Richard Bejtlich

@[email protected]
3K Followers
79 Following
766 Posts
I was a captain in the United States Air Force who formally trained as an intelligence officer. I later worked in information warfare. I promoted the concept that "prevention eventually fails" in my first book (2004) and developed tactics, operations, and strategy to detect and respond to nation-state and criminal computer intrusions. I wrote about cybersecurity from 2001 to 2021. I created the GE-CIRT and was Mandiant's first CISO. I currently advocate #NetworkSecurityMonitoring for @corelight. My latest books are here #ad https://amzn.to/3B2AcMc
TaoSecurityhttps://www.taosecurity.com/index.html
Bloghttps://taosecurity.blogspot.com/
LinkedInhttps://www.linkedin.com/in/richardbejtlich/
Amazonhttps://www.amazon.com/-/e/B001IR3KOW
Richard Bejtlich1d ago
Do you see that crescent at the far right of the image? That’s US! The larger crescent in the middle is the moon, and the left is the Artemis II mission spacecraft.
Richard BejtlichMar 27

Episode 11 of the Corelight podcast is live. I speak with our product lead, Vijit Nair. We explore what it takes to mature AI in security operations, from the importance of high-quality, unopinionated data to the rise of agent-based systems and connected workflows.

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362

Show threadRichard BejtlichMar 25
@jerry right-o.
Richard BejtlichMar 24

Oh snap. My single most important cybersecurity metric deteriorated again.

In the M-Trends report for calendar year 2024, Mandiant’s global median dwell time metric worsened from 10 to 11 days. In the newest report, released today, for calendar year 2025, that metric worsened again, from 11 to 14 days.

In other words, organizations are taking even longer to detect and respond to intrusions. 10 days was already still too much, in a world where teams need to detect and contain in an hour to be effective.

I’m not a doomer. We made amazing progress since 2011, when median global dwellers time was over 400 days. But, two bad years in a row has never happened. Before last year, the metric had always improved!

It’s possible Mandiant is just dealing with ever tougher cases. I have to dig into the full report.

Show threadRichard BejtlichMar 20
@FritzAdalis ah, interesting!
Richard BejtlichMar 20
Iranian state TV uses unactivated version of Windows as seen by “Activate Windows” warning under picture. 😂
Richard BejtlichMar 15
@campuscodi TIL IAB means initial access broker.
Richard BejtlichMar 12

Episode 10 of the Corelight podcast is live. I speak with our co-founder, Greg Bell, about what it's like to start a network security monitoring company and how to thrive in the long term.

https://www.youtube.com/playlist?list=PLBKbF72bCp2UtefR6_GhrKATP3tVD7Vev

https://open.spotify.com/show/2L2bkmbxaMxlz46xzhPNAH

https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362

Richard BejtlichMar 11
@campuscodi Rudd “had almost no prior expertise in cyber and intelligence operations.” Another reason I did not stay in uniform. It’s clear that to have a top cyber and intel job you must have no experience. 🤦‍♂️
Show threadRichard BejtlichMar 9
@choomba @b0rk When a filter is tough to understand, you can dump the filter with -d and step through the compiled packet-matching code to see what it does. See https://taosecurity.blogspot.com/2004/09/understanding-tcpdumps-d-option-have.html and https://taosecurity.blogspot.com/2004/12/understanding-tcpdumps-d-option-part-2.html
Understanding Tcpdump's -d Option

Richard Bejtlich's blog on digital security, strategic thought, and military history.