Stamus Networks

Stamus Networks is a provider of network-based threat detection and response systems and the creator of Clear NDR, a network detection and response (NDR) system built on Suricata, the open-source network security and intrusion detection engine. The company positions Clear NDR as a network intelligence layer for security operations centers, transforming network traffic from cloud and on-premise environments into threat detections, declarations of compromise and policy violations, attack timelines and supporting evidentiary artifacts. Detection combines signatures and indicator-of-compromise matching with machine learning, algorithmic detection and behavioral analytics, and the product is offered for cloud, on-premise and appliance deployments, with threat hunting and integration into SIEM and other security tooling.

The product line comprises Clear NDR Enterprise (formerly the Stamus Security Platform) and Clear NDR Community (formerly SELKS), a turnkey open-source Suricata-based IDS, network security monitoring and threat hunting distribution. Stamus Labs, the company's open-source and threat research group, maintains additional free projects including the Suricata Language Server, a Splunk app, GopherCAP for PCAP manipulation, Jupyter playbooks for Suricata, a lateral movement ruleset, Kibana dashboards, SEPTun, and the Open NRD newly-registered-domain threat intelligence feeds; open-source contributions are released under GPL v3.0-or-later. Stamus Labs also delivers daily threat intelligence and detection algorithm updates to Clear NDR Enterprise customers along with a weekly update email.

The company operates dual headquarters in Indianapolis, Indiana and Paris, France, and publishes a book ("The Security Analyst's Guide to Suricata"), a blog, webinars, the Stamus Spotlight newsletter and the Blue Team Diaries podcast.

Founding story

The company was founded by Éric Leblond and Peter Manev, both long-standing contributors to the Suricata open-source project; Leblond has worked on Suricata development since 2009 and was a member of the Netfilter Core Team, while Manev leads quality assurance for the Suricata project. Both serve on the board of directors and executive team of the Open Information Security Foundation (OISF), the governing body for Suricata.

Business model

Stamus Networks sells a commercial NDR product, Clear NDR Enterprise, to enterprise and public-sector security teams, deployable in the cloud, on-premise or as appliances, with associated support and customer solutions functions. A free, open-source edition (Clear NDR Community, formerly SELKS) and a portfolio of free Suricata tooling and threat intelligence feeds serve the broader community. Enterprise customers receive ongoing threat intelligence and detection algorithm updates from Stamus Labs.

Commercial licensing of Clear NDR Enterprise (pricing available on request via the company's "Get Pricing" and "How to buy" channels) alongside free open-source editions and tools.

Traction

Stated traction includes protection of over $10 trillion in assets for global financial institutions, Clear NDR Community (formerly SELKS) downloads exceeding 1,000 per month, ten consecutive years supporting NATO CCDCOE cyber defense exercises such as Locked Shields and Crossed Swords, a 4.7/5.0 user rating, and customer references from central banks, multinational government institutions, defense departments, MSSPs, a U.S. public school system and technology vendors. At the time of its 2023 Series A the company reported having trained hundreds of Suricata users over the preceding 18 months.

Latest developments

In September 2025 Stamus announced production-ready Clear NDR Community 1.0 and an expanded go-to-market partnership with SentinelOne; in October 2025 it released Clear NDR Enterprise U42 with AI integration and behavioral analytics; in November 2025 it participated in NATO CCDCOE's Crossed Swords 2025 exercise. In March 2026 it appointed Mark Firmin CEO and Patrick Deane CFO and released Suricata Language Server 2.0 with AI-assisted signature development and CI support. In May 2026 it released Clear NDR U42.2 with additional MCP tools, a redesigned Analyst Operations Console and scalability improvements, and was cited among leading NDR vendors in Omdia's NDR market analysis. In June 2026 it marked its 10th year supporting NATO CCDCOE cyber defense exercises.