What CySight does

CySight is a privately held Israeli cybersecurity software vendor, founded in 2023 and headquartered in Ra'anana, that provides an AI-driven security observability platform built on NetFlow, IPFIX, and sFlow telemetry. The platform ingests flow data from routers, switches, firewalls, and cloud environments at over one million flows per second, retains full-fidelity records rather than sampling, and applies machine-learning-based behavioral baselining per asset to detect anomalies, lateral movement, ransomware behavior, and threats inside encrypted traffic without requiring packet decryption. The product is delivered as a core platform augmented by modular components including CySight Pulse for continuous AI baselining, NetFlow Auditor Threat Intelligence for ransomware and botnet correlation, NetFlow Anomaly Detection for DDoS and ML-based diagnostics, NetFlow Security for granular forensics, and Performance Analytics for traffic visibility.

CySight primarily targets large enterprises, alongside ISPs, MSSPs, and regulated verticals such as government, healthcare, and financial services. The company claims deployments across more than 50 Fortune 1000 organizations and major ISP/telco carriers, and is a Cisco Technology Development Partner with native interoperability across Cisco, Juniper, Palo Alto, AWS, Azure, GCP, and other vendors. Distribution is hybrid: direct enterprise field sales with sizing-based annual subscriptions (priced on IP addresses, flow exporters, and interfaces), a channel partner program for resellers and MSSPs, and a free 30-day self-service trial as a product-led growth entry point. Public positioning is anchored to the AI-NDR market category, which the company sizes at $2.97B in 2024 growing to $10.6B by 2030 at 23.7% CAGR.

Operating scale is small, with 11-50 employees, no disclosed revenue, no funding rounds in the input data, and an empty management roster. The combination of a small team, enterprise sales motion, multiple product modules, and a global Fortune 1000 customer claim suggests a company in early commercialization that is repackaging more than a decade of NetFlow product heritage into an AI-led security observability narrative.

Name

CySight

Legal name

CySight

Website

https://cysight.ai

Company type

Private

Founded year

2023

Operating status

Operating

Headcount range

1–10 employees

Short description

CySight is an Israel-based cybersecurity vendor that provides an AI-driven security observability platform using NetFlow, IPFIX, and sFlow analytics to detect threats inside encrypted traffic, serving Fortune 1000 enterprises, ISPs, MSSPs, and regulated verticals via direct enterprise sales and a partner channel.

Ownership category

akta.pro rank

Headquarters

HQ city

Ra'anana

HQ country

Israel

HQ region

Middle East

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Infrastructure, Marketing or Sales, Operations

Revenue model

1. Software Licensing/Subscription: Annual or multi-year software licensing model with subscription pricing based on infrastructure scale (IP addresses, flow devices, interfaces monitored). Tiered pricing accommodates organizations from small to enterprise-scale deployments.
2. Professional Services: Implementation, training, and support services. CySight's team of specialists have prepped, installed, and deployed over 1000 solutions including Fortune 1000 companies.
3. Usage-Based Sizing: Pricing scales with deployment size including number of IP addresses, flow exporters, and interfaces. Supports options from 1-100 to 10000+ IP addresses and 1-1000+ flow devices.

Pricing tiers

Go-to-market motion3 records

Distribution channels3 records

Marketing channels5 records

Core offering

CySight sells an AI-driven security observability platform that collects NetFlow, IPFIX, and sFlow telemetry to deliver continuous AI behavioral baselining, encrypted traffic analytics without packet decryption, lateral movement detection, and granular forensics. The platform is offered with annual subscription licensing sized to IP addresses, flow devices, and interfaces, with cloud, hybrid, air-gapped, and multi-tenant deployment options. Professional services cover implementation, training, and ongoing support.

Product overview

CySight is an AI-driven security observability platform delivered as a unified core product with modular components. The platform centers on CySight (core platform) combined with CySight Pulse for continuous AI baselining, and four specialized modules: NetFlow Auditor Threat Intelligence for ransomware/botnet detection, NetFlow Anomaly Detection for DDoS and ML diagnostics, NetFlow Security for granular forensics, and Performance Analytics for traffic visibility. Core capabilities include Encrypted Traffic Analytics and Deep Analytics features that work across the unified architecture to provide complete network visibility, threat detection, and forensic analysis without requiring packet decryption.

Differentiator

Problem solved

Functional benefit

Products and services

• CySight AI-Driven Security Observability Platform Unified AI-driven security observability platform that baselines every asset, retains full-fidelity evidence, and reconstructs operational risk across encrypted traffic and full communication paths without requiring packet decryption. Designed for large enterprise security and network operations teams, ISPs, MSSPs, and regulated organizations.
• CySight Pulse Continuous AI Baselining Continuous AI baselining module that heartbeats every network asset with full-fidelity accountability, applied across standalone or unified deployments to reveal risk, detect AI-driven threats, expose lateral movement, and uncover ransomware and encrypted traffic risk. Targeted at enterprise security and operations teams requiring ongoing behavioral baselining.
• NetFlow Auditor Threat Intelligence Threat intelligence module providing ransomware, botnet, and infection detection through threat feeds and correlation of NetFlow, IPFIX, and sFlow telemetry for advanced threat detection within the CySight platform.
• NetFlow Anomaly Detection Anomaly detection module using machine learning and AI diagnostics to identify DDoS activity, anomalous traffic, advanced persistent threats, and insider threats without requiring packet decryption, delivered through the CySight platform.
• NetFlow Security Granular Forensics Granular security forensics module within the CySight platform that addresses blind spots in encrypted traffic with scalable and flexible security monitoring and data mining for full forensic retention.
• Performance Analytics Performance analytics module within the CySight platform providing absolute network traffic visibility with application intelligence, QoS metrics, and bits-per-second measurements for network performance monitoring and capacity planning.
• Encrypted Traffic Analytics Standalone encrypted traffic analytics capability delivering granular insight into encrypted transactions without requiring packet decryption, available as part of the CySight platform offering.
• Deep Analytics Standalone deep analytics capability providing granular data mining and reporting from a small-footprint, big data architecture for complete forensics with high-granularity data retention.
• CySight Professional Services Professional services delivered by CySight specialists covering prep, installation, and deployment of the CySight platform at customer sites, including Fortune 1000 deployments, plus training and ongoing support.

Quantifiable outcome

• 20x to 40x visibility improvement
• +4 more outcomes

Named customers2 records

Segments6 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability6 records

Feature9 records

Partnerships

One partnership is on record.

• CiscocoreTechnology or IntegrationCySight is welcomed by Cisco as a Technology Development Partner. The partnership provides interoperability with Cisco devices including routers, switches, firewalls (ASA), wireless LAN controllers, Nexus switches, ASR routers, and medianet-enabled devices. CySight supports Cisco's NBAR (Network Based Application Recognition) and other Cisco-specific flow extensions.

Scale indicators7 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• Darktrace: Darktrace is a leading AI-driven cybersecurity company specializing in network threat detection and autonomous response. It directly competes with CySight in the AI-NDR space, serving similar enterprise and MSSP customers with AI-based anomaly detection across network traffic.
• ExtraHop: ExtraHop offers network detection and response through its Reveal(x) platform, combining packet-level visibility with machine learning-based threat detection. It competes with CySight in enterprise and government segments for AI-driven NDR and network forensics.
• Corelight: Corelight provides network detection and response built on open-source Zeek logs, combining packet-level telemetry with machine learning analytics. It competes with CySight in the network-based threat detection market, particularly for enterprises seeking rich telemetry and AI-driven threat detection.
• Vectra AI: Vectra AI provides AI-driven network detection and response focused on detecting cyber attackers in real time using behavioral analytics. It competes head-to-head with CySight in the enterprise NDR category, particularly around threat detection in encrypted traffic and lateral movement visibility.
• IronNet Cybersecurity: IronNet offers AI-driven network detection and collective defense for enterprises and critical infrastructure. It is comparable to CySight in targeting large enterprises with behavioral threat detection across network telemetry, though with a different go-to-market emphasis on collective defense.
• Plixer: Plixer provides NetFlow-based network analytics and security monitoring solutions for enterprises. It is a direct competitor to CySight in the NetFlow analytics and network performance/security monitoring category, serving similar IT and security operations teams.
• LiveAction (including FlowTraq): LiveAction provides network performance and security analytics with deep NetFlow/sFlow/IPFIX analysis capabilities. It competes with CySight in the unified network observability and security analytics market, particularly for enterprise IT operations and security teams.

Broad incumbents

• Cisco Secure Network Analytics (Stealthwatch): Cisco's Stealthwatch (now Secure Network Analytics) is an established NetFlow-based NDR platform that directly overlaps with CySight's core offering. As CySight's technology partner, Cisco is both a collaborator and a competitive incumbent across enterprise network security.
• Arista Networks (Awake Security): Arista acquired Awake Security to deliver AI-driven network detection and response as part of its broader networking portfolio. Awake is comparable to CySight in applying AI to encrypted traffic analysis and threat detection for enterprise networks.

Emerging players

• ManageEngine NetFlow Analyzer: ManageEngine's NetFlow Analyzer offers bandwidth monitoring and traffic analysis with security add-ons. While broader in IT management, it competes with CySight's NetFlow analytics capabilities in mid-market and enterprise network monitoring deployments.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks5 records

Key highlights7 records

Customer concentration

• Xx.com/CySight_ai
• LinkedInlinkedin.com/company/385874

Revenue estimate

Valuation estimate

Number of profiles

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about CySight