Corelight
Founded 2016 · 486 employees on LinkedIn · 11 known investors
Corelight provides network detection and response (NDR) software that uses agentic triage to automatically consolidate security alerts into entity-centric cases with evidence-backed investigation summaries. The platform combines network telemetry with AI-driven investigative workflows to help security teams reduce mean time to respond (MTTR) and close cases faster.
Also known as Corelight, Inc.
Founders & leadership
Corelight was founded in 2016 by Seth Hall.
Investors · 11
Also in the syndicate · 1
Funding
SEC filings, press & company announcements$150M disclosed across 1 round · 2024
- $150MSeries EApr 2024 · 2 sources
Accel (lead), Cisco Investments, CrowdStrike Falcon Fund
Source ↗
Source: company announcements and press reports — follow each round's link for the claim.
Company profile
researched Aug 2026Corelight develops a network detection and response (NDR) platform, marketed as the Open NDR Platform, that converts network traffic into structured evidence used for threat detection, investigation and threat hunting. The platform combines threat intelligence, machine learning, behavioral analytics and expert-tuned signatures in a multi-layered detection engine that produces risk-prioritized alerts enriched with context and AI-generated, evidence-backed summaries.
A central element of the current product positioning is what the company calls a "defensible AI SOC": agentic workflows that run on deterministic logic so that automated investigations remain auditable. Its Agentic Triage capability automatically consolidates alerts, correlates supporting evidence and executes expert-authored playbooks so analysts can reach documented conclusions without repeating manual steps. Additional capabilities highlighted by the company include performance and asset visibility, and network operations features introduced in Corelight Sensor v29.1.
Business model
Corelight sells an Open NDR software platform, deployed via sensors (including physical/virtual sensors and a Cloud Sensor for AWS) that generate network evidence and detections, and integrates with customers' existing security tooling such as SIEM, SOAR and endpoint platforms.
▸Full profile — market position, technology, go-to-market, geography
Market position
The company cites third-party analyst recognition in network detection and response, including Leader placement in the 2025 Forrester Wave, Leader and Outperformer status for NDR, and Leader placement in the SPARK Matrix for NDR from QKS Group.
Corelight positions its differentiation on high-fidelity network evidence combined with governed, deterministic agentic workflows that provide full auditability of automated investigations, alongside expert-authored detection and response playbooks and an open, integration-friendly architecture.
Technology
Sensors capture and transform network traffic into metadata and logs used as evidence; a multi-layered detection engine fuses threat intelligence, machine learning, behavioral analytics and expert-tuned signatures, while agentic triage automation consolidates alerts, correlates evidence and executes playbooks with deterministic, auditable logic. Data models support native Splunk CIM integration, and integrations extend to CrowdStrike Charlotte AI and Microsoft security products.
Go-to-market
Corelight markets through its website with demo requests, publishes technical blog content and analyst recognition, and relies on integrations and joint value propositions with ecosystem vendors including CrowdStrike, Splunk (Enterprise Security and SOAR), Microsoft (Defender, Sentinel, Entra ID) and AWS. Customer reviews are surfaced through Gartner Peer Insights.
Enterprise and public-sector security operations teams; reviewer profiles cited by the company span healthcare, manufacturing, government and IT security and risk management roles.
Geography
The platform includes a Cloud Sensor for Amazon Web Services environments in addition to on-network deployment.
Compiled by commissioned research from 1 cited public sources — announcements, filings, and press listed under research sources below.
Key figures
latest reportedCompany-reported or press-reported figures, each dated to when it was claimed — not independently audited.
Competitors · 10
by search overlap
Companies competing with Corelight for the same Google search keywords, organic and paid, via search-intersection analysis.
Timeline · 2
launches, deals, and filingsCorelight cites recognition as a Leader in the 2025 Forrester Wave, a Leader and Outperformer for NDR, and a Leader in the SPARK Matrix for NDR by QKS Group.
Corelight announced a new integration with CrowdStrike Charlotte AI, alongside blog announcements for Performance and Asset Visibility and network operations capabilities in Corelight Sensor v29.1.
Dated company events from announcements, filings, and press; legal rows summarize public dockets and regulator releases.
In the news
▸Research sources · 1
primary sources listed
- Corelightcorelight.com · web
1 public sources were cited for this profile; the first-party ones are listed here.
Frequently asked questions
- What does Corelight do?
- Corelight offers an open network detection and response platform that turns network traffic into evidence for AI-driven detection and triage.
- Who founded Corelight?
- Corelight was founded by Seth Hall in 2016.
- Who are Corelight's investors?
- Corelight's investors include Accel, Cisco Investments, Delta-v Capital, Energy Impact Partners, Flucas Ventures, H.I.G. Capital, H.I.G. Growth Partners, Insight Partners and 2 more.
- How much funding has Corelight raised?
- Corelight has disclosed $150M raised across 1 round.