Corelight
Corelight sells network detection boxes that watch traffic for security teams to catch attackers.
On the record
Checkpoint: Cisco's decision to acquire Corelight or build native Splunk NDR instead
The call
Corelight sits on hardware and integrations customers rely on daily, but the same companies investing in it, Cisco and CrowdStrike, are the ones most able to build around it.
Corelight makes software that watches data moving through computer networks to catch attacks, and it has deployed this at many government and enterprise customers. It is hard to copy because Corelight has years of data and specialized knowledge built into its sensors, plus deep connections to security platforms like Splunk. However, Cisco owns both Splunk and a stake in Corelight, CrowdStrike and Microsoft are both investors and could build their own network monitoring, and AI chatbots are starting to do the detective work that Corelight's analysis software does. The one thing that could change everything is whether Cisco buys Corelight outright or instead builds its own competing product using Splunk, which would turn Cisco from investor into rival.
Why
01
AI pressure: CrowdStrike Charlotte, Microsoft Security Copilot, Google/Mandiant SecOps AI. AI copilots automate alert triage and investigation writeups, squeezing the analysis layer Corelight sells on top of its sensor data. Could AI do the core job? Only partly.
02
Bigger players: Cisco (Splunk owner, investor) and CrowdStrike (investor, endpoint player). Both invested in Corelight but could instead bundle native network detection into their own platforms and stop needing a separate vendor. Could a giant copy it? Probably.
03
What protects it. Physical Zeek/Suricata sensors already wired into customer networks and SIEMs, plus military and Black Hat NOC deployments that are hard to rip out.
What would change this call
Cisco ships a native NDR product bundled into Splunk or its security stack. Would show Cisco choosing to build/bundle rather than partner, activating a top investor as a rival.
Corelight announces a Series F round or acquisition offer within the next year. Would show whether growth claims translate into continued independent funding or a buyout.
Next Gartner Magic Quadrant NDR cycle publishes and shows Corelight demoted or Vectra/Darktrace gaining ground. Would show whether analyst-validated leadership position is slipping to peer rivals.
Corelight announces a Series F round or acquisition offer within the next year. Would show whether growth claims translate into continued independent funding or a buyout.
Next Gartner Magic Quadrant NDR cycle publishes and shows Corelight demoted or Vectra/Darktrace gaining ground. Would show whether analyst-validated leadership position is slipping to peer rivals.
Key numbers
- $900M valuation after $150M Series E
- >40% YoY ARR growth claimed
- ~473-477 employees, up 16% YoY
Named risks
- Platform giants Cisco, CrowdStrike, Microsoft could bundle native NDR into existing security stacks.
- AI SOC copilots compressing value of alert-triage and investigation layer above raw sensor data.
- No new priced funding round disclosed since April 2024 Series E, over two years without a confirmed raise.
- Three-way contested Gartner Leader claims with Vectra AI and Darktrace dilute market differentiation.
- Public revenue estimates inconsistent with vendor-claimed growth rates, raising scrutiny risk pre-IPO.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| Vectra AI | contesting | Both claim Gartner MQ NDR Leader status in overlapping 2025/2026 cycles |
| Darktrace | contesting | Named Gartner MQ NDR Leader for second consecutive year, 2026-05-20 |
| Cisco | contesting | Strategic investor via Cisco Investments, but owns Splunk and could build native NDR |
| CrowdStrike | contesting | Investor and partner; integrated Charlotte AI with Corelight Investigator, March 2026 |
| Microsoft | gaining on | Security Copilot and Sentinel bundling pressures the alert-triage layer above sensors |
Questions people ask
- Is Corelight profitable in 2026?
- Corelight has not disclosed profitability. CEO Brian Dye said in June 2024 the company was targeting cash-flow positivity while sustaining over 40% annual growth, but no profitability figures have been published since.
- Who are Corelight's biggest competitors?
- Corelight's closest rivals in network detection and response are Vectra AI, Darktrace, ExtraHop, and NetWitness. As of May 2026 both Vectra AI and Darktrace also claim Gartner Magic Quadrant NDR Leader status, making the top tier a three-way contest.
- Could AI replace Corelight?
- Corelight's sensor-based network evidence collection (Zeek and Suricata parsing at the wire) is hard for AI to replicate, but the alert-triage and investigation layer above it is exactly where AI SOC copilots from CrowdStrike, Microsoft, and Google are advancing fastest, per its own March 2026 Agentic Triage launch.
- Is Corelight going public soon?
- Corelight has not confirmed an IPO. In May 2026 it added Hatem Naguib to its board and Tenable co-founder Jack Huffard as advisor, both with public-company backgrounds, and one aggregator speculated about IPO-prep hiring, but this is unconfirmed by primary reporting.
- Who owns Corelight?
- Corelight is privately held and venture-backed, with Series E funding of $150 million closed April 30, 2024, led by Accel and including strategic investors Cisco Investments and CrowdStrike Falcon Fund, at a post-money valuation of $900 million.
- Is Corelight losing customers to Cisco or CrowdStrike?
- No customer losses are reported. Cisco and CrowdStrike are both strategic investors and technology partners of Corelight, integrating rather than replacing it, as shown by the CrowdStrike Charlotte AI integration Corelight shipped in March 2026.
Timeline
- 2026-06-17Extended Open NDR platform with network performance monitoring and AI-service asset classification
- 2026-05-06Appointed Hatem Naguib to board and Tenable co-founder Jack Huffard as advisor
- 2026-03-18Launched Agentic Triage and CrowdStrike Charlotte AI integration in Corelight Investigator
- 2025-10-15Named a Leader in Forrester Wave for Network Analysis and Visibility Solutions Q4 2025
- 2025-07-31Launched GenAI Accelerator Pack with MCP server, tested at Black Hat NOC
- 2025-05-29Named a Leader in Gartner's inaugural Magic Quadrant for NDR
- 2024-04-30Closed $150M Series E led by Accel with Cisco Investments and CrowdStrike Falcon Fund
- 2021-10-13Acquired AI-security startup PatternEx
Revision history
21 July 2026
First assessed. Protection under test. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- Corelight Secures $150 Million in Series E Funding (2024-04-30)
- Cisco-Backed Corelight Receives $150 Million Investment (2024-04-29)
- Corelight Achieves 300% YoY Growth (2024-04-23)
- Corelight Gets $150M to Expand Detection, Improve Workflows (2024-06-25)
- Corelight - Overview, News & Similar companies (2026-06-06)
- Revenue, Competitors, Alternatives (2022-04-16)
- Corelight Extends Gen AI Leadership in NDR (2025-07-31)
- Corelight LinkedIn (2026-03-23)
- How many employees work at Corelight? (2025-12-01)
- Corelight - Headcount, Funding & Open Jobs (2026-06-11)
- Corelight Recognized as a Leader in the 2025 Gartner MQ for NDR (2025-05-29)
- Corelight Named a Leader in Network Analysis and Visibility Solutions, Q4 2025 (2025-10-15)