Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Ben Reardon, Lead Researcher Corelight Labs / NOC crew I'm a researcher on the Labs team at Corelight and, for me, working in the Black Hat Network Operations Center (NOC) at the USA show in Las Vegas is up there as one of the most interesting and intense activities on the calendar.

You face more signals than your SOC can triage and more lateral movement than your legacy rules can see. Signature-only controls miss new techniques, while manual triage slows response. The gap between “alert created” and “incident contained” widens when you can’t separate real risk from noise. Adversaries exploit encrypted channels, low-and-slow exfiltration, and living-off-the-land tools that look like normal activity. Missed weak signals become major incidents.

How AI can transform even Microsoft's own documentation to meet its style standards.

Advanced AI-supported threat detection for faster MTTD and MTTR The Ministry of Defence (MoD)’s own assessments describe an unacceptable cyber risk position amid an escalating wave of malicious cyber activity1 — a sobering reality for defence security operations centre (SOC) managers With the risk of cyber attack among the highest managed by the Defence Board2, the pressure on security teams is growing. SOC teams must detect sophisticated cyber threats before they cause damage.

Many security teams struggle to see the full scope of threats because network, endpoint, and cloud data remain siloed. Without unified visibility, detecting hidden attacks or spotting lateral movement is tough. Gaps between tools lead to fragmented signals, low-fidelity alerts, and slower investigations. That fragmented view can let attackers linger longer—and SOC analysts bounce between multiple interfaces just to piece together a coherent incident narrative.