State of the space · AUG 2026
Network Defense Agents
Who is on this map
What this category does
- Monitor - watch traffic between on-premises and cloud systems continuously for behavioral change.
- Model - build a baseline of normal network behavior across users, devices, and workloads.
- Investigate - correlate related alerts into a single incident and reconstruct the attack path.
- Contain - trigger network controls such as host isolation or flow blocking to stop a confirmed threat.
The agentic shift
From flow analytics to automated investigation
Cisco's network detection line, rebranded from Stealthwatch to Secure Network Analytics in 2020, added machine-learning-based Cognitive Analytics on top of NetFlow-derived traffic analysis, moving the product from pure flow reporting toward behavioral scoring (Sources: cisco.com).
Darktrace shipped Cyber AI Analyst in 2019, automating the correlation and write-up steps that a human analyst previously performed by hand, and later folded that capability into its ActiveAI Security Platform (Sources: darktrace.com). Vectra AI rebranded its detection engine as Attack Signal Intelligence in 2022, prioritizing alerts by a modeled attacker-progression score instead of raw volume (Sources: vectra.ai). Corelight added AI-generated investigation summaries to its Investigator product in 2023, building on its long-standing Zeek-based open network detection and response engine (Sources: corelight.com). Fortinet's FortiNDR Cloud carries an AI detection engine positioned within the Fortinet Security Fabric, and Lumu automated parts of its Continuous Compromise Assessment workflow after its 2021 product update (Sources: fortinet.com, lumu.io).
Pricing across this roster still leans on infrastructure-shaped meters rather than flat per-seat fees, reflecting the fact that network detection cost scales with the traffic a customer wants monitored. Corelight and Fortinet FortiNDR both structure pricing around network bandwidth or throughput tiers tied to sensor placement, while Vectra and Cisco Secure Network Analytics price by covered node or device count within a subscription (Sources: corelight.com, fortinet.com, vectra.ai, cisco.com).
Darktrace and ExtraHop keep list pricing out of public view, directing prospective buyers to sales-led quotes, a pattern common among vendors selling into enterprise procurement cycles with custom deployment sizing; both list pricing as pricing not public on their public sites (Sources: darktrace.com, extrahop.com). Lumu and Netography, the two most recently funded emerging vendors, publish subscription tiers keyed to the number of log or telemetry sources ingested rather than raw bandwidth, a variation on the same consumption-based logic that dominates the established tier's bandwidth and sensor pricing.
Sources:category analysis,NDR comparison,Vendr
- Throughput-based tiers - Corelight and FortiNDR Cloud price against monitored network bandwidth.
- Node or device subscriptions - Vectra AI and Cisco Secure Network Analytics price by covered device or node count.
- Sales-quoted enterprise pricing - Darktrace and ExtraHop keep published pricing off their sites, listing pricing not public.
- Log-source subscriptions - Lumu and Netography price emerging-tier plans by the number of telemetry sources ingested.
This quarter
May - Aug 2026 ·gold = a monetization move· grey = product, market, or capital
Agentic platform
On July 27, Microsoft introduced Project Perception and said the agentic security system would enter public preview on August 3. It coordinates red, blue, and green agents using continuously updated security context and connects insights to actions across the digital estate. The launch positions shared security context as a core operating layer for agent-driven defense. pricing not public.
Source: Microsoft Project Perception announcement
Platform expansion
On August 3, Darktrace introduced the Behavioral Defense Platform, including the Darktrace / SECURE AI product and a platform portal spanning AI systems, people, identities, and infrastructure. Darktrace said its Adaptive AI continuously models behavior and can detect, triage, and respond autonomously when behavior diverges. The category's protection scope expanded from defending network activity to monitoring what enterprise AI agents do across connected systems. pricing not public.
Source: Darktrace Behavioral Defense Platform announcement
Packaging
On August 5, Vectra AI launched Vectra AI Pro as a new offering that correlates network, identity, cloud, SaaS, EDR, and SASE signals for AI agents and analysts. Customers can use it as a signal layer for their own agents through APIs and MCP, adopt Vectra-run agentic workflows, or use Vectra services to operationalize agents. This is a new commercial package for agent-ready signal intelligence, not simply an added detection feature. pricing not public.
Source: Vectra AI Pro launch announcement
High-speed telemetry
On August 25, ExtraHop announced a 400 Gbps sensor for RevealX and said it made the platform the first NDR product to analyze enterprise data-center traffic fully at that speed. The sensor ingests and analyzes traffic at line rate and provides an open, extensible real-time context substrate for the agentic SOC. At AI-data-center scale, full-fidelity network telemetry is becoming a product-level requirement for agents that must act on evidence quickly. pricing not public.
Source: ExtraHop 400 Gbps sensor announcement
Auditable agents
On September 15, Corelight released its Agent Builder Library and Natural Language Query capabilities, while adding AI threat detections for supply-chain compromise, anomalous AI activity, command-and-control, and exfiltration. Corelight said its deterministic playbooks and investigation logic can be exported to customer AI agents, SOAR workflows, and private LLM environments, including air-gapped deployments. The release makes network-forensics expertise portable into customer-controlled agents while preserving an auditable investigation trail. pricing not public.
The long arc
2019 to 2026: from flow-based alerting to AI-assisted investigation and containment
2021
NDR CAPITALIZATION
ExtraHop completed its acquisition by Bain Capital Private Equity and Crosspoint Capital Partners in July, saying the new backing would support threat research, detection capabilities, and customer services; it also described a CrowdStrike integration that paired network detection with automated device quarantine. NDR was becoming an investment-backed enterprise buying category with a direct path from network evidence to endpoint action. ExtraHop acquisition update
2022
AUTONOMOUS DATA PLATFORM
Palo Alto Networks introduced Cortex XSIAM in February as an autonomous platform built on widespread infrastructure telemetry, then made it generally available in October. The buying model shifted toward a broader security-operations platform that combined network data, analytics, and remediation, and Palo Alto Networks said XSIAM could reduce list cost versus legacy products. XSIAM launch XSIAM general availability
2024
FABRIC-LEVEL ENFORCEMENT
Cisco unveiled Hypershield in April 2024 with autonomous segmentation and distributed exploit protection, extending enforcement into servers, workloads, and network fabric. Security enforcement moved closer to where traffic and workloads operate, while monetization moved into composable subscription modules layered on existing hardware. Cisco Hypershield announcement Cisco Hypershield solution overview
2025
AGENTIC CONTEXT LAYER
Corelight put an MCP Server and investigation promptbooks into private preview for its GenAI Accelerator Pack, exposing network evidence to multiple LLM and SIEM environments. Google made Unified Security generally available with a shared security data fabric across networks, endpoints, clouds, and applications, plus an alert-triage agent in preview. Network evidence began functioning as an interoperable context layer for security agents and existing SOC tools. Corelight GenAI Accelerator Pack Google Unified Security announcement
2026
AUDITABLE AGENT DEFENSE
Corelight released Agentic Triage in March, Darktrace introduced its Behavioral Defense Platform in August, and Vectra launched Vectra AI Pro as a new offering for agent-ready signal intelligence. As of September 21, 2026, the category is competing on trusted cross-domain context, inspectable investigation logic, and autonomous response alongside core network detection. Product-level pricing and billing units for these new AI offerings were not publicly disclosed, so pricing not public. Corelight Agentic Triage Darktrace Behavioral Defense Platform Vectra AI Pro
Vendor by vendor
Journalist first, analyst second
Clear NDR Enterprise is the commercial edition formerly called Stamus Security Platform. It combines IDS, network security monitoring, and NDR functions, including multi-source threat detection, lateral-movement tracking, guided threat hunting, Declarations of Compromise, REST APIs, and webhooks for security-tool integration.
The May 2026 U42.2 release added four MCP tools, bringing the published total to 14, plus an Analyst Operations Console, advanced protocol analytics dashboards, and threat-hunting filter sets.
Pricing not public. Public Stamus licensing documentation for its predecessor commercial NDR offering describes annual software licenses priced by the monitored data rate of each connected network probe, with 100 Mbps, 1 Gbps, 10 Gbps, and 40 Gbps increments. Multiple years may be purchased together.
That documentation says licenses include maintenance, support, and software updates. It also describes optional turnkey appliances and states that deployments of 40 Gbps or greater require Stamus appliances. The reviewed materials do not publish list prices, minimum commitments, renewal terms, or a discount schedule.
For managed security service providers, Stamus documents a usage-based option based on data analyzed by network probes. Clear NDR Community is the open-source tier. No separate public meter or price for MCP or AI-agent access was identified.
Vectra Fusion is the renamed Netography Fusion platform. It orchestrates and enriches flow logs, DNS, and cloud telemetry across AWS, Azure, Google Cloud, SaaS, and on-premises environments without deploying sensors or endpoint agents. Public documentation also describes traffic-source setup for AWS VPC Flow Logs and response-integration APIs.
Public pricing is available through AWS Marketplace. The listed one-month Essentials Tier 1 offer is $11,000 per month for 1-10 sources, 45 days of retention, and a maximum of 2,500 FPS.
The Marketplace listing describes subscription entitlements for a specified quantity of use over the contract term. It lists one-, 12-, 24-, and 36-month contract options, with savings of up to 12%, 15%, and 17%, respectively, for the annual, two-year, and three-year terms.
The listing directs buyers seeking custom pricing, an EULA, or a private contract to contact the seller. No separate public meter for agents is documented in the reviewed materials.
ExeonTrace is Exeon's AI-based network detection and response platform. It ingests network metadata such as flow logs, DNS records, and proxy logs, and applies machine learning models to build behavioral baselines and flag anomalies indicative of malware, lateral movement, insider threats, and command-and-control activity. The platform is agentless, relying on existing network infrastructure such as switches, firewalls, and proxies for data rather than installing software on endpoints, which the company positions as suited to environments with legacy systems and operational technology (OT) that cannot run agents.
Exeon does not publish list pricing for ExeonTrace. Public materials describe the platform as sold on an annual subscription basis, with cost tied to the scale of the customer's network environment, such as the number of monitored devices, sites, or data volume, rather than a per-seat or per-analyst model. Enterprise deployments typically involve a sizing and scoping engagement before contract terms are finalized.
There is no public evidence of a separate metering mechanism for AI or automated detection features within ExeonTrace; the platform's machine learning capabilities appear bundled into the core subscription rather than billed as a distinct usage-based add-on. Pricing not public.
Network detection and response sensors that inspect traffic and metadata across an enterprise perimeter and internal segments, using deep session inspection to flag command and control activity, data exfiltration and lateral movement. Documented on the Fidelis Network product page.
Fidelis does not publish list prices for Fidelis Network, Fidelis Endpoint or Fidelis Elevate; pricing not public. Public procurement listings and vendor marketing indicate the platform is typically sold as an annual subscription or license tied to network sensor throughput and the number of protected endpoints, with modules such as deception and cloud posture management priced as add-ons to the core Elevate bundle.
Enterprise and government buyers generally negotiate multi-year contracts through Fidelis or its channel and managed security partners rather than purchasing off a public price list, consistent with common practice in the network detection and response category. There is no public evidence that Fidelis meters its agents separately by action volume, alert count or automated response events; pricing appears to be capacity and module based rather than usage based.
Scrutinizer is Plixer's flagship network traffic analytics product, collecting and analyzing NetFlow, IPFIX, and sFlow data to give network and security teams visibility into traffic patterns, bandwidth usage, and anomalous flows across on-premises and cloud environments.
Plixer does not publish list pricing for Scrutinizer, FlowPro Defender, or Plixer One on its public website. Historical Scrutinizer pricing has been reported by resellers and in procurement documents as based on flow volume or the number of monitored network devices and interfaces, with tiered licensing for larger deployments, but Plixer's own site directs prospective buyers to request a quote rather than publishing rates. Pricing not public.
Public evidence does not show a separate metered charge specifically for the machine learning or automated detection functions inside Plixer One. Based on available documentation, these capabilities appear to be bundled within the platform license rather than sold as a distinct usage-based add-on, though Plixer has not published packaging detail confirming this.
Arista NDR is the network detection and response platform derived from the Awake Security acquisition. Arista documents it as combining full packet capture and traffic analysis with an entity model that profiles devices, users and applications without requiring agents on endpoints. The vendor describes an AI component branded AVA that clusters related signals into what Arista calls situations, so that an analyst reviews grouped incident context rather than isolated alerts. Public product material describes hunting, forensic search over historical traffic, and integration with third party enforcement points. See the Arista NDR product page.
Pricing not public. Arista does not publish list pricing for Arista NDR, CloudVision or the Zero Trust Networking portfolio on its website, and the company's SEC filings do not disclose per-unit or per-subscription pricing for security software. Public procurement records and reseller catalogs list Arista hardware and software SKUs from time to time, but Arista itself has not released an official price book for the security line.
What is documented in Arista's filings is the shape of the model rather than the level. Arista sells hardware systems together with software subscriptions and post-contract support, and it describes subscription and services revenue as recognized ratably over the contract term. Software for the security and management layer is sold as a term subscription tied to the deployed estate, typically scoped by the devices, sites or capacity being monitored, and is booked alongside multi-year support agreements. Arista sells through a mix of direct sales and channel partners, so end customer discounting is negotiated and not disclosed.
There is no public evidence that Arista meters the AI components of its security stack separately. The AVA analysis engine inside Arista NDR is presented in product material as an included capability of the platform rather than as a consumption-priced add-on, and Arista has not published an agent, task, query or token based meter for it. On the public record, AI functionality is bundled into the subscription for the underlying product.
The core platform ingests DNS queries, network flow data, and logs to detect compromise indicators continuously rather than relying solely on point-in-time scans. It maps findings against the MITRE ATT&CK framework and provides a compromise level score intended to help security teams prioritize response.
Lumu does not publish pricing on its website, and no procurement or public filing data on pricing metrics was located as of the research cutoff. Industry commentary and Lumu's own marketing describe packaging tiers that reportedly scale with elements such as number of protected devices, data volume ingested, or number of network endpoints, but no verifiable figures or contract terms are publicly available to confirm this structure.
Pricing not public. Lumu's sales process is presented as consultative, requiring prospective customers to request a demo or quote directly, which is typical for mid-market and enterprise security vendors that negotiate contracts individually based on organization size and deployment scope.
There is no public evidence that Lumu separately meters or prices its Playbooks automation feature apart from the core platform subscription. No public information confirms whether automation actions carry usage-based or consumption-based pricing distinct from the base compromise assessment service.
The core platform ingests network, identity, and cloud metadata and applies the Attack Signal Intelligence machine learning engine to detect attacker behaviors such as lateral movement, command and control activity, and privilege escalation, then prioritizes alerts by risk score for SOC analysts.
Vectra AI does not publish list prices. Public procurement and reseller listings indicate the platform is sold primarily as an annual subscription, typically scoped by network bandwidth or by the number of hosts, workloads, and identities monitored, rather than by per-seat licensing. Packaging separates network detection, identity detection, and cloud detection as modules that can be purchased individually or combined within a single platform subscription.
Contracts are negotiated directly with Vectra AI or through channel partners and managed security service provider (MSSP) resellers, with multi-year terms common in enterprise and public sector deals based on publicly available procurement records. No evidence was found of a separate usage-based meter tied specifically to AI or machine learning processing; the detection engine is bundled into the core subscription rather than billed as a discrete add-on.
Pricing not public. No official price list, per-unit rate card, or standard discount schedule was located in company documentation as of the research cutoff.
Physical, virtual, and cloud sensors built on Zeek that capture and analyze network traffic to generate structured logs, extracted files, and full packet capture. Sensors are deployed at network taps or cloud VPC mirrors and feed downstream SIEM, SOAR, and data lake systems.
Corelight does not publish list prices. Public procurement records and reseller quotes indicate pricing is structured primarily around sensor throughput capacity, typically licensed by bandwidth tier (for example gigabit thresholds for physical or virtual sensors), plus a separate subscription for cloud analytics such as Investigator, and additional fees for extended data retention and premium detection content packages.
Contracts are typically annual or multi-year subscriptions bundling sensor hardware or software licenses with software maintenance and cloud service access. Government and education pricing is available through resellers and cooperative purchasing vehicles, sometimes reflected in published state or federal procurement schedules.
Corelight has not published a distinct usage-based meter for its AI Investigator capability. Public materials describe AI-driven investigation as part of the Investigator product tier rather than as a separately metered add-on, so pricing not public for any standalone AI consumption unit.
RevealX is ExtraHop's flagship network detection and response platform. It ingests network traffic, decrypts and analyzes it using machine learning models trained on network behavior, and surfaces threats such as ransomware activity, command-and-control traffic, and lateral movement. RevealX is available as a cloud-delivered SaaS product (RevealX 360) and as a self-managed on-premises deployment.
ExtraHop does not publish list pricing for RevealX or RevealX 360 on its website. Historically, and per third-party procurement and reseller listings, ExtraHop has priced its network detection and response products based on network traffic volume, typically measured in sustained Mbps or Gbps of monitored traffic, along with the number of sensors or deployment scale required to cover an organization's network segments.
Contracts are typically structured as annual or multi-year subscriptions, consistent with standard enterprise security software procurement, and sold through direct sales and channel partners. Public sector and government pricing is available through partners on cooperative purchasing vehicles, though specific unit pricing is not disclosed publicly.
Pricing not public. There is no evidence of a separate, distinctly metered charge for AI or machine learning detection capability; ML-based threat detection appears bundled into the core RevealX and RevealX 360 platform tiers rather than sold as a separate agent-based add-on.
Darktrace DETECT uses self-learning AI to establish patterns of normal activity and identify anomalous behavior across an organization's digital environment. Darktrace presents DETECT as a current platform product; a first-shipping date is not public.
Darktrace's FY 2024 annual report describes a subscription business. It states that customers generally commit to contracts of one to five years and are generally billed annually in advance.
Darktrace publicly identifies DETECT and RESPOND as separate products, but the reviewed public materials do not publish a rate card, a standard pricing metric, or mandatory package composition. Pricing not public.
No public discount schedule was identified in the reviewed materials. No reliable public evidence identifies a separate usage meter or standalone price for autonomous-response or agent-like capabilities.
Not covered
Past editions
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
About this data
Everything on this page is a synthesis of public information: published reporting, analyst coverage, vendor documentation, and procurement data that anyone can access. We link to those sources throughout. Nothing on this page draws on private or confidential information, and the positions are Monetizely's analysis of that public record, refreshed monthly.