Corelight, the fastest-growing provider of Network Detection and Response (NDR) solutions, has announced major upgrades to its AI-powered threat detection platform. The enhancements include expanded detection for evasive threats and the launch of Corelight Threat Intelligence, a new capability that delivers real-time, adversary-focused intelligence feeds sourced from CrowdStrike Falcon® Adversary Intelligence.

Together, these advancements empower security operations centers (SOCs) to identify and respond to sophisticated attacks faster and with greater accuracy — all while minimizing false positives and analyst fatigue.

Rising Need for Evasion-Resistant Defenses

Cyber attackers are increasingly adopting advanced tactics to evade traditional defenses. The 2025 Verizon Data Breach Investigations Report revealed a sharp rise in the exploitation of edge devices and VPNs, jumping from 3% to 22% as initial breach vectors in the past year. Supporting this trend, a Gigamon study found that 96% of lateral movement behaviors go undetected by conventional tools, creating dangerous blind spots in enterprise networks.

Meanwhile, the CrowdStrike 2025 Global Threat Report noted that “breakout time” — the interval between an initial compromise and lateral movement — has fallen to an average of just 48 minutes. This compressed timeline demands continuous visibility, actionable intelligence, and rapid, automated responses to stop attackers before they expand their foothold.

“As adversaries increasingly use AI and advanced techniques to bypass traditional defenses, organizations must focus on detecting threats that hide within normal network activity,” said Vijit Nair, Vice President of Product at Corelight. “Our approach unites high-quality network evidence, intelligence-driven insights, and AI-powered analytics to give SOC teams the visibility and context they need to identify evasive threats efficiently.”

Cyber Technology Insights : Astrix Security Recognized on Fortune Cyber 60 List for Breakthrough Innovation in AI Agent Security

Comprehensive AI-Powered Detection Enhancements

Corelight’s latest release strengthens its multilayered detection framework, combining network telemetry and advanced machine learning to uncover stealthy lateral movement, credential abuse, and other sophisticated threat behaviors.

Key updates include:

  • Enhanced Anomaly Detection: New machine learning models identify unusual administrative behavior, lateral movement, and RDP activity — including anomalous file transfers and shared directory access.
  • Advanced East-West Detection: Enhanced capabilities to spot complex internal attacks such as Kerberos brute-force attempts, credential theft, and configuration weaknesses.
  • Expanded Supervised ML Models: Corelight sensors now feature improved algorithms to detect anonymous network usage and malicious SSL certificates, tuned to cut down on noise and boost accuracy.
  • Advanced Command-and-Control (C2) Detection: Fresh signatures detect unique adversary tool patterns that can disguise themselves within encrypted HTTPS traffic, helping uncover hidden C2 channels.

Cyber Technology Insights : PQShield and Carahsoft Partner to Deliver Advanced Post-Quantum Cryptography Solutions

Introducing Corelight Threat Intelligence

The new Corelight Threat Intelligence capability integrates validated Indicators of Compromise (IOCs) from industry-leading partners, starting with CrowdStrike. This integration combines Corelight’s rich network telemetry with CrowdStrike’s adversary-driven intelligence — providing continuously updated, context-rich IOCs such as domains, file hashes, and IPs.

The result is more precise, prioritized detection and reduced noise, allowing analysts to focus on the threats that matter most to enterprise risk.

“Adversaries are now leveraging AI to exploit vulnerabilities at unprecedented speed,” said Adam Meyers, Head of Counter Adversary Operations at CrowdStrike. “By embedding CrowdStrike’s intelligence into Corelight’s detection framework, defenders gain that same advantage — the ability to operate with AI-driven precision, speed, and context to stop attacks others might miss.”

Empowering Defenders with Intelligence and Automation

With these upgrades, Corelight continues to advance the state of network-based detection, bridging the gap between AI analytics and actionable threat intelligence. The integration of continuous, high-fidelity data enables defenders to identify adversaries quickly, automate responses, and strengthen overall cyber resilience.

By combining adversary insights, network telemetry, and adaptive machine learning, Corelight gives enterprises the tools they need to outpace modern threat actors — delivering the speed, precision, and confidence today’s security operations demand.

Cyber Technology Insights : Rapid7 Boosts Exposure Remediation with AI-Driven Risk Insights and Smarter Vulnerability Intel

To participate in our interviews, please write to our CyberTech Media Room at info@intentamplify.com