TLDR: Corelight is integrating generative AI into its cybersecurity solutions to deliver more intelligent and effective threat detection. This move highlights the increasing importance of AI in strengthening digital security measures against evolving cyber threats.
Corelight, a prominent player in open network detection and response (NDR), is significantly enhancing its threat detection capabilities by leveraging generative artificial intelligence (GenAI). This strategic integration aims to provide smarter and more effective cybersecurity solutions, addressing the growing sophistication of cyberattacks. Corelight CEO Brian Dye noted that attackers are increasingly using generative AI to deploy advanced techniques, such as “living off the land” or lateral movement, which were previously limited to highly skilled hackers.
While there is a clear recognition of GenAI’s potential, a 2024 Corelight study revealed a divide among European IT leaders regarding its suitability for cybersecurity teams. Despite 46% actively exploring GenAI integration, 44% expressed concerns about data sensitivity and ingrained issues. However, the study also indicated a positive outlook, with 68% of organizations with dedicated threat hunters reporting that GenAI is already aiding their detection and protection efforts, and an additional 28% planning to expand its use. Ignacio Arnaldo, Director of Data Science at Corelight, stated that “Generative AI has been successfully applied for alert enrichment and contextualisation, providing SOC analysts with enhanced incident response capabilities.” He also emphasized the need for security vendors to build “sufficient guardrails into their AI-powered products” to overcome concerns about data confidentiality and model accuracy.
Corelight’s approach to threat detection is backed by AI and automation, enabling faster movement from alert to action. Their Open NDR solution provides extensive network visibility and precise detections that can identify threats missed by Endpoint Detection and Response (EDR) systems. The company employs machine learning and expert-driven models to pinpoint threats like lateral movement, DNS tunneling, and command-and-control (C2) behaviors. These detections are evidence-backed and explainable, facilitating quicker analyst validation. Corelight also provides structured, context-rich network data that integrates seamlessly with SIEMs, data lakes, and custom AI/ML models, allowing organizations to tailor threat profiles and adapt detections over time without vendor lock-in.
Also Read:
- AI Agents Accelerate Zero-Day Exploits, Challenging Cybersecurity Defenses
- Cisco Fortifies Data Centers Against Emerging AI Agent Threats
Looking ahead, European IT decision-makers are enthusiastic about GenAI’s role in SecOps, believing it will help mitigate attacks based on past tactics (75%), improve threat detection (71%), and shorten the breach cycle (63%). The ideal security approach, as identified by nearly half of the surveyed organizations, is a blend of human intelligence and technology, with risk-based and threat intelligence-based hunting strategies being most popular. As threat volumes surge and adversaries deploy automated tools, the integration of generative AI is becoming crucial for bolstering digital security and building resilience against evolving cyber threats.
