Corelight is a leading cybersecurity company specializing in open network detection and response (NDR) platforms, with a global reputation for technical depth, open-source leadership, rapid innovation, and strong company culture. Below is a detailed analysis:
Corelight was founded in 2013 by cybersecurity luminaries Dr. Vern Paxson, Dr. Robin Sommer, Seth Hall, and Dr. Gregory Bell, evolving from the renowned open-source Zeek (formerly Bro) network security monitoring framework at Lawrence Berkeley National Laboratory. Incorporated in 2016, Corelight's mission is to bring clarity and forensic-grade evidence to the core of network activity, supporting defenders in combating sophisticated cyber threats.
Corelight has raised over $309 million through multiple funding rounds, highlighted by a $150 million Series E (April 2024) led by Accel, with participation from Cisco Investments and CrowdStrike, achieving a reported valuation of $900 million. Key historical funding rounds:
Series A: $9.2M (2017, led by Accel).
Series B: $25M (2018, led by General Catalyst).
Series C: $50M (2019, led by Insight Partners, Accel).
Corelight provides a suite of NDR products leveraging Zeek and Suricata for deep packet analysis, evidence collection, and behavioral analytics. Key products and features include:
Open NDR Platform with on-prem, virtual, and cloud sensors.
Corelight Investigator: AI- and ML-powered alert triage, guided investigations using plain-language summaries, efficient correlated evidence, and integration with SIEM/SOC tools.
GenAI Accelerator Pack: MCP Server for natural language-driven SOC workflows, LLM promptbooks for automated investigations, and integration with major SIEMs.
Smart PCAP: Efficient packet capture at scale.
Multi-layered detection engines that combine expert-authored detections, AI/ML analytics, and proprietary behavioral models.
GenAI Accelerator Pack: Semantic access to network evidence and native SOC automation for LLM-powered environments.
Guided Triage in Investigator: Up to 50% faster threat triage, translating detailed logs into actionable insights for analysts.
Major SIEM log reduction: Up to 80% log volume savings without loss of detection fidelity.
Corelight is recognized for a highly mission-driven, collaborative, low-ego culture where technical excellence, open-source ethos, and employee well-being are prioritized. Employees describe Corelight as feeling like a “national lab or university” but with commercial agility; culture is driven by transparency, shared mission, organizational health, and ongoing professional growth.
Corelight serves hundreds of organizations globally, including many Fortune 500s, critical infrastructure operators, major financial institutions, universities, and government agencies. The company is steward for the Zeek open-source project, anchoring a vibrant community of defenders, researchers, and contributors focused on continuous improvement, knowledge-sharing, and evidence-based security operations.
