Richard Bejtlich

@[email protected]
3K Followers
79 Following
766 Posts
I was a captain in the United States Air Force who formally trained as an intelligence officer. I later worked in information warfare. I promoted the concept that "prevention eventually fails" in my first book (2004) and developed tactics, operations, and strategy to detect and respond to nation-state and criminal computer intrusions. I wrote about cybersecurity from 2001 to 2021. I created the GE-CIRT and was Mandiant's first CISO. I currently advocate #NetworkSecurityMonitoring for @corelight. My latest books are here #ad https://amzn.to/3B2AcMc
TaoSecurityhttps://www.taosecurity.com/index.html
Bloghttps://taosecurity.blogspot.com/
LinkedInhttps://www.linkedin.com/in/richardbejtlich/
Amazonhttps://www.amazon.com/-/e/B001IR3KOW
Richard Bejtlich23h ago
Do you see that crescent at the far right of the image? That’s US! The larger crescent in the middle is the moon, and the left is the Artemis II mission spacecraft.
Richard BejtlichMar 27

Episode 11 of the Corelight podcast is live. I speak with our product lead, Vijit Nair. We explore what it takes to mature AI in security operations, from the importance of high-quality, unopinionated data to the rise of agent-based systems and connected workflows.

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362

Richard BejtlichMar 24

Oh snap. My single most important cybersecurity metric deteriorated again.

In the M-Trends report for calendar year 2024, Mandiant’s global median dwell time metric worsened from 10 to 11 days. In the newest report, released today, for calendar year 2025, that metric worsened again, from 11 to 14 days.

In other words, organizations are taking even longer to detect and respond to intrusions. 10 days was already still too much, in a world where teams need to detect and contain in an hour to be effective.

I’m not a doomer. We made amazing progress since 2011, when median global dwellers time was over 400 days. But, two bad years in a row has never happened. Before last year, the metric had always improved!

It’s possible Mandiant is just dealing with ever tougher cases. I have to dig into the full report.

Richard BejtlichMar 20
Iranian state TV uses unactivated version of Windows as seen by “Activate Windows” warning under picture. 😂
Richard BejtlichMar 12

Episode 10 of the Corelight podcast is live. I speak with our co-founder, Greg Bell, about what it's like to start a network security monitoring company and how to thrive in the long term.

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362

Richard BejtlichMar 2

Episode 9 of the Corelight podcast is live. I speak with our federal CTO, Jean Schaffer, about challenges faced by governments when trying to secure their data.

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362

Richard BejtlichFeb 25

Episode 8 of the Corelight podcast is live. I speak with our CISO, Bernard Brantley, about his idea of using an enterprise nervous system to support and defend the business.

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362

Richard BejtlichFeb 25
Thanks Cynthia Brumfield for including my thoughts in your new article for CSO Online: https://www.csoonline.com/article/4136995/boards-dont-need-cyber-metrics-they-need-risk-signals.html
Boards don’t need cyber metrics — they need risk signals

Security teams have learned to measure activity. The harder task is turning those measurements into signals directors can use to govern risk.

CSO Online
Richard BejtlichFeb 13
This might be the most unusual citation my work has ever received: "We propose fungi, and in particular living mycelial networks, as a novel class of biohybride systems for security, resilience, and protection in extreme environments. We discuss how fungi can function as distributed sensing substrates, self-healing materials, and low-observability anomaly-detection layers." https://arxiv.org/abs/2602.10543
Richard BejtlichFeb 6

RE: https://infosec.exchange/@jerry/116020940189408651

Let's not forget that, in the Phaedrus, Socrates argued against writing, because he feared it would make people reliant on external symbols over their own memory. The irony is that the only reason we know of Socrates' thinking is that his number one student, Plato, wrote down what Socrates said.