Nation-state actors living undetected inside critical infrastructure for months. Ransomware gangs weaponizing generative AI to compress exploit timelines from three weeks down to a matter of hours. Attackers systematically bypassing endpoint defenses and disappearing into encrypted traffic. If the 2025 threat landscape delivered any single message to enterprise security teams, it was this: the blind spots are getting bigger. At RSA 2026, Corelight is making the case that network detection and response has never been more essential — and that the company built on nearly 30 years of Zeek-based visibility is uniquely positioned to close those gaps.
Heading into the show at Booth N-5683 in the North Briefing Center, Corelight is showcasing a newly launched Agentic Triage capability designed to move security operations centers from drowning in alert noise to delivering evidence-backed containment decisions at machine speed. The announcement arrives alongside a broader argument the company is pressing on attendees: that AI without transparency is just another black box, and that the difference between “I think” and “I know” during an active breach can be worth millions.
Don’t miss this pre-show Q&A with Dave Getman, Senior Director of Product Management at Corelight, to find out more.
++
VMblog: Give VMblog readers a quick overview of your company and its core mission in the cybersecurity space.
Dave Getman: Corelight is a network detection and response (NDR) company that helps enterprises and governments find and disrupt advanced cyber attacks – including the ones bypassing traditional defenses like firewalls and endpoint detection and response (EDR).
We provide ground-truth network evidence and visibility of what’s happening on the network, helping security teams answer critical questions: Who got in? What did they do? Are they still here?
Our technology is built on Zeek, which has provided open source network security monitoring for nearly three decades. This heritage gives us unique advantages, including native compatibility with large language models for AI-driven security workflows.
We serve elite organizations including all six branches of the U.S. military, Five Eyes agencies, NATO members, and enterprises protecting more than $10 trillion in banking assets – just to name a few.
VMblog: Where can attendees find you at RSA 2026? What’s your booth number, and what kind of experience can visitors expect when they stop by?
Getman: Attendees can find Corelight on the RSA show floor at the North Briefing Center, Booth N-5683.
Corelight just launched a new agentic AI capability. This category-first offering accelerates security operations center (SOC) workflows, with a new suite of machine learning models to turn encrypted blind spots into evidence, and integrations across the AI-enabled SOC ecosystem to facilitate immediate containment of compromised accounts. Additionally it leverages expert-designed playbooks to support SOC analysts, building trust through complete transparency. We will be demoing this new capability at RSAC in addition to a wide range of other demos.
In addition, hear from Corelight’s Senior Sales Engineer Paul Mathis on how Network Detection and Response (NDR) helps public sector defenders uncover Volt Typhoon–style “living off the land” attacks.
Throughout the week our booth theater will also feature short talks and demos from Corelight alliance partners. Stop by for conversations with our team about how modern NDR fits into a strong security strategy.
Finally, join United Airlines VP & CISO Deneen DeFiore and Corelight CEO Brian Dye for a discussion on how collaboration, visibility, and open innovation are reshaping the defense of critical infrastructure. This session will be on Thursday, March 26, from 12-12:30 pm in the North Expo Hall Briefing Center Booth 6545.
VMblog: What is your message to RSA attendees coming out to the show this year?
Getman: IIf the past year has taught us anything, it’s that we can’t afford to become complacent. Attackers like Volt Typhoon and Salt Typhoon continue to bypass traditional endpoint and perimeter defenses –and can remain undetected for months or even years.
At the same time, while adversaries are starting to weaponize generative AI to accelerate attacks, many SOCs still rely on manual, repetitive triage processes and are struggling to keep up.
Advanced attackers are moving faster, and defenders need both better evidence and faster investigations. The difference between “I think” and “I know” during a breach can be worth millions, and can determine whether you can confidently prove containment.
At RSAC, we’re encouraging security teams to rethink how AI fits into the SOC. It’s not just about generating answers, it’s about delivering evidence analysts can trust based on transparency. By pairing high-fidelity network telemetry with expert-governed AI, capabilities like Corelight’s Agentic Triage can automate repetitive investigative work and turn alert noise into transparent, evidence-backed investigations – helping analysts move from detection to containment far faster.
VMblog: What were your key learnings from 2025’s security landscape, and how have those insights shaped your solutions for 2026?
Getman: The biggest lesson from 2025 was watching attackers systematically exploit the blind spots that exist across every enterprise network: living off the land, compromising edge devices, and evading EDR through lateral movement techniques that traditional defenses simply can’t see.
That reinforced what we’ve always believed: network evidence is the connective tissue that shows you the whole attack, not just isolated fragments. You can’t scope a breach, confirm containment, or prove remediation without understanding what actually happened across your environment.
In 2026, we’re focused on three things: making NDR faster to operationalize, delivering AI-powered workflows that accelerate investigations without vendor lock-in, and providing the behavioral context teams need to find attacks that are already inside, before they become headlines.
VMblog: With AI being a major focus in cybersecurity, how is your company leveraging or addressing AI both as an opportunity and a potential threat vector?
Getman: Corelight is announcing category-first agentic AI capabilities that help modern security operations centers (SOCs) automate the most repetitive tasks consuming security teams, dramatically improving analyst efficiency and speed while also building trust through complete transparency. On March 18, the company released Agentic Triage to accelerate SOC workflows, a new suite of machine learning models to turn encrypted blind spots into evidence, and integrations across the AI-enabled SOC ecosystem to facilitate immediate containment of compromised accounts.
By pairing the industry’s highest-fidelity network telemetry from Corelight with an expert-governed AI agent, we are giving security teams the evidence they need to trust, verify, and act on AI-generated insights. Only Corelight delivers true agentic AI triage, uniquely transforming overwhelming alert queues into verified, defensible investigations by applying expert playbooks to industry-leading network evidence with AI reasoning, drastically reducing time-to-triage and equipping analysts with definitive answers.
Indisputable evidence and robust detections are the foundation for any AI capability to be successfully integrated into today’s modern SOC. To support the advancement of AI in the SOC, Corelight is also introducing an expansion of its advanced machine learning and behavioral detections with a new suite of statistical models designed to detect evasive, post-exploitation techniques, including tunneling anomalies and VPN anomalies, without requiring decryption.
VMblog: What specific market challenges or pain points is your company addressing at RSA 2026? How have these evolved from previous years?
Getman: Modern SOCs are under relentless pressure as adversaries actively leverage generative AI to automate reconnaissance and accelerate attacks, while most triage processes remain manual, repetitive, and highly variable across analysts. In addition, many AI assistants can come up with recommendations to their human counterparts, but most of those are black boxes that don’t show how or why it came up with those recommendations.
Corelight Agentic Triage is an category-first automated investigation capability that helps security teams move from high-volume alert noise to rapid, evidence-backed containment, making triage up to 10x faster and allowing analysts to handle up to 3x more cases.
Powered by a modern GenAI agent architecture and driven by expert-written investigative playbooks, Agentic Triage automatically investigates the highest-risk entities in a customer’s environment on a daily basis. Instead of requiring analysts to manually review hundreds of individual alerts, the Corelight Lux agent consolidates signals into entity-centric investigations, applies structured investigative logic, and delivers a single, evidence-backed triage verdict, complete with transparent reasoning a human analyst can inspect and verify.
Unlike proprietary systems that hide the details used to inform AI decision-making, Corelight Agentic Triage exposes every playbook step, every query run, and every piece of evidence used to reach a conclusion. This “show-your-work” approach is purpose-built for enterprise SOCs that require AI to be accountable, reviewable, and defensible during audits and incident response reviews.
VMblog: Can you share any exclusive previews or announcements that attendees can expect to see at your booth this year?
Getman: Brian Dye, CEO at Corelight, and Deneen DeFiore, CISO at United Airlines, will host a session to discuss the need for collective action as cyber threats increase in sophistication and global infrastructure becomes more interconnected.
In this session, they will explore how collaboration, visibility, and open innovation are reshaping the defense of critical infrastructure. The session will be on Thursday, March 26, from 12 PM to 12:30 PM PT at North Briefing Center Booth N-6545.
In addition, Corelight just launched a new agentic AI capability. This category-first offering leverages expert-designed playbooks to support SOC analysts at machine speed. We will be demoing this new capability at RSAC in addition to a wide range of other demos.
VMblog: What sets your solution apart in today’s crowded cybersecurity marketplace? Why should RSA attendees prioritize visiting your booth?
Getman: The cybersecurity market is flooded with “AI-powered” and “next-gen” solutions. Many may be excellent, but few have been battle-tested in the highest-stakes environments with decades of real-world validation to prove it. Corelight stands apart today because of our commitment to getting it right from day one.
First, we’re built on Zeek, with nearly three decades of development by some of the world’s most sophisticated defenders. Our data is already understood by LLMs, already trusted by elite security teams, and already proven at massive scale.
Second, we serve organizations that can’t afford to get it wrong, whether that’s the military, intelligence agencies, or enterprises that hundreds of millions of people place their trust in. Unlike most security startups that begin in the SMB or midmarket and work their way up, Corelight started in the world’s largest, most demanding environments and only later expanded to the broader enterprise market.
And third, we solve the problem that everyone else is creating blind spots around. The industry’s focus with EDR has left a massive gap: what happens when attackers bypass the endpoint? When they exploit edge devices, live off the land, and move laterally for months without triggering alerts? That’s where network detection and response becomes non-negotiable.
If you haven’t implemented NDR and you’re concerned that you may have blind spots or vulnerabilities, we’re here to tell you: you do – and we can help.
VMblog: With the rise in sophisticated ransomware attacks, how does your solution help organizations better prepare and respond?
Getman: Ransomware attacks succeed because organizations can’t answer three critical questions fast enough: What did the attackers actually take? How long were they inside? And are we sure they’re gone? Corelight changes the equation by giving you the ability to look back in time and understand exactly what happened across your network.
We had a customer face a $10 million ransomware demand. The attackers claimed to have stolen massive amounts of sensitive data. Because this customer had deployed Corelight about 18 months prior, they could investigate the actual attack timeline and scope. As it turns out, there’s no honor among thieves. The attackers had taken roughly 10% of what they claimed, and that data wasn’t particularly brand-damaging. Armed with that evidence, they turned down the ransom.
Before an attack, we help organizations establish behavioral baselines and visibility across their environment. That’s the foundation you need to detect anomalies and respond quickly. During an attack, we provide the evidence to scope the full kill chain, understand lateral movement, and identify command-and-control activity. And after an attack, we enable you to prove containment and confirm remediation, not just hope for it.
VMblog: Are you participating in any speaking sessions or panel discussions at RSA 2026? Can you tell us more about these presentations?
Getman: Brian Dye, CEO at Corelight, and Deneen DeFiore, CISO at United Airlines, will host a session to discuss the need for collective action as cyber threats increase in sophistication and global infrastructure becomes more interconnected.
In this session, they’ll explore how collaboration, visibility, and open innovation are reshaping the defense of critical infrastructure. The session will be on Thursday, March 26, from 12 PM to 12:30 PM PT at North Briefing Center Booth N-6545.
VMblog: How is your company addressing the challenges of securing hybrid and multi-cloud environments?
Getman: Hybrid environments are the new normal, but visibility is still often fragmented. That’s why we deploy wherever your network traffic lives – physical data centers, AWS, GCP, Azure, remote offices, even Kubernetes clusters. Some SASE providers like Palo Alto and Netskope are enabling taps directly off their services, which we can monitor as well.
The key is that we’re out-of-line and non-disruptive. We don’t require network re-architecture or complex micro-segmentation projects. We use traffic mirrors, taps, and packet brokers to capture the data we need without forcing changes to your cloud architecture or operations.
VMblog: What’s your perspective on the most critical cybersecurity trends that will shape the industry in 2026-2027?
Getman: The global threat landscape continues to shift rapidly, magnifying cross-sector organizational needs for network detection and response capabilities. What we see shaping the landscape for the coming year include:
- Adversarial AI: Attackers, not just nation-state actors, are increasingly utilizing generative AI to accelerate exploit times, attack volumes and adopt new techniques. It used to take three weeks for vulnerabilities to shift to exploits, but with GenAI, this timeline is now 2-3 hours. As a result, we’re seeing an increase in customer demand for AI-powered real-time triage and response.
- Evasive Attacks: Endpoint detection and response (EDR) and firewall evasion are becoming increasingly common, resulting in ready access and persistence by living off the land, leading to organizations requiring robust AI-driven behavioral threat detection.
- Network Growth: Network traffic is continuously evolving and remains the ground truth for investigation. This is where NDR becomes critical, as it provides organizations visibility beyond the endpoint as networks continue to grow.
- Tool Sprawl: Vendors think in tools that they struggle to integrate, whereas attackers think in graphs and exploit gaps between tools, requiring organizations to implement interconnected and data-driven platforms.
VMblog: How does your solution help organizations address regulatory compliance and emerging privacy requirements?
Getman: Corelight empowers organizations to address regulatory compliance and emerging privacy requirements by providing built-in compliance reporting and evidence-based network visibility aligned with major frameworks such as PCI DSS, SOX, NIST CSF, FERPA, and CJIS. These reports, along with customizable reporting capabilities, allow teams to continuously monitor control effectiveness, identify policy violations, and produce documentation for auditors. Corelight’s monitoring spans on-premises, hybrid, and cloud environments, helping organizations demonstrate that required security controls are functioning and that network activity is properly documented.
For privacy and data protection, Corelight enforces strong encryption for data at rest and in transit, offers a GDPR-aligned Data Processing Addendum (DPA), and provides transparency into subprocessors and data transfer impact assessments. Security and privacy controls are mapped to standards including ISO 27001, SOC 2, GDPR, and CCPA, and supporting documentation – including compliance artifacts and product privacy datasheets – is available through Corelight’s Trust & Compliance portal and Trust Center.
VMblog: How can security leaders better prepare their organizations for the evolving threat landscape in 2026 and beyond?
Getman: Security leaders at traditional businesses should begin to key in on the importance of knowing what they have – particularly the inventory of crypto assets – and discuss how they will prepare for a post-quantum encryption world. Attackers continue to deploy ‘harvest now, decrypt later’ tactics, so organizations need to remain vigilant and mindful about their approach to quantum computing.
VMblog: Is your company giving away anything special or interesting at your booth this year?
Getman: If you grabbed the Guardian shirt last year, don’t miss this year’s Wrath of Conn tee.
VMblog: As an experienced RSA sponsor, what advice would you give to attendees to make the most of their conference experience?
Getman: Be intentional. RSA can be overwhelming, so focus on the conversations and solutions that align with your business priorities. And don’t hesitate to ask vendors tough questions, particularly about outcomes, integrations, and how they’ll help you reduce risk. Any company worth their salt should be happy to share more.
##
