Corelight provides open network detection and response (NDR) solutions that transform network and cloud activity into evidence security teams use to proactively hunt for threats, accelerate incident response, gain complete network visibility, and create analytics. The company serves global customers including Fortune 500 companies, major government agencies, and large universities. Led by CEO Brian Dye, Corelight plans to accelerate AI-driven security innovation, expand cloud-native security capabilities, and grow data fusion partnerships with cybersecurity platforms. Those initiatives aim to deliver enhanced capabilities for SOC analysts and incident response teams. Corelight raised $150M in Series E funding to support these product and partnership investments. Corelight is a San Francisco-based startup that provides an open network detection and response (NDR) platform built on the Zeek open-source framework. The company’s product is a network visibility solution that leverages Zeek, which has been widely deployed by thousands of organizations including U.S. government agencies, the Department of Energy, and major research universities. Corelight positions itself as a fast-growing NDR player at scale and competes with incumbents such as FireEye and McAfee/STG. The company plans to use new funding to accelerate its global market presence and to develop new data and cloud-based offerings. Corelight says it will invest in growth and product development to ensure its insights continue to lead the industry and are readily usable by customers of all types. The company was founded in 2013 by Dr. Vern Paxson, Robin Sommer and Seth Hall; Brian Dye is quoted as CEO. Corelight provides network traffic analysis (NTA) solutions that transform network traffic into rich logs, extracted files, and security insights to support incident response, threat hunting, and forensics. Its sensors run on Zeek (formerly Bro), the open-source network security monitoring tool, and Corelight Sensors simplify Zeek deployment while expanding performance and capabilities. The company’s solution is used in production by large public- and private-sector organizations, including Fortune 500 companies, major government agencies, and large research universities. Corelight was founded by Dr. Vern Paxson, Robin Sommer and Seth Hall and is led by CEO Greg Bell. The company recently secured additional capital and has raised a total of $84M to date. It plans to use new funds to accelerate product development, research, sales, and marketing to deliver new capabilities for network defense. Corelight provides enterprise-class network visibility solutions for cybersecurity built on the open-source Bro framework. Its product features include an intuitive management UI, native NIC shunting, sensor health metrics, and automated data export to Splunk, Elastic, Kafka, Syslog, S3, and more. The company recently launched the Corelight Virtual Sensor to enable pervasive monitoring across virtual infrastructure at speeds up to 2 Gbps and scalable across four reference configurations for VMware. Corelight plans to use the new funding to accelerate product development, research, sales, and marketing, expand internationally with increased investment in global sales infrastructure, and build additional strategic partner alliances. The company was founded by Dr. Vern Paxson, Dr. Robin Sommer and Seth Hall and is led by CEO Greg Bell. It is based in San Francisco, CA. Corelight produces the Corelight Sensor, a turn‑key enterprise network-visibility product that acts as a “flight data recorder” for networks to investigate and prevent ransomware and other threats. The sensor is built atop the Bro open-source framework originally developed by co‑founder Dr. Vern Paxson and is integrated with tools such as Splunk, Amazon S3 and Kafka. Paying customers include dozens of enterprises, among them six of the Fortune 100 and one of the largest private companies in the US. The appliance offers a comprehensive API, a high-performance FPGA-based network interface card, optimized file extraction and log filtering, and claims 3–4x higher data processing throughput compared to standard servers. Corelight commercializes the open-source project via turnkey solutions designed to reduce deployment time and complexity. The company said it will use its new funding to accelerate product feature development and invest in sales, marketing and engineering to meet market demand and to shift customer effort toward analysis, threat hunting and incident response.

Total raised

$309M

Funding rounds

5

Latest round

Series E

Latest activity

Apr 2024