What Lancope does

Lancope was a network visibility and security analytics company founded in 2000 in Atlanta, Georgia, that developed the Stealthwatch platform for continuous monitoring of network and cloud traffic. Its core technology applies machine learning and behavioral modeling to network telemetry to detect hidden threats, insider threats, policy violations, and unknown malware, and to analyze encrypted traffic without decryption. The product is positioned for large enterprise organizations with complex network environments and is sold through an enterprise field-sales motion.

The company was acquired by Cisco Systems, Inc. in 2015, and the Stealthwatch product was subsequently rebranded as Cisco Secure Network Analytics in 2022 as part of Cisco's integrated security strategy. Today the platform is sold as part of Cisco's broader security portfolio, integrating with Cisco Identity Services Engine (ISE) for segmentation policy enforcement, Cisco XDR for extended detection and response workflows, and Splunk for joint visibility and analytics. Licensing is delivered through the Cisco Security Enterprise Agreement on a subscription basis, with quote-based enterprise pricing and no publicly disclosed list prices.

Lancope last raised approximately $24.6 million across four venture rounds between 2002 and 2006, from Canaan Partners, Council Capital, GMG Capital Partners, and H.I.G. Capital, with Canaan Partners leading the 2004 round. Since the 2015 acquisition, the company has operated as a wholly-owned subsidiary within Cisco's security business unit; the Lancope legal entity no longer operates as an independent commercial enterprise, and no standalone revenue, headcount trend, or current funding data is disclosed.

Name

Lancope

Legal name

Cisco Systems, Inc.

Website

https://lancope.com

Company type

Private

Founded year

2015

Operating status

Acquired

Headcount range

501–1,000 employees

Short description

Lancope developed the Stealthwatch network security analytics platform using machine learning and behavioral modeling to detect hidden threats in enterprise network and cloud traffic. Acquired by Cisco in 2015 and rebranded as Cisco Secure Network Analytics in 2022.

Ownership category

akta.pro rank

Product category

Network Security Analytics

NAICS

Security Systems Services (except Locksmiths) (561621), All Other Telecommunications (517810)

SIC

Communications Services, Nec (4899), Services-Computer Integrated Systems Design (7373)

akta.pro primary industry

Network Security Managed Services (Firewall/IDS/IPS/SASE) (BPAEADAG)

Keywords

• Network security analytics
• Threat detection platform
• Network traffic monitoring
• Behavioral analytics security
• Encrypted traffic analysis

Headquarters

HQ city

Atlanta

HQ country

United States

HQ region

North America

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure

Revenue model

1. Software Subscription: Security software sold through Cisco Security Enterprise Agreement, providing flexible licensing with one easy-to-manage agreement. Subscription-based model with enterprise licensing.

Pricing tiers

Go-to-market motion1 record

Distribution channels2 records

Marketing channels3 records

Core offering

Lancope, now operating as Cisco Secure Network Analytics (formerly Stealthwatch), delivers an enterprise network security analytics platform that uses machine learning and behavioral modeling to continuously monitor network and cloud traffic. The solution detects hidden threats, insider threats, policy violations, and anomalies in encrypted traffic in real time, providing high-fidelity contextual alerts without requiring additional endpoint agents.

Product overview

Cisco Secure Network Analytics is a unified network security platform that leverages machine learning and behavioral modeling to detect threats across network and cloud environments. The core product analyzes existing network data to identify threats that may have bypassed existing controls, providing real-time detection with high-fidelity alerts enriched with user, device, location, timestamp, and application context. The platform integrates with Cisco Identity Services Engine (ISE) for network segmentation and policy enforcement, Cisco XDR for extended detection and response workflows, and Splunk for enhanced visibility and advanced threat detection analytics.

Differentiator

Problem solved

Functional benefit

Brands

• Stealthwatch: Network threat detection and response solution that continuously monitors network and cloud traffic to identify hidden threats

Products and services

• Cisco Secure Network Analytics (formerly Lancope Stealthwatch) Enterprise network security analytics platform that continuously monitors network and cloud traffic using machine learning and behavioral modeling to detect hidden threats, insider threats, policy violations, and encrypted traffic anomalies in real time. Designed for large enterprise security operations teams needing agentless, network-level visibility across complex distributed environments.

Segments1 record

Ideal customer profiles1 record

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration3 records

AI capability3 records

Feature4 records

Partnerships

Three partnerships are on record, tiered core and flagship.

• Cisco Identity Services Engine (ISE)coreTechnology or IntegrationDeep product integration between Secure Network Analytics and Cisco ISE enables smarter network segmentation policies, custom alerts for unauthorized access detection, and compliance enforcement. Customers can define segmentation policies and create alerts directly through the integration.
• SplunkflagshipTechnology or IntegrationCisco Secure Network Analytics + Splunk delivers deep visibility, optimized data management, and advanced threat detection, transforming the network into a sensor for enhanced security. Joint solution combines network analytics with Splunk's security information and event management (SIEM) capabilities.
• Cisco XDRcoreTechnology or IntegrationIntegration with Cisco XDR (Extended Detection and Response) enables automated response actions and cross-product threat correlation. Secure Network Analytics provides network telemetry to the broader XDR platform for comprehensive threat detection and response.

Scale indicators1 record

Recent moves6 records

Expansion highlights4 records

Direct peers

• Vectra AI: AI-driven NDR platform focused on detecting attacker behaviors and attack progression across enterprise networks and cloud. Directly comparable to Lancope in using ML over network telemetry for threat detection.
• Arista Networks (Awake Security): Awake Security (now part of Arista) provides AI-driven NDR over enterprise network telemetry. Direct competitor to Lancope in ML-based network threat detection.
• ExtraHop: NDR and network performance vendor (Reveal(x)) that performs deep packet inspection and ML-based threat detection. Competes head-to-head with Secure Network Analytics for network-centric threat detection budgets.
• IronNet Cybersecurity: Enterprise NDR vendor applying behavioral analytics and collective defense across network traffic. Overlaps with Lancope's behavioral modeling for unknown threat detection.
• Corelight: Network detection and response provider built on open-source Zeek/Suricata, offering behavioral analytics over network sensor data. Highly comparable to Lancope's flow-based network analytics approach.
• Darktrace: UK-based NDR vendor using self-learning AI/behavioral modeling to detect threats across enterprise network traffic. Most direct competitor to Cisco Secure Network Analytics' Stealthwatch lineage in the network detection and response category.

Broad incumbents

• Splunk: SIEM and security analytics platform (now part of Cisco) that ingests network telemetry including from Secure Network Analytics; both collaborator and adjacent competitor for security operations analytics budgets.
• Palo Alto Networks (Cortex XDR / XSIAM): Large platform vendor delivering XDR and SIEM-adjacent analytics over network, endpoint, and cloud data; competes with Cisco Secure Network Analytics as part of broader platform consolidation deals.
• Rapid7: Security analytics and XDR/SIEM vendor (InsightIDR/XDR) offering network-based threat detection alongside endpoint and log analytics; competing platform for mid-market and enterprise SOC consolidation.
• CrowdStrike (Falcon Network Threat / XDR): Endpoint-led security platform with network detection/XDR modules; rivals Secure Network Analytics as enterprises evaluate single-vendor XDR stacks.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/LandCope
• Facebookfacebook.com/Lancope
• LinkedInlinkedin.com/company/lancope

Revenue estimate

Valuation estimate

Number of profiles

Funding overview

Funding rounds4 records

Investors4 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Lancope