Corelight sells network detection and response sensors and analytics that turn network traffic into evidence, with an AI investigator that automates parts of alert triage and investigation for security operations teams.
Corelight builds network detection and response (NDR) technology based on open source Zeek, packaging network traffic analysis, encrypted traffic metadata, PCAP retrieval, and machine learning based detections into physical and virtual sensors and a cloud management layer. The company sells to enterprises, government agencies, and managed security service providers, and its data is widely used as an input to SIEM and SOAR platforms including Splunk, Microsoft Sentinel, and CrowdStrike.
Corelight is a privately held company headquartered in San Francisco. It has raised more than 300 million dollars in venture funding from investors including Crowdstrike, Accel, Insight Partners, and Energy Impact Partners, with a Series E round in 2022 valuing the company at over 720 million dollars according to reporting at the time. The company has not disclosed an IPO or acquisition as of the research cutoff.
Documented from public materials · these are the products the AMS scores
Corelight Sensors
Shipping since 2013
Physical, virtual, and cloud sensors built on Zeek that capture and analyze network traffic to generate structured logs, extracted files, and full packet capture. Sensors are deployed at network taps or cloud VPC mirrors and feed downstream SIEM, SOAR, and data lake systems.
Corelight Investigator
Shipping since 2021
A cloud-delivered analytics layer that applies detections, behavioral analytics, and threat intelligence to sensor data, producing prioritized entity-based alerts intended to reduce manual correlation work for SOC analysts.
Corelight AI Investigator
Corelight AI Investigator
A generative AI assistant built on large language models that automates parts of alert triage by summarizing detections, correlating related evidence, and drafting investigation narratives for analysts, as described in Corelight's public product materials.
2024 - 2026 ·gold = a monetization move· grey = product or capital
Corelight introduced AI-driven investigation capabilities intended to automate parts of alert triage and reduce analyst workload, as described in company product announcements.
CrowdStrike made a strategic investment in Corelight and the companies announced deeper technology integration between CrowdStrike Falcon and Corelight's network detection data.
Corelight does not publish list prices. Public procurement records and reseller quotes indicate pricing is structured primarily around sensor throughput capacity, typically licensed by bandwidth tier (for example gigabit thresholds for physical or virtual sensors), plus a separate subscription for cloud analytics such as Investigator, and additional fees for extended data retention and premium detection content packages.
Contracts are typically annual or multi-year subscriptions bundling sensor hardware or software licenses with software maintenance and cloud service access. Government and education pricing is available through resellers and cooperative purchasing vehicles, sometimes reflected in published state or federal procurement schedules.
Corelight has not published a distinct usage-based meter for its AI Investigator capability. Public materials describe AI-driven investigation as part of the Investigator product tier rather than as a separately metered add-on, so pricing not public for any standalone AI consumption unit.
Analyst layer · placement follows the documented capability above
Independence in Corelight's AI Investigator sits in the moderate range. The system drafts investigation summaries and correlates evidence, but documented capability shows analysts remain responsible for validating findings and taking response action, consistent with roughly 20 to 50 percent of the task being handled without human involvement.
Job width is narrow. The AI capability is scoped to alert triage and investigation summarization within the security operations function, rather than spanning multiple business functions or executing an end-to-end workflow such as automated containment or remediation.
On output versus cost, Corelight's own materials position the AI capability as a productivity aid that helps analysts process more alerts and evidence per hour rather than as a capability that replaces the underlying sensor and analytics product. This is consistent with an inflecting improvement in throughput for a given analyst headcount, not an order-of-magnitude structural cost change.
Corelight's documented monetization pattern remains anchored in sensor throughput licensing and cloud analytics subscriptions. There is no public evidence of a separate consumption-based meter, credit system, or outcome-based pricing tied specifically to AI Investigator usage as of the research cutoff.
| Edition | AMS score | Change | |
|---|---|---|---|
| Aug 2026 | M · S · Infl | Baseline, first edition |
Future editions add a row whenever the score or the metric moves, with the evidence that moved it.
About this data
Everything on this page is a synthesis of public information: published reporting, vendor documentation, and procurement data that anyone can access. We link to those sources throughout. Nothing on this page draws on private or confidential information, and the positions are Monetizely's analysis of that public record, refreshed monthly.