Episode 21 - Building AI Harnesses to Unify Detection and Response

Corelight Senior Security Engineer Jordan Hair joins Richard Bejtlich to break down how defense teams can leverage agentic AI harnesses to transform traditional security operations. By wrapping deterministic code around large language models, Hare created automated agents for alert triage, threat hunting, and detection engineering that shrink routine investigations from 45 minutes down to seconds. He emphasizes the necessity of maintaining a human-in-the-loop verifier at critical decision points, while demonstrating how this AI-assisted workflow collapses traditional SOC silos—enabling a single engineer to seamlessly manage the entire lifecycle from initial threat hunt to incident response. Learn more about Corelight's use of TAC GPT-5.5: https://www.linkedin.com/posts/openai-for-business_corelight-uses-codex-security-to-move-faster-activity-7477439412524470272-oMWe