Snort

What Snort does

Snort is an open-source network intrusion detection and prevention system (IPS) created in 1998 by Martin Roesch and now owned and maintained by Cisco Systems, Inc. following Cisco's October 2013 acquisition of Sourcefire. The software performs real-time traffic analysis, packet logging, and content matching against a rule-based detection engine, and can be deployed as a packet sniffer, packet logger, or full inline IPS. The current generation — Snort 3 — uses Lua-based configuration, multi-threaded processing, and a plug-in architecture with 200+ extensions; legacy Snort 2 (final version 2.9.20) remains in long-term support. Threat detection content is delivered through a tiered ruleset model: a free Community Ruleset (GPLv2, daily updates), a free Registered Rule Set (30-day delay, available with snort.org registration), and a paid Snort Subscriber Ruleset developed and QAed by the Cisco Talos intelligence team and delivered in real time. Pricing for the subscriber ruleset starts at $29.99/year for personal accounts, with business pricing available on request; commercial use of the proprietary rules in products or services additionally requires a separate Snort Integrator License.

Snort serves a heterogeneous customer base spanning individual security enthusiasts and home-lab users, small and mid-market organizations, large enterprises (often indirectly via Cisco Secure Firewall / Firepower Threat Defense appliances that embed Snort), and commercial security vendors and MSSPs that bundle the engine or rules under the Integrator License. The product portfolio is complemented by OpenAppID for application-layer detection, the Talos LightSPD unified rules package, a Sample IP Block List, and SnortML — a TensorFlow-based LSTM machine learning engine introduced in 2024 for zero-day HTTP exploit detection. The go-to-market is hybrid: community-led growth through snort.org, GitHub, Docker Hub, mailing lists, Discord, blogs, and a $10,000 annual cybersecurity scholarship, paired with sales-led enterprise motion via the Cisco Partner channel using product code L-FP-VRT-1Y. Snort does not publicly report standalone revenue, and the business is not structured as a discrete revenue-reporting entity within Cisco; the project's value to Cisco is best understood as a threat-intelligence and ecosystem anchor for the broader Cisco Security portfolio rather than a standalone P&L.

Name

Snort

Legal name

Cisco Systems, Inc.

Website

https://snort.org

Company type

Private

Founded year

1998

Operating status

Operating

Headcount range

51–100 employees

Short description

Snort is an open-source network intrusion prevention system owned and maintained by Cisco, offering rule-based and ML-based (SnortML) real-time traffic analysis to enterprises, security vendors, MSSPs, and individual users via free engine downloads and a paid Talos-branded subscriber ruleset.

Ownership category

akta.pro rank

Product category

Network Intrusion Prevention System (IPS)

akta.pro primary industry

Next-Generation Firewalls (NGFW) (HDAFAFAA)

akta.pro secondary industry

Next-Gen Firewalls (NGFW) & UTM (HDADABAA)

Keywords

• Network intrusion prevention
• Intrusion detection system
• Open source security
• Threat detection rules
• Network security software

Headquarters

HQ city

Columbia

HQ country

United States

HQ region

North America

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Infrastructure, Marketing or Sales, Operations

Revenue model

1. Snort Subscriber Rule Set Subscription: Paid subscription providing real-time access to Talos-developed detection rules, 30 days ahead of registered users. Rules developed by Cisco Talos intelligence team. Subscribers receive fastest access to updates, same ruleset as Cisco customers, ability to submit false positives directly to Talos support.
2. Commercial Rule License: Separate commercial license agreement required for using rules in commercial products or for fee-based services. Sold through Cisco Partners with product code L-FP-VRT-1Y.
3. Snort Integrator License: Fee-based license enabling Snort Integrators to distribute Snort Subscriber Rule Set with commercial offerings. Contact [email protected] for pricing.
4. Community Ruleset: Freely available rules developed by the open source community and QAed by Cisco Talos. Governed by GPLv2. Included in subscriber downloads.

Pricing tiers

Go-to-market motion2 records

Distribution channels5 records

Marketing channels9 records

Core offering

Snort is an open-source network intrusion prevention system (IPS) that performs real-time traffic analysis and packet logging on IP networks using a rule-based detection engine. The software is freely distributed under GPL v2 and is available alongside tiered rulesets (free Community Ruleset, free Registered Rule Set, and paid Talos Subscriber Rule Set) for detecting exploits, zero-day threats, and anomalous traffic. Snort is deployed by enterprises, individual users, MSSPs, and OEMs, and is also sold under a commercial Snort Integrator License for bundling in third-party products.

Product overview

Snort is an open-source Network Intrusion Prevention System (IPS) developed by Cisco and maintained by the Snort community. The product portfolio centers on the Snort Core Engine (available as Snort 3, the current next-generation version with Lua configuration and 200+ plugins, and Snort 2, a legacy version still supported at 2.9.20). Rule-based threat detection is delivered through tiered rulesets: the free Community Ruleset (GPLv2, updated daily), the free Registered Rule Set (30-day delay from subscribers), and the commercial Snort Subscriber Rule Set (real-time access, developed by Cisco Talos). Additional products include OpenAppID for application-layer detection, the Talos LightSPD rules package for unified Snort 3 rule management, the Sample IP Block List, and SnortML - a machine learning-based exploit detection engine launched in 2024 that addresses zero-day threats using TensorFlow neural networks. The ecosystem includes community tools like PulledPork for automated rule management and Snort2Lua for configuration migration. Snort can be purchased for commercial use via the Snort Integrator License, and educational resources include webcasts, documentation, and an annual scholarship program.

Differentiator

Problem solved

Functional benefit

Brands

• Snort 3: The next generation of Snort Intrusion Prevention System featuring Lua-based configuration, multi-threaded processing, improved scalability, and 200+ plugins.
• Snort 2
• OpenAppID
• Talos Ruleset
• Community Ruleset

Products and services

• Snort 3 The next-generation Snort Intrusion Prevention System featuring enhanced performance, faster processing, improved network scalability, and over 200 plugins. Uses Lua-based configuration and replaces Snort 2.x configuration syntax.
• Snort 2 Legacy version of Snort Intrusion Detection System. Latest supported version is 2.9.20. Users are encouraged to upgrade to Snort 3 for improved features and ongoing support.
• Snort Subscriber Rule Set
• Community Ruleset Freely available ruleset developed by the Snort open source community and QAed by Cisco Talos. Governed by GNU GPL v2, updated daily, and accessible without registration.
• Registered Rule Set Free ruleset available to registered Snort.org users. Contains the community ruleset plus additional rules, but with a 30-day delay from the subscriber release.
• Talos LightSPD Rules Package A singular rules package that contains configurations for every version of Snort 3 and Shared Object rules for all supported versions and architectures, in addition to the latest versions of all rules. Recommended for ensuring compatibility across Snort 3 versions.
• Daemonlogger Libpcap-based packet logger and soft tap developed by Martin Roesch. Can sniff packets and spool to disk with 2GB file rollover, or rewrite packets to a second interface acting as a soft tap. Licensed under GPL v2 with Cisco clarifications.

Quantifiable outcome

• 5 million+ software downloads
• +3 more outcomes

Named customers1 record

Segments4 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration10 records

AI capability3 records

Feature9 records

Scale indicators6 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• Suricata: Open-source network IDS/IPS/NSM engine developed by the OISF foundation; directly competes with Snort on rule-based and protocol-aware network detection, and is positioned by many as the higher-performance alternative in the same deployment scenarios.
• Zeek (formerly Bro): Open-source network security monitor focused on rich semantic traffic analysis and behavioral logs; commonly deployed alongside or instead of Snort for network detection, sharing the same target users (SOC analysts, IDS operators).
• Corelight: Commercial vendor built on Zeek that delivers enterprise-grade network detection and response appliances and SaaS; competes for the same enterprise budget as Snort-based deployments, particularly where richer analytics are valued over pure signature matching.
• Security Onion: Linux distribution for IDS, NSM, and log management that bundles Snort, Suricata, Zeek, and Elastic Stack; a closely adjacent open-source platform that competes for the same SOC/network-security-monitoring buyer, where Snort is one of several engines it ships.

Broad incumbents

• Cisco Secure Firewall (Firepower / Firepower Threat Defense): Cisco's commercial NGFW product line that runs Snort under the hood for IPS/IDS; competes with Snort-as-standalone in enterprises that prefer an integrated appliance, and is the primary vehicle through which Cisco monetizes Snort technology.
• Palo Alto Networks Next-Generation Firewalls: Market-leading NGFW vendor with App-ID and Threat Prevention; competes with Snort-based IPS deployments in enterprise network security, offering an integrated alternative to standalone open-source IPS.
• Fortinet FortiGate: Broad incumbent NGFW/UTM vendor with integrated IPS, sandboxing, and SD-WAN; competes with Snort in mid-market and enterprise network security, often replacing or being evaluated against Snort in greenfield deployments.
• Check Point Quantum Security Gateway: Enterprise NGFW and threat prevention platform; competes with Snort-based IPS in enterprise perimeter and data-center deployments, often as part of broader Check Point Infinity architecture.

Emerging players

• Darktrace: AI-driven network detection and response vendor using unsupervised machine learning for anomaly-based threat detection; competes with Snort for the network detection budget, especially in enterprises prioritizing behavioral over signature-based detection.
• Vectra AI: Network detection and response platform using AI to surface attacker behaviors across cloud, SaaS, and on-prem networks; overlaps with Snort's use case in SOC workflows, particularly where ML-driven triage is preferred over ruleset management.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat6 records

Key risks6 records

Key highlights6 records

Customer concentration

• Xx.com/Snort
• GitHubgithub.com/snort3

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Snort