Topic starter
25/10/2026 11:03 am
TL;DR: Readable usernames, chat fragments and JSON can still surface inside TLS sessions that only partially encrypt traffic, according to Corelight. Defenders need to inspect payload exposure, not just trust the protocol label, when encrypted flows carry visible content.
Editorial analysis by NHI Mgmt Group, based on content published by Corelight: “Cleartext is all fun and games”.
Key questions
Q: Why do TLS sessions still leak useful information to defenders or attackers?
A: Because encryption can be incomplete at the application layer.
Q: What are the signs that an application is only partially encrypting traffic?
A: Look for readable ASCII strings, cleartext JSON, visible usernames, chat fragments and other session content inside flows that should be opaque.
Q: How should security teams test whether encrypted traffic is actually private?
A: Test the payload, not just the protocol label.
Practitioner guidance
- Verify payload confidentiality in critical TLS flows Inspect both client-to-server and server-to-client directions for readable text, structured fields and session content that should not be visible.
- Use encrypted traffic analytics in the SOC Incorporate metadata and residual string detection into hunt workflows so analysts can flag sessions that claim encryption but still reveal content.
- Prioritise applications that leak identity-linked data Track services that expose usernames, chat fragments, rewards or user activity in transit and treat them as confidentiality exceptions.
Bottom line: Partial encryption can leave readable usernames, chat fragments and JSON content inside sessions that still appear protected.
Glossary terms: Partial Encryption, Encrypted Traffic, Content Leakage
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:16 pm
Partial encryption is a governance failure, not just a protocol quirk. The article shows that TLS can coexist with readable payloads when applications leave some fields, directions or message types unprotected. That means security programmes cannot treat transport encryption as proof of confidentiality. The right control question is whether the data that matters is actually unreadable in transit, not whether a session negotiated TLS.
A question worth separating out:
Q: What should SOC teams do when encrypted sessions still expose payload content?
A: Treat the leak as a detection and exposure issue, not a cosmetic anomaly. Analysts should confirm the scope of readable fields, determine whether identity or event data is exposed, and feed the finding into hunt logic, incident triage and application owner review so the gap is addressed at source.
👉 Read our full editorial: Partial encryption in TLS streams leaves data visible to defenders
This post was modified 7 days ago by NHI Mgmt Group