Stamus Networks develops Clear NDR, an open-core network detection and response platform. Its Enterprise and Community editions turn network traffic into detection, investigation, and response evidence, with documented MCP interfaces that can supply network intelligence to AI security workflows.
Stamus Networks provides Clear NDR, a network detection and response platform built on Suricata. The platform is available in open-source Community and commercial Enterprise editions, using network telemetry, detections, evidence, and integrations to support security investigation and response workflows.
The company is privately held and lists Indianapolis, Indiana as its headquarters, with a Paris location. Its LinkedIn profile reports a company size of 11-50 employees and a 2014 founding year. Stamus announced a $6 million Series A financing in August 2023 led by First Analysis, with participation from existing and new investors.
Documented from public materials · these are the products the AMS scores
Clear NDR Enterprise
Shipping since 2024
Clear NDR Enterprise is the commercial edition formerly called Stamus Security Platform. It combines IDS, network security monitoring, and NDR functions, including multi-source threat detection, lateral-movement tracking, guided threat hunting, Declarations of Compromise, REST APIs, and webhooks for security-tool integration.
The May 2026 U42.2 release added four MCP tools, bringing the published total to 14, plus an Analyst Operations Console, advanced protocol analytics dashboards, and threat-hunting filter sets.
Clear NDR Community
Shipping since 2025
Clear NDR Community is the production-ready open-source edition and successor to SELKS. Version 1.0 became generally available in September 2025 with Debian ISO and containerized deployment options, Suricata 8, OpenSearch 2.0, threat-intelligence feed ingestion, configurable data retention, and investigation workflows.
Community 1.0 also includes Model Context Protocol interfaces intended to connect third-party AI applications with Clear NDR network data. The edition is released under the GPL-3.0-or-later license.
2024 - 2026 ·gold = a monetization move· grey = product or capital
Stamus announced Clear NDR as the successor to Stamus Security Platform and SELKS. The release introduced Enterprise and Community editions on a unified open-core architecture. Source
Clear NDR Community 1.0 reached general availability as a production-ready open-source NDR edition. Stamus documented expanded deployment options, Suricata 8, MCP integration, threat-intelligence ingestion, and investigation workflow changes. Source
Pricing not public. Public Stamus licensing documentation for its predecessor commercial NDR offering describes annual software licenses priced by the monitored data rate of each connected network probe, with 100 Mbps, 1 Gbps, 10 Gbps, and 40 Gbps increments. Multiple years may be purchased together.
That documentation says licenses include maintenance, support, and software updates. It also describes optional turnkey appliances and states that deployments of 40 Gbps or greater require Stamus appliances. The reviewed materials do not publish list prices, minimum commitments, renewal terms, or a discount schedule.
For managed security service providers, Stamus documents a usage-based option based on data analyzed by network probes. Clear NDR Community is the open-source tier. No separate public meter or price for MCP or AI-agent access was identified.
Analyst layer · placement follows the documented capability above
Independence: Medium. This is a provisional assessment. Clear NDR can supply evidence and telemetry to AI-driven security operations through MCP and other integrations, but the public record centers on analyst investigation, threat hunting, and security-team response. It does not establish broadly autonomous execution of network-defense decisions.
Job width: Medium. The documented workflow spans network detection, evidence collection, triage, investigation, hunting, and handoff to connected security systems. That constitutes an end-to-end workflow within the security-operations function rather than a single narrow task or a cross-functional operating process.
Output versus cost: Linear. Clear NDR documents automation-supporting interfaces, detections, prioritization, and investigation assets. However, the reviewed public record does not provide verified evidence that its AI or MCP capabilities deliver a 10x or greater output-to-cost change. The provisional assessment therefore remains Linear.
Monetization pattern. Stamus uses an open-core structure: Community provides an open-source entry point, while Enterprise is the commercial tier. The documented commercial meter is monitored network-probe throughput under annual licensing, with a separate usage-based option for managed security service providers based on analyzed data. Agent-facing MCP capabilities do not have a separately documented meter.
| Edition | AMS score | Metric on record | Change |
|---|---|---|---|
| Aug 2026 | M · M · Lin | Provisional AMS score | Baseline, first edition |
Future editions add a row whenever the score or the metric moves, with the evidence that moved it.
About this data
Everything on this page is a synthesis of public information: published reporting, vendor documentation, and procurement data that anyone can access. We link to those sources throughout. Nothing on this page draws on private or confidential information, and the positions are Monetizely's analysis of that public record, refreshed monthly.