Corelight

Corelight (operating under corelight.com, legally Corelight, Inc.) is the premier, enterprise-grade network detection and response (NDR) platform, cybersecurity telemetry pioneer, and open-source-to-enterprise orchestration powerhouse engineered to act as the definitive, high-velocity network threat hunting, incident response, and behavior analysis layer for global enterprises and defense organizations. Co-founded in 2013 by Dr. Vern Paxson, Robin Sommer, Seth Hall, and Dr. Gregory Bell—the original creators and maintainers of the revolutionary open-source Zeek (formerly Bro) network analysis framework—the company completely eliminates the severe systemic friction of modern security operations. It addresses the critical bottleneck where security operations centers (SOCs) struggle with high-volume, low-signal network alerts, massive data-storage costs for packet captures, and a lack of forensic clarity when reconstructing sophisticated, multi-stage cyberattacks. It achieves this by deploying a production-hardened network telemetry matrix. Moving far beyond traditional, passive signature-matching intrusion detection systems or basic packet sniffer utilities, Corelight natively unifies high-performance Zeek network logging, Suricata-driven intrusion detection alerts, advanced smart-pcap recording engines, and automated AI-driven alert enrichment workflows into a single high-availability developer and security operations platform. Highly integrated with industry leaders like CrowdStrike, SentinelOne, Microsoft Defender, and Splunk, the platform scales from physical network gateways to complex multi-cloud environments (AWS, Azure, Google Cloud). Highlighting its massive commercial validation and status as an elite NDR market leader, the high-growth enterprise has raised over $310 million in institutional venture capital. This is anchored by a monumental $150 million Series E financing round led by Accel alongside Cisco Investments and the CrowdStrike Falcon Fund, pushing the company valuation toward $1 billion. Under the hood, its technology core utilizes high-performance hardware and virtual sensors capable of digesting up to 100 Gbps of raw network traffic at the wire, real-time programmatic extraction of over 400 specialized network security data fields, and secure, low-overhead cloud integrations designed to deliver rich, contextual network evidence without degrading application latency. What sets Corelight apart is its uncompromising dedication to replacing fragmented, low-context alerts with absolute network visibility, open-source community integrity, and robust forensic evidence; by bridging the gap between low-level raw network packets and high-level, AI-accelerated SOC workflows, the platform remains the definitive cornerstone of modern algorithmic cybersecurity and global digital asset protection.