Corelight

• Zeek and Suricata, the engines under the platform, are open source, so a rival can ship the same foundation and compete on the appliances, management console, detection content and proprietary modules Corelight builds on top.
• Cisco Investments and the CrowdStrike Falcon Fund both backed the 2024 round, and Network World lists both parent companies among the larger vendors selling something similar, so a partner in one account can be the competitor in the next.
• The federal entry is an In Process listing on the FedRAMP Marketplace at Class C rather than a completed authorization, so an agency that requires an authorized cloud service has to wait for the process to finish.
• No reviewed independent source reports Corelight revenue, customer count or growth, so a buyer weighing the company's staying power is working from the company's own account.
• Corelight sensors sit out of band and export Zeek-format evidence into a customer's own platform, so a rival that emits the same evidence can compete for the sensor layer without displacing the tools around it.

Corelight sells to the security operations team that already runs endpoint and log tooling and still cannot see what crossed the network. Network World describes the platform in its own words as aiming at network detection weak spots including alert overload and tool sprawl, and reports Corelight's own account of three failures it targets: attacks that move slowly and quietly, alert volume analysts cannot work through, and a stack of separate monitoring products.

The scale of that pain is asserted rather than measured. Corelight leads with a 98 percent reduction in alerts and triage ten times faster, and both figures sit on its own pages. No reviewed source outside the company sizes the budget moving toward network detection or counts the teams that report the problem.

The category itself is not in question. Network World places Corelight against ExtraHop and Vectra as direct rivals and against Cisco, CrowdStrike and Microsoft as larger companies selling something similar. [s8, s1, s2]

The sensor is the product a customer installs. Corelight Sensors passively analyze traffic and log network activity, and ship as hardware appliances, virtual machines, cloud instances, flow collectors and software. The appliance line is documented model by model, down to traffic analysis speeds, monitoring interfaces, power draw and an operational mode described as out of band, fed by tap, span or packet broker. SiliconANGLE reports appliances that scan more than 100 gigabits per second.

The software layers sit on top of that evidence. Corelight Investigator is the cloud service that correlates detections into cases, maps them across more than 100 MITRE ATT&CK techniques, runs Agentic Triage through expert-written playbooks, and lets an analyst isolate a host from a validated case. Corelight Fleet Manager configures and updates the sensor estate, pushing Zeek packages, Suricata rulesets and YARA rules from one console. Smart PCAP is a subscription module that keeps only the packets a rule selects, with rules defined on address, port, protocol or Zeek and Suricata events, which is how the company extends how far back an investigator can pull packet evidence.

The June 2026 release widened what the same sensor produces. Help Net Security records passive asset classification of every device the moment it communicates, naming industrial control, operational technology, unmanaged endpoints and language-model endpoints, plus native network performance monitoring, both drawn from traffic the sensor already collects. [s24, s15, s16, s17, s13, s14]

Corelight competes on the same ground as the network detection specialists and lives alongside the platforms. Network World names ExtraHop and Vectra as direct rivals, and Cisco, CrowdStrike and Microsoft as larger companies selling something similar. The same article records that Cisco Investments and the CrowdStrike Falcon Fund both put money into the 2024 round, so two of those larger companies hold positions in the vendor they overlap with.

The differentiation Corelight argues is openness. Its engines are public projects, its evidence is exported in a format other tools consume, and its federal announcement puts the argument plainly: security teams keep control of their data, write their own detections and avoid vendor lock-in. That argument makes Corelight easier to place beside Splunk, CrowdStrike or Microsoft Defender than a product that wants to own the console.

The same openness lowers part of what a rival has to reproduce. Zeek and Suricata are available to anyone, so a competitor starts from the same public foundation and has to match the appliance line, the fleet console, the detection content and the work Corelight says it built itself for encrypted collections and packet capture. Corelight's own account claims the steward position on Zeek, which is standing in a community rather than an asset a rival is barred from using. [s8, s7, s21, s3, s1, s16]

Two customer names reach the record through an outside publication. Network World names Carrefour and Grand Canyon Education, and Corelight's homepage adds anonymized case studies from an energy company, a mortgage lender and a United States government agency.

The strongest independent traction signal is not a customer at all. TechTarget reports that Cisco provided domain-name and file analysis of data gathered from Corelight's network visibility tools at the Black Hat conference network, and that a Corelight senior director served as its security operations lead. Network World separately carries Corelight's claim that services teams at CrowdStrike and Mandiant use the product, which is the company's account rather than an outside one.

The product is built to interoperate with the platforms a buyer already owns. The homepage documents integration with Splunk Enterprise Security and Splunk SOAR, and Fleet Manager connects to CrowdStrike, Microsoft Defender, SentinelOne, Tenable and Axonius. What the reviewed record does not carry is any independent figure for revenue, customer count or growth, so the size of the business is only what Corelight states it is. [s8, s20, s7, s1, s16]

The founding story is unusually checkable because part of it is published research. Vern Paxson created the open-source project now called Zeek while at Lawrence Berkeley National Laboratory, and presented the original system's design at the 7th USENIX Security Symposium in 1998. Network World attributes the open-source work to him with co-founders Robin Sommer and Seth Hall, and Corelight lists Paxson as chief scientist and Sommer as an advisor and co-founder emeritus.

Corelight has a chief executive who is not a founder, and its co-founders hold the strategy and research roles. Network World records that chief executive Brian Dye came from product leadership at McAfee and information security leadership at Symantec. Corelight's own leadership page adds a federal chief technology officer who spent more than 33 years in the Department of Defense, a research lead from Palo Alto Networks, and a development chief from Exabeam.

What the independent record supports is a verifiable build and a publication, plus a chief executive with two large-vendor product histories. The honours the company lists for its founders, including professional society awards, appear on its own pages and nowhere else in the reviewed sources. [s10, s8, s4, s3, s13]

Corelight runs a published trust centre, and it routes the artifacts a buyer wants through a portal rather than a page. The site states that its offerings are independently audited and certified, and directs a reader to a self-service portal to view certifications and request audit reports. No certificate or report is named on the trust centre's public pages.

The federal position is a step in progress rather than a completed one. Corelight announced in June 2026 that the Open NDR Platform, including Investigator and Hosted Fleet Manager, is listed on the FedRAMP Marketplace as In Process at the Class C moderate level, which the announcement itself describes as active progress through the process.

Deployment choice is where the company puts its trust argument. Sensors can run on premises or air-gapped and feed evidence into a customer's own log platform, the cloud service is offered as an alternative rather than a requirement, and the federal announcement frames custom detections and stack integration as the customer keeping control of its data. [s5, s21, s25, s18]

Add analyzed competitors to compare them side by side with Corelight.

Corelight sells to organizations large enough to run a security operations team and to care what crossed the network. The company states that it serves large enterprises and government agencies in more than fifteen countries, and it maintains dedicated pages for energy, federal, financial services, healthcare and state, local and education buyers.

The independent record points at the same tier. Network World names Carrefour and Grand Canyon Education, and TechTarget places the tools inside the Black Hat conference network, an environment run by security practitioners. Corelight's own case studies add an energy company, a major mortgage lender and a United States government agency, most of them unnamed.

Nothing in the reviewed record points at the small end of the market. The reviewed pages carry no self-service tier and no published price, and the smallest published appliance, the AP 220, is described as suited to branch offices.

The differentiating engineering is the sensor rather than the analytics. Corelight Sensors passively analyze traffic and log network activity as hardware appliances, virtual machines, cloud instances, flow collectors and software, and the appliance line is published model by model with traffic analysis speeds, monitoring interfaces and an out-of-band operational mode fed by tap, span or packet broker. SiliconANGLE reports appliances scanning more than 100 gigabits per second.

The detection story is deliberately plural rather than single-model. Corelight describes fusing machine learning, behavioural analytics, curated signatures and threat intelligence into risk-ranked alerts, and Investigator maps detections across more than 100 MITRE ATT&CK techniques. The AI layer is built around auditability: Agentic Triage runs expert-written playbooks so the reasoning behind a verdict can be read back, and the federal announcement frames custom detections and open integration as the customer keeping control.

The June 2026 release turned the same traffic into an inventory. Help Net Security records passive classification of every device the moment it communicates, including industrial control, operational technology, unmanaged endpoints and language-model endpoints, alongside native network performance monitoring, all from data the sensor already collects.

The reviewed record names no private dataset under any of it. Zeek and Suricata are open source, the Corelight Labs mission is stated as producing monitoring content, and the company's own claim to proprietary work names technologies it built for encrypted collections and packet capture rather than a corpus it has accumulated.

The motion is enterprise sales with a channel and a partner ecosystem behind it. The site carries a partner programme with deal registration, a channel-partner path and a technology partner directory, and the reviewed pages show no self-service path: the contact page offers pricing or a quote and a demo request.

The product is built to interoperate with the platforms the buyer already owns. Corelight documents native integration with Splunk Enterprise Security and Splunk SOAR, and Fleet Manager connects to CrowdStrike, Microsoft Defender, SentinelOne, Tenable and Axonius. Cisco Investments and the CrowdStrike Falcon Fund both invested in the 2024 round, so two vendors in that ecosystem also hold positions in Corelight.

Proof of the motion working is thinner than the motion itself. Two customers are named by an outside publication, Corelight's own claim that services teams at CrowdStrike and Mandiant use the product reaches the record through Network World as the company's account, and no independent source in the reviewed set reports revenue, a customer count or a growth rate.

Corelight publishes no price. The contact page invites a buyer to ask for pricing or a quote, and no page in the reviewed set carries a rate card, a tier list or a starting figure.

The packaging is legible even where the price is not. The platform separates into sensor models differentiated by traffic-analysis capacity, with the appliance line published by traffic analysis speed. Smart PCAP is described as a subscription module purchased with Corelight Sensors, and Investigator is the software-as-a-service detection and investigation layer that runs on the sensors' evidence.

Deployment choice does the work a price list usually does. A customer can buy sensors only and feed evidence to its own log platform, buy the cloud service, or run a hybrid of the two, which lets the same product line address an air-gapped agency and a cloud-first enterprise without a separate offering.

A customer can run sensors on its own premises or take the cloud-delivered components, and its security team owns the decisions either way. Corelight offers professional services and training alongside the platform, and the reviewed record documents no managed detection service Corelight runs on a customer's behalf and no outcome it accepts accountability for.

Fleet operations are where the product invests. Fleet Manager configures, updates and monitors deployed sensors from one console, pushing Zeek packages, Suricata rulesets, Smart PCAP policies and YARA rules, with role-based access, health dashboards and an audit trail of configuration changes. Corelight claims quick-start templates that cut policy creation time by up to 80 percent, which is the company's own figure.

Investigator is where day-to-day analyst work happens. It consolidates the highest-priority entities every 24 hours, investigates the last seven days of host activity, and lets an analyst isolate a host or push a firewall policy change from a validated case, which keeps the response step inside the same interface as the evidence.

Corelight publishes a trust centre and gates the artifacts behind it. The page states that its offerings are independently audited and certified, and directs a reader to a self-service portal to view certifications and request audit reports. No certificate or report is named on the trust centre's public pages.

The federal credential is in progress. Corelight announced in June 2026 that the Open NDR Platform, including Investigator and Hosted Fleet Manager, is listed on the FedRAMP Marketplace as In Process at the Class C moderate level, and the announcement itself describes that as active progress through the process rather than a completed authorization.

Data control is the trust argument the company actually leads with. Sensors can run on premises or air-gapped and export evidence into a customer's own platform, the announcement frames the openness as customers keeping control of their data and avoiding vendor lock-in, and the cloud service is an option rather than a precondition.

Corelight supplies evidence to other consoles and runs one of its own. Its evidence lands in Splunk Enterprise Security and Splunk SOAR through native integration, and Fleet Manager's connector framework reaches CrowdStrike, Microsoft Defender, SentinelOne, Tenable and Axonius, ingesting threat intelligence over STIX and TAXII 2.1 or any HTTP endpoint.

The open-source foundation is the ecosystem's other half. Zeek and Suricata are public projects and Corelight describes itself as Zeek's steward. The design of the original system was published at the 7th USENIX Security Symposium in 1998. Corelight says its unified, standard Zeek log format simplifies investigations and integrations with the tools a customer already runs.

That position cuts both ways. TechTarget records Cisco performing domain-name and file analysis on data gathered from Corelight's tools at the Black Hat conference network, which shows the interoperability working in public. It also puts a larger platform above Corelight's evidence, which is the screen Corelight Investigator competes for.

The founding claim rests on published research rather than on the company's own account alone. Vern Paxson created the open-source project now called Zeek while at Lawrence Berkeley National Laboratory, and presented the original system's design at the 7th USENIX Security Symposium in 1998. Network World attributes the open-source work to him with co-founders Robin Sommer and Seth Hall, and Corelight lists Paxson as chief scientist and Sommer as an advisor and co-founder emeritus.

Several operating leaders came from outside. Network World records that chief executive Brian Dye held product leadership at McAfee and information security leadership at Symantec. Corelight's leadership page adds a federal chief technology officer with more than 33 years in the Department of Defense, a Corelight Labs lead from Palo Alto Networks, and a development chief from Exabeam, and its newsroom shows a chief customer officer appointed in July 2026.

Research capacity sits in Corelight Labs, whose stated mission is content that enables detailed monitoring of enterprise network activity, staffed with security researchers and data scientists. The honours the company lists for its founders, including professional society awards, appear on its own pages and are not corroborated elsewhere in the reviewed sources.