Stellar Cyber

• Stellar Cyber's homepage counts over 15,000 customers and partners globally while its about page and customer stories page count over 15,000 customers across more than 50 countries, so a buyer reading the two cannot tell whether resellers sit inside that total, and no reviewed independent source counts them.
• The last funding round in the reviewed record closed in November 2021 and the 2026 money is borrowed, so a buyer weighing a multi-year platform commitment has no recent equity signal of the company's staying power and has to ask for current financials under diligence.
• KuppingerCole rates Stellar Cyber an Overall Leader in network detection while its own recognition page reports a Challenger placement in Gartner's 2025 network detection quadrant, so a buyer who shortlists from analyst grids meets two different readings of the same product.
• Stellar Cyber's value depends on reading endpoint tools it does not own, and it names CrowdStrike, SentinelOne and Microsoft Defender as those tools, so a buyer who consolidates onto any one of those suppliers has to be persuaded that a separate correlation layer still earns its budget line.
• Stellar Cyber tells managed providers to put the platform at the centre of their service offerings, so the end customers served through a provider relationship are reached through that provider, and one that changes platforms could move them with it.
• The security portal lists SOC 2, ISO/IEC 27001, TX-RAMP, DORA and CPSTIC Prod Med, records the TX-RAMP certification as provisional with Level 2 in progress, and puts the underlying reports behind an access request, so a buyer cannot read the evidence for those claims before contacting the company.

Stellar Cyber sells to security teams drowning in their own tooling. Its founding account describes analysts with too many consoles to monitor, too many alerts to respond to and too much manual correlation to spot complex attacks, and puts that problem in both medium-to-large enterprises and managed provider operations. The homepage states the same argument commercially: security stacks are bloated, noisy and expensive.

The buyer is named twice over, because the company sells to two of them. Enterprise material addresses leaders who want to amplify existing investments while speeding detection and response. Managed provider material addresses executives who want to deliver services without adding staff, and describes running security services for thousands of end customers on one multi-tenant license.

What the record does not carry is an independent measure of that pain. The independent coverage in the reviewed sources is the 2021 funding round, which reports the raise rather than testing the problem. Two analyst houses maintain a network detection category, which establishes that the category exists without sizing the consolidation problem Stellar Cyber sells against. [s3, s1, s4, s6, s13, s14, s17, s8]

Among the reviewed sources, the pricing page carries the most specific technical detail. It describes network detection that combines raw packet collection with firewall, log, NetFlow and IPFIX data from switches, containers, servers and public clouds, deep packet analysis across more than 4,000 applications, and L2 to L7 metadata extracted from traffic. Alongside it sit a malware sandbox that detonates suspicious files, machine-learning intrusion detection, user behavior analytics, file integrity monitoring and orchestration with hundreds of pre-built integrations.

Data collection is where the company puts its own engineering. Stellar Cyber says it invented a family of sensors that index security metadata at ingestion so any source can be normalised and enriched for correlation, and it offers those sensors to managed providers to pull raw network and log data from customer environments. Its threat intelligence platform aggregates commercial, open-source and government feeds and pushes the result to every deployment, on premises or in cloud.

The external check in the reviewed record is analyst assessment of the network detection product rather than open code. KuppingerCole's compass rates it an Overall Leader, and the company reports Gartner coverage in 2025 and 2026. Its own August 2026 release states that automated triage agreed with human analysts 99.7 percent of the time in customer trials, announced by the company rather than reported by anyone else, so the figure cannot be treated as independently validated. [s7, s3, s6, s17, s10, s8]

Stellar Cyber's whole argument is that the buyer keeps what they already bought. It tells buyers to bring their own endpoint tools, naming CrowdStrike, ESET, SentinelOne and Microsoft Defender, and sells unification across them rather than replacement of them. To managed providers it sharpens the same point commercially, arguing that a closed endpoint vendor will not manage a competitor's agent while Stellar Cyber will read both.

Stellar Cyber makes the dependence argument itself, telling providers that a closed endpoint vendor will not manage a rival's agent, which is a statement about how those vendors behave rather than about what they can build. The reviewed record does not document the correlation those endpoint vendors sell themselves, so the size of that pressure is not established here. The company's own recognition page argues the comparison directly, claiming the platform outperforms point tools from Darktrace and Vectra.

Analyst placement puts it among established network detection vendors. KuppingerCole rates Stellar Cyber an Overall Leader in network detection alongside Cisco, Darktrace, ExtraHop, Fortinet, Gurucul, IBM and Arista Networks. [s5, s6, s8, s17]

The named references carry job titles and employers rather than logos. A-dec, a dental equipment manufacturer in Newberg, Oregon, is quoted through an information security and privacy analyst describing visibility it had never had before. 5-hour ENERGY is quoted through its director of IT and CyFlare through its chief executive, and the homepage carries a chief information security officer at Sumitomo Chemical and the University of Zurich.

The provider channel is a prominent motion. Stellar Cyber names Solis Security, Blackswan, Deeptree and CyFlare as managed provider references, announced Brite, Inspira and M-Theory as its first Infinity delivery partners in July 2026, and its partner program was rated five stars in CRN's 2026 guide with a channel executive named a CRN Channel Chief.

Scale itself stays inside the company's own arithmetic. The homepage claims over 15,000 customers and partners globally while the about page and the customer stories page claim over 15,000 customers across more than 50 countries, so the two counts do not agree on whether resellers are inside the number. The one dated outside transaction is financing rather than traction: a lender funded $15.0 million on 1 April 2026 under a loan agreement worth up to $25 million. [s9, s1, s6, s10, s2, s18, s16]

The founding story is documented and in-domain. Stellar Cyber records that Aimei Wei founded the company in 2015 as chief technical officer, and describes the data-overload problem she saw working at Cisco and Nortel as the reason she built sensors that index metadata at ingestion. Changming Liu is listed as chief executive and co-founder, and both VentureBeat and SiliconANGLE identify him in that role in 2021.

The bench around them is named only by the company. Its leadership page lists a chief revenue officer, a senior vice president of engineering and a senior vice president of global sales engineering, and its news index records partner and recognition announcements through 2026. No reviewed independent source covers any of those individuals, so the bench beyond the founders remains vendor-described.

The pedigree claim is looser than the rest of the founder record. Stellar Cyber states that its founding team includes members who helped build NetScreen, Juniper, Fortinet, Barracuda Networks, Cisco, Gigamon, Lastline and A10 Networks, without attaching any individual to any of those companies, so a reader cannot check which claim belongs to whom. [s2, s3, s13, s14, s10]

Stellar Cyber publishes its security posture through a portal on a security subdomain, which lists six compliance regimes. Alongside SOC 2 and an ISO/IEC 27001 certified management system it lists GDPR, DORA, TX-RAMP and CPSTIC Prod Med, and it publishes a risk profile with a stated recovery time objective of 12 hours and a software bill of materials entry. The portal states that the TX-RAMP certification is provisional and that Level 2 is still in progress.

The documents themselves are gated. A data flow diagram, an OWASP test report, a penetration test report, a SOC 2 report and a vulnerability assessment report are all listed as available on request rather than on download, so a buyer sees the labels before contacting the company and the evidence only afterwards. The portal also states that the company is still working on its security compliance and will provide completed questionnaires on request.

The legal surface is ordinary and current. The privacy policy names Stellar Cyber Inc. as the entity and separates website data handling from the customer agreements that govern service data. The reviewed pages on Stellar Cyber's main website carry the same San Jose, California address in their footers. [s11, s12, s1, s2]

Add analyzed competitors to compare them side by side with Stellar Cyber.

Stellar Cyber runs two go-to-market segments around the same core platform. Enterprise material addresses leaders who want to unify defences and amplify existing investments, while managed provider material addresses executives who want to add services without adding staff. The platform page splits the same way, offering a security operations platform for enterprises and a multi-tenant version for providers running thousands of end customers on a single license.

The named accounts show what those segments look like in practice. On the enterprise side the record carries a dental equipment manufacturer in Oregon, a beverage company with global affiliates, and homepage testimonials from a chemicals group and a Swiss university. On the provider side it carries Solis Security, RSM US, Blackswan, Deeptree and CyFlare, plus Brite, Inspira and M-Theory named in July 2026 as its first delivery partners in the Infinity program.

The buyers are enterprises and managed providers, and the providers serve their own downstream customers on the platform. CyFlare describes its mission as making enterprise-grade tooling available to managed service providers and small-business IT professionals, so the small businesses in that motion are the provider's customers rather than Stellar Cyber's buyers. On the direct side, the security portal names Boise State University and Blackswan Cybersecurity among organisations that reviewed the company, so a buyer sizing the platform against its own governance requirements is evaluating software built to serve both an enterprise deployment and a provider's multi-tenant service.

The technical claim is breadth of ingestion followed by correlation. Stellar Cyber describes network detection that pairs raw packet collection with firewall, log, NetFlow and IPFIX data from switches, containers, servers and public clouds, deep packet analysis across more than 4,000 applications, and L2 to L7 metadata drawn from traffic. Around it sit a malware sandbox, machine-learning intrusion detection, user behavior analytics and file integrity monitoring.

Sensors are where the company claims its own invention. It says it built a family of sensors that index security metadata at ingestion so any source can be normalised and enriched before correlation, and it offers those sensors to managed providers to collect raw network and log data that a customer's existing stack does not see. Its threat intelligence platform aggregates commercial, open-source and government feeds and distributes the result to every deployment, whether on premises or in cloud.

The platform uses AI to defend conventional systems, data and identities. The company markets Multi-Layer AI as detection, correlation and response working together, and claims a patented Kill Chain Loop. Its August 2026 release states that automated triage agreed with human analysts 99.7 percent of the time in customer trials. The reviewed record carries the company's announcement of that result rather than the evaluation behind it, so the 99.7 percent figure cannot independently establish efficacy, and KuppingerCole's Overall Leader rating is the one assessment in the reviewed record that comes from outside the company.

The motion is sales-led with a channel underneath it. The public pages route a prospective buyer to a quote request rather than a sign-up. Stellar Cyber says CRN recognised its partner program as five-star in the 2026 CRN Partner Program Guide, a recognition the reviewed record carries as the company's own announcement.

Providers are more than a distribution channel here, they are a product argument. Stellar Cyber tells managed providers to make the platform the centre of their security offerings, and sells them multi-tenancy, per-customer data separation and the ability to build differentiated services on top. That makes each provider relationship potential access to many end customers at once, and the record does not document the contracting or churn mechanics behind those relationships, so revenue concentration through providers cannot be sized from this record.

Public demand-generation activity is event demonstrations and promotion of analyst placements. The news index for 2026 records a Black Hat demonstration with a delivery partner, an EMA top-three placement, inclusion in a Gartner network detection quadrant and a channel executive named a CRN Channel Chief for a second year, and the recognition page adds a Global InfoSec award. No reviewed independent source verifies revenue, growth or customer count, so a buyer sizing the company against a rival has only the company's own numbers to work from.

The packaging decision is the pricing story. Stellar Cyber states that every Open XDR customer gets every capability in the platform under a single license, framed as removing trade-off decisions between security capabilities, and the pricing page advertises predictable pricing. For a buyer used to per-module security suites, that is a real difference in how a renewal conversation goes.

The reviewed pages publish no number. The pricing page routes the reader to a quote request, so a buyer cannot estimate cost before contacting sales, and the reviewed record contains no price, no packaging tier and no unit of sale.

The provider side implies a unit even where the public pages do not name one. Managed providers are told they can serve thousands of end customers on a single license platform, which needs a defined basis for counting, and the company offers proprietary sensors for collection alongside the software. A buyer comparing this against a per-seat or per-gigabyte competitor has to get that basis from a sales conversation.

The customer operates the product. Stellar Cyber's enablement team describes its goal as getting a customer's team fully operational and self-sufficient in running the platform. The managed services in the reviewed material are delivered by provider partners, and the record documents no managed service run by Stellar Cyber itself.

Deployment shape is a deliberate part of the offer. The homepage states the platform is purpose-built for on-premises and cloud, the threat intelligence platform pushes updates to deployments in both, and sensors collect from switches, containers, servers and public clouds. That range matters for the operational-technology and government accounts the company markets to.

Multi-tenancy is the operational load-bearing piece for the provider business. Stellar Cyber promises no commingling of customer data while letting one analyst serve several customers on the same platform. The reviewed sources describe the guarantee without documenting how it is enforced or independently tested, so a provider whose own contracts turn on data separation has to test that claim during evaluation rather than read it off the record.

Stellar Cyber publishes its security posture through a portal at a security subdomain. It lists SOC 2, an ISO/IEC 27001 certified management system, GDPR, DORA, TX-RAMP and CPSTIC Prod Med, and it publishes a risk profile with a stated recovery time objective of 12 hours, and a software bill of materials entry. It also states that the TX-RAMP certification is provisional, with Level 2 still in progress.

The evidence behind the labels is gated. A data flow diagram, an OWASP test report, a penetration test report, a SOC 2 report and a vulnerability assessment report are all listed as available on request, so a buyer reads the claims first and the documents only after making contact. The portal also states plainly that the company is still working on its security compliance and can provide completed questionnaires on request.

The legal surface is current. The privacy policy names Stellar Cyber Inc., covers the websites, and separates that handling from the customer agreements that govern data processed in delivering the service. The reviewed pages on Stellar Cyber's main website carry the same San Jose address in their footers.

Openness is the ecosystem strategy and the sales argument at once. Stellar Cyber tells buyers to bring their own endpoint tools, naming CrowdStrike, ESET, SentinelOne and Microsoft Defender, and describes hundreds of pre-built integrations across security, IT, operational technology and productivity products. To providers it makes the commercial version of the point: a closed endpoint vendor will not manage a competitor's agent, and this platform will read both.

Stellar Cyber's own argument is that a closed endpoint vendor will not manage a rival's agent, which is a claim about those vendors' commercial choices rather than about their engineering. What the reviewed record does not document is the correlation each of them sells inside its own stack. The company argues the comparison directly, claiming on its own recognition page that the platform outperforms point tools from named rivals.

The platform extends outward through partners rather than through a developer ecosystem. Stellar Cyber named Brite, Inspira and M-Theory as its first Infinity delivery partners in July 2026, and the reviewed record shows no third-party application built on top of the platform that depends on it to run, so no developer ecosystem adds switching friction beyond the provider integrations.

The founder record is documented and squarely in-domain. Stellar Cyber states that Aimei Wei founded the company in 2015 as chief technical officer, and traces the product idea to the data-overload problem she saw at Cisco and Nortel. Changming Liu appears as chief executive and co-founder, identified in that role by VentureBeat and SiliconANGLE in 2021 and by ABF Journal in 2026.

Below the founders the company names its own executives, covering revenue, engineering and global sales engineering among other functions, and its news index records channel recognition through 2026. No reviewed independent source covers any of those individuals or their prior work, so the bench beyond the founders remains vendor-described.

One claim is looser than the rest. The leadership page states that the founding team includes members who helped build NetScreen, Juniper, Fortinet, Barracuda Networks, Cisco, Gigamon, Lastline and A10 Networks, attaching no individual to any of those companies. A reader cannot check which person carries which credential, so the pedigree lands as an assertion in a record that is otherwise specific.