Corelight
- Company typePrivate
- Founded2017
- HeadquartersSan Francisco, United States
- Headcount251–500
- GTM typeB2B
- OfferingSoftware
What Corelight does
Corelight, Inc. is a private U.S. cybersecurity company founded in 2013 and headquartered in San Francisco, with regional offices in Vienna VA, London, Dubai, and Sydney supporting enterprise and government customers across four continents. The company develops and sells the Open NDR Platform, an evidence-based network detection and response (NDR) platform built on the open-source Zeek network security monitor and Suricata IDS. Corelight's sensor portfolio — including appliance, virtual, software, cloud, and flow form factors — transforms raw network packets into structured, AI-ready evidence consumed by the Corelight Investigator SaaS and a growing portfolio of analytics modules (encrypted traffic analysis, Smart PCAP forensics, YARA static analysis, threat intelligence, and the new Performance and Asset Visibility capability).
The platform is anchored by the founders' stewardship of Zeek and deep integration with the modern SOC stack: Splunk, CrowdStrike Falcon, Microsoft Sentinel/Defender, Elastic, and Google Cloud. In March 2026 Corelight launched Agentic Triage, an AI-driven workflow that autonomously consolidates clusters of related alerts into evidence-backed investigations and integrates with Microsoft Entra ID and CrowdStrike. Revenue is generated through a sales-led enterprise motion with quote-based multi-year contracts combining Corelight Investigator SaaS subscriptions, hardware/virtual sensor sales, professional services, and an emerging channel motion (Infinigate for UK&I). Total funding raised is approximately $309 million across rounds including a $150 million growth round in April 2024 led by Accel with Cisco Investments and the CrowdStrike Falcon Fund. The company has been named a Leader in 2025 by all four major NDR analyst reports — Gartner Magic Quadrant, Forrester Wave, GigaOm Radar, and QKS Group SPARK Matrix.
Corelight firmographics
Firmographics- Name
- Corelight
- Legal name
- Corelight, Inc.
- Website
- https://corelight.com
- Company type
- Private
- Founded year
- 2017
- Operating status
- Operating
- Headcount range
- 251–500 employees
- Ownership category
- akta.pro rank
Corelight industry classification
Industry- Product category
- Network Detection and Response (NDR)
- NAICS
- Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (518210), Information (51)
- SIC
- Computer Peripheral Equipment, Nec (3577)
- akta.pro primary industry
- Network Detection & Response (NDR) (HDADABAI)
- akta.pro secondary industries
- Extended Detection & Response (XDR) (HDADAEAB), OT Threat Detection & Monitoring (NDR/IDS for ICS) (HDADAJAF), Identity Threat Detection & Response (ITDR) (HDAEAJAH)
Keywords
Where Corelight is headquartered
LocationHeadquarters
- HQ city
- San Francisco
- HQ country
- United States
- HQ region
- North America
Offices5 records
Markets served
Corelight business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure, Supply Chain
Revenue model
- Corelight Investigator SaaS subscriptions: Recurring SaaS subscriptions for the cloud Investigator platform, typically tiered by data volume/throughput and number of sensors; primary recurring revenue line.
- Network sensor / appliance hardware sales: One-time and subscription-bundled hardware appliance sales (physical and virtual sensors) deployed on customer premises for traffic collection.
- Professional services and training: Deployment, integration, and training services to accelerate customer time-to-value and operationalize Corelight within their SOC.
- Channel / managed services via partners: Indirect revenue via channel partners such as Infinigate (UK&I) who deliver managed NDR services built on Corelight to regional enterprises and MSSPs.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Other | Multi-year contract | Quote-based enterprise pricing for Corelight NDR platform (sensors + Investigator SaaS) |
| Freemium | Pay-as-you-go | Free Polaris Program for students, researchers, and Defenders |
Go-to-market motion5 records
Distribution channels5 records
Marketing channels9 records
Corelight product offering
Product offeringCore offering
Corelight builds an evidence-based Network Detection and Response (NDR) platform that captures raw network packets via physical, virtual, cloud and software sensors, converts them into high-fidelity, AI-ready structured evidence using the open-source Zeek framework and Suricata IDS, and delivers that evidence through the Corelight Investigator SaaS layer with Agentic AI Triage for SOC investigation, threat hunting, and response across on-premises, cloud, and OT environments.
Product overview
Corelight offers a unified evidence-based Network Detection and Response (NDR) platform delivered as an integrated portfolio rather than a single monolithic product. The centerpiece is the Open NDR Platform, which is powered by Corelight Sensors (deployed as Appliances, Cloud, Software, Virtual, and Flow sensors managed via Fleet Manager) that transform raw network packets into high-fidelity, AI-ready evidence using the open-source Zeek framework and Suricata IDS. This evidence is enriched by modular capabilities including Analytics & Detections (mapped to MITRE ATT&CK), Threat Intelligence, Encrypted Traffic Analytics, YARA Static File Analysis, Smart PCAP forensics, and the new Performance and Asset Visibility module. Investigations and triage are delivered through Corelight Investigator, a SaaS analytics solution enhanced by the Agentic Triage AI-powered SOC capability that autonomously consolidates alerts and executes expert-authored playbooks. Corelight Labs (with the Polaris Program) supplies ongoing detection research, while Professional & Consulting Services and Training round out the customer-facing offerings.
Differentiator
Problem solved
Functional benefit
Brands
- Open NDR Platform: Corelight's primary network detection and response platform based on open-source Zeek.
- Corelight Investigator
- Corelight Sensor
- Corelight Labs
- Corelight DefeNDRs
Products and services
- Open NDR Platform Flagship enterprise network detection and response platform that fuses threat intelligence, machine learning, behavioral analytics, and expert-tuned signatures to transform network data into high-fidelity evidence for detection, triage, threat hunting, and response; sold to enterprise and government security buyers.
- Corelight Investigator SaaS analytics solution combining sensor evidence with the Agentic Triage AI workflow for evidence-backed triage, threat hunting, and investigation at scale with global hosting and a published SLA; sold to enterprise SOCs.
- Corelight Sensor Sensor product family (Appliance, Cloud, Software, Virtual, Flow form factors) that captures raw network packets, deduplicates and cleans traffic, applies threat intelligence and asset identification, performs deep protocol parsing via Zeek across 70+ data types, and emits structured evidence; sold to enterprise and government customers.
- Cloud Sensor Dedicated cloud sensor deployment for AWS (with GCP and Azure enrichment support) providing network detection and response inside cloud environments for east-west and ingress/egress visibility; sold to cloud-operating enterprises.
- Professional and Consulting Services Professional and consulting services that support customer deployment, configuration, and optimization of the Corelight Open NDR Platform; sold to enterprise and government buyers.
- Training Training programs for security practitioners covering operation of the Corelight Open NDR Platform, threat hunting, and evidence-based security workflows; sold to enterprise customers and partners.
Quantifiable outcome
- 98% reduction in false positives
- +4 more outcomes
Companies that use Corelight
Customer profileNamed customers6 records
Segments6 records
Ideal customer profiles5 records
Corelight technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Integration10 records
AI capability8 records
Feature6 records
Corelight partnerships and signals
Strategic signalPartnerships
Twelve partnerships are on record, tiered flagship regional channel partner, core integration, flagship technology alliance, flagship consortium, event-tier co-marketing, core technology alliance and foundational.
- Infinigateflagship regional channel partnerInfinigate signed as Corelight's distributor for the United Kingdom and Ireland, expanding reach into UK&I enterprises, MSSPs, and resellers.
- Microsoft (Azure AD / Microsoft Entra ID)core integrationCorelight integrates with Microsoft Azure AD / Entra ID to ingest identity logs and correlate identity events with network telemetry for unified threat detection across identity and network layers.
- CrowdStrikeflagship technology allianceTechnology alliance and integration partner. Corelight exports enriched Zeek logs to CrowdStrike Falcon LogScale and Next-Gen SIEM; jointly marketed at Black Hat Asia 2026 and other industry events. Also an integration partner for Corelight's AI Proving Grounds Consortium work.
- AI Proving Grounds Consortium (Dropzone AI, SCYTHE, SimSpace, Sondera)flagship consortiumConsortium of AI and security vendors (Dropzone AI, SCYTHE, SimSpace, Sondera) collaborating to validate and test AI-driven SOC capabilities integrated with Corelight's NDR data.
- Black Hat Asia 2026 security partners (Palo Alto Networks, Arista, Cisco, JAMF)event-tier co-marketingCo-marketing and booth collaboration at Black Hat Asia 2026 with Palo Alto Networks, Arista, Cisco, and JAMF as part of an integrated security partner showcase.
- Splunkflagship technology allianceTechnology alliance integrating Corelight's Zeek-based network telemetry with Splunk SIEM and Splunk Enterprise Security for threat detection, hunting, and forensics.
- Google Cloudflagship technology allianceTechnology alliance enabling Corelight deployments on Google Cloud and integration with Google Cloud's security analytics services for cloud-scale network detection and response.
- Microsoft (technology alliance)flagship technology allianceBroader technology alliance with Microsoft beyond Azure AD integration, encompassing Azure cloud, Sentinel SIEM, and Defender XDR integrations.
- Elasticcore technology allianceTechnology alliance integrating Corelight's Zeek network logs with the Elastic Stack (Elasticsearch, Kibana) for search-driven security analytics and threat hunting.
- Suricatacore integrationCorelight sensors integrate Suricata IDS signatures alongside Zeek protocol logs to combine signature-based detection with deep protocol visibility.
- Zeek / International Computer Science Institute (ICSI)foundationalCorelight is built on Zeek, the open-source network security monitor originally developed at Lawrence Berkeley National Laboratory / ICSI. Corelight maintains and contributes to Zeek via Corelight Labs.
- Humio (now CrowdStrike Falcon LogScale)core integrationCorelight's Zeek logs are forwarded and integrated with Humio (now CrowdStrike Falcon LogScale) for high-volume log analytics, particularly in the SUNBURST/SolarWinds investigation context.
Scale indicators11 records
Recent moves6 records
Expansion highlights7 records
Corelight competitors and assessment
Company assessmentDirect peers
- Vectra AI: Vectra AI is a direct NDR/AI-driven threat detection competitor using machine learning on network metadata to detect attacker behaviors, positioning closely against Corelight in enterprise SOC and MSSP channels.
- ExtraHop: ExtraHop is a direct NDR competitor offering the Reveal(x) platform for network detection and response, targeting similar enterprise security buyers with comparable evidence-driven analytics and cloud-delivered deployment models.
- Darktrace: Darktrace is a direct AI-driven NDR and self-learning threat detection competitor with global enterprise coverage; competes head-to-head with Corelight in evidence-based behavioral analytics and SOC automation.
Broad incumbents
- CrowdStrike: CrowdStrike is both a strategic investor (Falcon Fund) and a flagship technology alliance partner that competes at the XDR layer; its Falcon Next-Gen SIEM and Charlotte AI products overlap with Corelight's Investigator and Agentic Triage.
- Arista Networks (Awake Security): Arista Networks acquired Awake Security to offer NDR capabilities integrated with its networking portfolio, competing with Corelight in enterprise and federal accounts while also co-marketing at industry events.
- Palo Alto Networks (Cortex XDR): Palo Alto Networks is a broad incumbent with Cortex XDR and related network analytics offerings; competes with Corelight as part of a wider XDR/security platform portfolio and was a co-marketing partner at Black Hat Asia 2026.
- RSA Security (NetWitness Network): RSA's NetWitness Network offers NDR capabilities as part of a broader SIEM/security portfolio, competing with Corelight in regulated industries and federal accounts while sharing similar evidence-first positioning.
- NETSCOUT (Omnis Cyber Intelligence): NETSCOUT is a broad incumbent with Omnis Cyber Intelligence providing NDR and deep packet inspection for service providers and large enterprises, competing in similar telecom, federal, and financial-services accounts.
- Cisco (Secure Network Analytics / Stealthwatch): Cisco is both a strategic investor in Corelight and a broad incumbent offering its own NDR capability (Secure Network Analytics / Stealthwatch) as part of a wider networking and security portfolio; competes in large enterprise accounts while also partnering at the integration level.
Emerging players
- IronNet Cybersecurity: IronNet offers AI-driven NDR and collective defense capabilities aimed at federal and critical-infrastructure customers, providing partial overlap with Corelight's enterprise and government NDR positioning.
Market position
Strengths5 records
Weaknesses4 records
Competitive moat6 records
Key risks5 records
Key highlights7 records
Customer concentration
Corelight social profiles
Digital presenceCorelight compliance and trust
Trust signalCompliance2 records
Corelight financial estimates
Financial estimateRevenue estimate
Valuation estimate
Corelight leadership team
Management profileNumber of profiles
Profiles19 records
Corelight subsidiaries and ownership
Company hierarchySubsidiaries1 record
Corelight funding detail
Funding detailFunding overview
Funding rounds7 records
Investors16 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Corelight M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Corelight
What does Corelight do?
Corelight builds an evidence-based Network Detection and Response (NDR) platform that captures raw network packets via physical, virtual, cloud and software sensors, converts them into high-fidelity, AI-ready structured evidence using the open-source Zeek framework and Suricata IDS, and delivers that evidence through the Corelight Investigator SaaS layer with Agentic AI Triage for SOC investigation, threat hunting, and response across on-premises, cloud, and OT environments.
Is Corelight a public or private company?
Corelight is a private company. It is classified as venture growth investor backed and is currently operating.
When was Corelight founded?
Corelight was founded in 2017. It employs 251 to 500 people.
Where is Corelight based?
Corelight is headquartered in San Francisco, United States, in the North America region.
How does Corelight make money?
Four revenue lines are on record. Corelight Investigator SaaS subscriptions are the primary driver. The others are network sensor / appliance hardware sales, professional services and training and channel / managed services via partners.
Who are Corelight's main competitors?
Direct peers on record are Vectra AI, ExtraHop and Darktrace. Broad incumbents are CrowdStrike, Arista Networks (Awake Security), Palo Alto Networks (Cortex XDR), RSA Security (NetWitness Network), NETSCOUT (Omnis Cyber Intelligence) and Cisco (Secure Network Analytics / Stealthwatch). IronNet Cybersecurity is listed as an emerging player.
Does Corelight have an API?
No public API is recorded for Corelight.
What industry is Corelight in?
Corelight's product category is Network Detection and Response (NDR). Its primary akta.pro industry code is HDADABAI, Network Detection & Response (NDR), with a secondary code of HDADAEAB, Extended Detection & Response (XDR). Its NAICS code is 518210 and its SIC code is 3577.