Corelight raises $50 million to monitor networks for intruders

San Francisco-based Corelight, which provides network traffic analyst platform for cybersecurity, today announced that it’s secured $50 million in a series C funding round led by Insight Partners. The fresh capital brings the startup’s total fundraising to $84 million to date following a $25 million series B in September 2018 and a $9.2 million series A in July 2017, which CEO Greg Bell said will accelerate Corelight’s investments in product development, research, sales, and marketing.

“What makes our data first security approach so powerful is the global community behind it,” added Bell. “That community generously contributes new detections, parsers, and other capabilities for the benefit of all defenders. In addition to helping Corelight accelerate commercial progress, the new investment will enable us to engage and serve our community at a higher level. Belief in this joint vision is a key driver for the partnership with Insight and Accel, two renowned and experienced firms.”

Corelight got its start in 2013 when Dr. Vern Paxson, a professor of computer science at the University of California, Berkeley, alongside Robin Sommer and Seth Hall built a network visibility solution atop an open source framework called Zeek (formerly Bro). Paxson began developing Zeek in 1995 while working at Lawrence Berkeley National Laboratory, and it went onto reach thousands of organizations around the world including labs in the Department of Energy, agencies in the US government, and research universities like Indiana University, Ohio State, and Stanford.

Corelight offers a suite of enterprise managed features supporting Zeek, including out-of-the-box integrations, distributed management, and data tuning capabilities that transform network traffic into rich logs, extracted files, and security insights. Specifically, Corelight offers traffic logging for more than 35 network protocols and the core collection of Zeek packages, in addition to support for custom Zeek packages.

Logs from Corelight’s sensors — which are available in physical, virtual, and cloud-based form factors an be seamlessly exported to data tools like Splunk, Elastic, QRadar, Spark in minutes. This helps to reduce downstream security information and event management costs by around 30% compared to a typical open source deployment, claims Bell.

Corelight’s says its customer base of just over 70 includes Fortune 500 brands, “major” government agencies, and large universities.

“Corelight recognizes that network data provides ground-truth evidence that security teams need to root out malicious activity inside their organizations,” said Jeff Horing, co-founder and managing director at Insight Partners. “It is this unique data-centric approach that sets Corelight apart from other vendors in the security market space. As a result, we believe that Corelight has substantial opportunities to expand their portfolio and provide customers a fundamentally better foundation for their security programs. We look forward to partnering with the team as they build out that vision.”

Previous and existing Corelight investors include General Catalyst, Osage University Partners, and Riverbed Technology cofounder Dr. Steve McCanne.