How AI Is Accelerating The Race Between Hackers And Corporate Security Teams

Key Concepts

• Coralite: An open-source cybersecurity company focused on network detection and response (NDR).
• Network Detection and Response (NDR): Security technology focused on identifying and responding to malicious activity within a network, after perimeter defenses have been breached.
• Threat Hunting: Proactively searching for malicious activity within a network, rather than relying solely on alerts.
• Living Off The Land (LotL): Attack technique using existing tools and processes within a compromised system to avoid detection.
• Open Source Model: Software development approach where source code is publicly available, fostering community contribution and transparency.
• Large Language Models (LLMs): AI models like GPT-3.5, Gemini, and Llama, used for automating tasks and analyzing data.
• Zero Trust Architecture: A security framework based on the principle of "never trust, always verify." (Implied through discussion of internal threats)

---

The Evolution and Impact of Coralite: A Deep Dive

Introduction & The Growing Threat Landscape

The cybersecurity landscape is facing an escalating crisis. In 2025, over 16 billion login credentials were compromised through cyberattacks, highlighting the urgent need for robust defense mechanisms. Coralite, an open-source cybersecurity company, is positioned to address this challenge by providing visibility into network activity and helping organizations detect and respond to threats that bypass traditional perimeter security.

Coralite’s Core Functionality: Visibility Within the Network

Coralite’s primary function is to provide comprehensive visibility into network traffic, enabling organizations to identify and track attackers after they have breached initial defenses. This is likened to defending an “egg” – securing the shell is important, but equally crucial is understanding what happens inside once an attacker gains access. The company focuses on detecting anomalous activity, particularly techniques like “living off the land” (LotL), where attackers utilize legitimate system tools to remain undetected. Coralite helps trace the entire attack path, providing a complete picture of the breach, not just the final target (e.g., a ransomware demand). A case study highlighted a customer successfully disputing a $10 million ransomware demand by proving the attacker had only compromised 10% of the claimed data, thanks to Coralite’s detailed tracking.

The Open-Source Foundation & Economic Sustainability

Coralite’s origins lie in academic research at Lawrence Berkeley National Lab. A PhD postdoc developed a tool to analyze network behavior, which quickly gained traction within national labs, the Department of Energy, the Department of Defense, financial institutions, and even allied intelligence agencies. Funded by the National Science Foundation for 15 years, the project transitioned to a commercial entity to ensure its long-term sustainability and support a growing community of over 300,000 security professionals. This transition was driven by the NSF’s recognition that ongoing software support required a dedicated economic vehicle. The open-source project is known as “Zeek.”

Leadership Transition & Strategic Focus

Brian Dy, the current CEO, joined Coralite when it was a 30-person startup with $2 million in revenue. He was drawn to the company by four key factors – the clear problem Coralite addressed (advanced threat detection), demonstrable product-market fit (evidenced by the open-source community), significant growth potential (adjacent technologies and a large Total Addressable Market - TAM), and the exceptional quality of the founding team and company culture. He emphasized the importance of a humble approach, contrasting Coralite with other cybersecurity companies prone to overpromising. The transition from founding CEO Greg Bell was smooth, facilitated by Bell’s self-awareness and willingness to step aside to focus on strategic initiatives and community engagement.

Customer Base & Market Positioning

Coralite’s customer base is heavily weighted towards large, critical infrastructure providers, government agencies (approximately 70% of revenue), and the intelligence community, including the “Five Eyes” alliance. Unusually, Coralite initially focused on securing these large enterprises and government entities before expanding downmarket. Approximately 50% of customers were already aware of the open-source Zeek project, while the other half were new to the technology but attracted by its widespread adoption within the security community.

The Impact of AI & Automation

The rapid advancement of Artificial Intelligence (AI), particularly Large Language Models (LLMs) like GPT-3.5, Gemini, and Llama, is dramatically altering the cybersecurity landscape. Attackers are leveraging AI to accelerate vulnerability exploitation (reducing the time from vulnerability discovery to exploit from weeks to hours) and overcome skill gaps. This has led to a surge in automated attacks, with customers reporting tens of thousands of attack attempts within 72 hours of a patch release. However, defenders are also utilizing LLMs to automate security investigations, leveraging Coralite’s data to enhance their response capabilities. Coralite’s open-source foundation has proven advantageous, as LLMs have already been trained on extensive documentation and community discussions related to the technology. Customers are now automating responses to 95% of inbound threats with a 15-second Service Level Agreement (SLA).

The Human Factor & Ongoing Challenges

Despite technological advancements, the human element remains a significant vulnerability. Social engineering attacks, facilitated by AI-powered tools, are becoming increasingly sophisticated. Coralite emphasizes the importance of employee training and awareness to mitigate this risk. A common vulnerability across customers isn’t technical deficiencies, but rather the inherent fallibility of human users who click on malicious links. The IT industry’s release of vulnerable products also contributes to the challenge.

Hiring & Scaling: Lessons Learned

As Coralite has grown from a 30-person startup to a company exceeding $100 million in revenue, Brian Dy has adapted his leadership approach. He highlighted the importance of delegating effectively, a skill honed during his previous experience in larger organizations. He initially underestimated the challenges of parallel hiring for multiple executive roles, advising future prioritization and a more focused approach. He also emphasized the need to continuously refine hiring practices to identify candidates who can scale with the company and adapt to evolving needs. He noted a shift in the candidate pool and the importance of assessing cultural fit. He also emphasized the importance of creating career-defining opportunities for employees.

Future Outlook & Key Priorities

Looking ahead, Coralite aims to expand its impact by bringing the insights gained from securing elite organizations to a broader range of enterprises. The company remains committed to supporting its open-source community and fostering a culture of growth and opportunity for its employees. The ultimate goal is to empower defenders with the tools and intelligence they need to stay ahead of increasingly sophisticated and automated cyberattacks.

Notable Quotes:

• “Corlite helps defend the world's most critical networks by ensuring attackers have no place to hide.” – Brian Dy
• “It’s a bit like being in the Air Force and not being a pilot. Go to where the action is.” – Brian Dy (on joining a Silicon Valley startup)
• “The biggest organizational win they had was to get the provost of the colleges to treat cyber as a priority to everyone else.” – Brian Dy (on a university customer’s success)
• “I can raise more money. I can’t raise more time.” – Board member advice to Brian Dy.

Technical Terms:

• Zeek: The open-source network security monitoring framework upon which Coralite is built.
• Ransomware: A type of malware that encrypts a victim’s files and demands a ransom payment for their decryption.
• SLA (Service Level Agreement): A commitment by a service provider to deliver a certain level of service.
• MSSP (Managed Security Service Provider): A company that provides outsourced security services to other organizations.
• TAM (Total Addressable Market): The total market demand for a product or service.
• LLM (Large Language Model): A type of artificial intelligence model capable of understanding and generating human-like text.

Conclusion:

Coralite’s unique blend of open-source innovation, a focus on network visibility, and a commitment to community support positions it as a key player in the evolving cybersecurity landscape. The company’s ability to adapt to emerging threats, particularly those driven by AI, and its dedication to empowering both defenders and its own employees will be crucial to its continued success. The emphasis on automation and the importance of addressing the human factor highlight the multifaceted nature of modern cybersecurity challenges.