. Over the last few months and several shows, I’ve had the privilege of working with one of the other NOC partners, Cisco, to design and test our first integration between Corelight Investigator and Cisco XDR.

Organizations today operate in a threat landscape that is clearly more complex than it was just a few years ago. Advanced attacks no longer follow a single path or rely on a single entry point. Instead, they move across endpoints, identities, networks, and cloud services, exploiting fragmented environments and the lack of integration between different security layers. This evolution highlights the limitations of traditional approaches.