Episode 19 - The Cap on Inference: Proving How Network Data Quality Drives AI Security ROI

Richard Bejtlich sits down with Michelle Pathe, Zeek's community liaison, to explore how Zeek stays open, supportive, and useful for practitioners. They discuss Michelle's role bridging maintainers and users, a CERN workshop that connected security teams across Europe, how Zeek gathers feedback without relying on telemetry, and the community’s approach to real-world use cases, training, and content that helps defenders get unstuck. They also cover plans for Berkeley workshops and how AI tools are reshaping how the Zeek ecosystem provides help while emphasizing accuracy and trusted information. The conversation highlights why building a strong, responsive community and practical resources matters for defenders who rely on Zeek to detect and understand threats in complex networks.

Richard Bejtlich sits down with Vern Paxson to celebrate Zeek's 30th anniversary and explore the discipline of measurement that underpins modern network visibility. They discuss the tension between configuration and data mindsets, why there is no such thing as a typical network, and how open source and community funding helped Zeek become a durable research and security resource. Vern reflects on the empirical discipline he brings from physics, the impact of AI tools on Zeek development, and practical guidance for researchers and practitioners navigating rapid change. The conversation also touches on NSF support, the evolution of Zeek as a project, and what motivates long-term work in instrumentation and telemetry.

Richard Bejtlich sits down with Vern Paxson, Corelight co-founder and Chief Scientist, to explore Zeek's 30-year journey from a Berkeley Lab research project to a data-rich backbone of modern NDR. They unpack how Zeek evolved from early TCP health measurements into a flexible, scriptable network analysis platform, the value of neutral, long-term logs over real-time alerts, comparisons to intrusion-detection approaches like Snort, and the challenges and opportunities of visibility in enterprise gear. The conversation also touches on the origins of libpcap, tcpdump, and BPF, the role of academia in building enduring tooling, and what this history means for defenders aiming to understand and defend today’s networks.

In this episode, Richard Bejtlich talks with Julie Parrish, CMO at Corelight, about how security professionals can communicate more effectively with CISOs, boards, and buyers who each measure success differently. Julie explains why practitioners should frame requests in terms of risk instead of raw technology, why CISOs need to connect security investments to reputation, compliance, and business continuity, and why marketers lose credibility when they lean on buzzwords, analogies, or FUD instead of clarity and education. The conversation also explores persona-based messaging, the value of expert-led content, and how AI-driven search is changing the way security companies think about discoverability and trust. For anyone trying to influence decisions in security, this episode is a practical look at how better communication leads to better outcomes.

In this episode, host Richard Bejtlich sits down with Christian Kreibich, Zeek's technical lead, to unpack the upcoming Zeek 9 release and what it means for practitioners. Christian explains how the project structures its three-releases-a-year cadence and how the team has spent recent cycles modernizing Zeek—including the shift to ZeroMQ for cluster messaging and new systemd-based cluster orchestration. A major thread is security: alongside longstanding fuzzing and static analysis work, the team is now navigating a wave of agentic, LLM-driven security scanning, with preliminary internal efforts surfacing 50–70 high-severity findings and parallel initiatives from OpenAI/Trail of Bits and Anthropic. The conversation also covers the migration from BinPAC to Spicy for safer protocol parsing, why the team favors Spicy over Rust for writing analyzers (while eyeing Rust elsewhere), the ongoing Microsoft Defender for Endpoint collaboration bringing Zeek to Windows, and a clear roadmap toward cloud-native packet ingestion, better tunnel handling, and a simpler packaging ecosystem. It's a grounded look at how a mature open source project stays modern without breaking what works.

In this episode, host Richard Bejtlich sits down with Steve Smoot, Chief Technical Officer at Corelight, to explore how AI is reshaping the daily work of engineers and defenders alike. Steve traces his path from early employee to CTO and explains why the flexibility of Open NDR—where a simple ten-line Zeek or Spicy script can solve a customer's edge case without a full product release—remains a core advantage. The conversation digs into practical realities of working with large language models: using AI to navigate unfamiliar code bases, the persistent danger of hallucinations (including a memorable Suricata example), and the classic programming trap where a routine's label no longer matches what the code actually does. Steve and Richard also tackle the anxiety around entry-level technical jobs, offering a grounded, economics-informed counterpoint to doom forecasts, and make the case that architecture, maintainability, and truly understanding the business problem are the durable human skills in an AI-assisted world. It's a candid look at where development is heading—and why understanding the problem still matters more than writing the code.

Corelight Senior Security Engineer Jordan Hair joins Richard Bejtlich to break down how defense teams can leverage agentic AI harnesses to transform traditional security operations. By wrapping deterministic code around large language models, Hare created automated agents for alert triage, threat hunting, and detection engineering that shrink routine investigations from 45 minutes down to seconds. He emphasizes the necessity of maintaining a human-in-the-loop verifier at critical decision points, while demonstrating how this AI-assisted workflow collapses traditional SOC silos—enabling a single engineer to seamlessly manage the entire lifecycle from initial threat hunt to incident response. Learn more about Corelight's use of TAC GPT-5.5: https://www.linkedin.com/posts/openai-for-business_corelight-uses-codex-security-to-move-faster-activity-7477439412524470272-oMWe

Richard Bejtlich joins Vince Stoffer to unpack the ideas behind his new book on network detection and response, starting with a practical distinction: NSM is a strategy, while NDR is a product. The conversation explores what teams should expect from network data, how alerts and threat hunting work together, why prevention eventually fails, and how AI can help practitioners investigate unfamiliar logs, alerts, and artifacts without replacing human judgment. Richard also reflects on the writing process, the pressure of creating technical material while doing the work, and why the future of NDR depends on trustworthy data, clear investigation paths, and analysts who know when to question the machine. Download the NDR Essentials book: https://corelight.com/cp/ndr-essentials

In this episode, host Richard Bejtlich sits down with Corelight Co-founder and Chief Strategy Officer Greg Bell to unpack groundbreaking research that quantifies exactly how data quality impacts AI-driven security automation. Moving past qualitative industry hype, Greg shares hard evidence from an empirical experiment pitting leading AI agents against real-world Capture the Flag (CTF) challenges and incident response report writing. The findings reveal a dramatic truth: basic firewall and flow logs place a hard cap on inference, throttling an LLM's capacity for deep insight. By upgrading to higher-fidelity, densely linked network data, teams can boost automated threat hunting accuracy, eliminate costly LLM hallucinations, and dramatically reduce token consumption budgets by enabling security agents to solve problems twice as fast. Read the full research paper: https://corelight.com/blog/data-quality-limits-ai-soc-performance

In this episode, host Richard Bejtlich sits down with Corelight Senior Sales Engineers Adam Donadeo and Nico Roosenboom to unpack their firsthand experiences at Locked Shields, the world’s largest international live-fire cyber defense exercise. The conversation dives deep into the chaotic, real-world friction of defending a massive virtualized network alongside 4,000 global experts against aggressive red team waves. Adam and Nico share crucial insights on navigating vendor interoperability, the critical value of contextual log enrichment, and deploying specialized SCADA protocol packages to monitor critical infrastructure under intense pressure. For enterprise defenders, this episode highlights why a transparent, open-foundation network detection and response (NDR) strategy is essential for surviving real-world tactical friction and modern cyber threats.