CISO Tribune

Vendor comparison · 2 companies

Blackwall vs Corelight

Blackwall sells a web traffic management platform for the hosting market. Corelight sells the Open NDR Platform, which transforms network data into evidence. CISO Tribune files both under Network visibility and traffic brokering. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Blackwall
  • Corelight
Blackwall vs Corelight: Products, Customers and Funding Compared
BlackwallBlackwall sells a web traffic management platform for the hosting market.blackwall.comCorelightCorelight sells the Open NDR Platform, which transforms network data into evidence.corelight.com
What it sells
  • GateKeeper[4][6]Blackwall's flagship product, deployed across 2.3M+ websites and applications.
  • Investigator[1][4][9][10][12][13][15][18]A SaaS-based NDR platform for investigations. It uses Agentic Triage playbooks to triage alerts.
  • Corelight Sensors[8][12][13]Sensors that capture a copy of traffic out-of-band and turn it into network evidence with Zeek.
  • Smart PCAP[1][4][12]Links Zeek logs, detections and extracted files to only the packets needed for investigations.
  • AI/ML detections[8]A subscription-based module of AI/ML detections that can be purchased with Corelight Sensors.
  • Threat Intelligence[4][8][13]A licensed feature for Corelight Sensors and Investigator.
  • Cloud Sensors[14]Corelight sensors for cloud networks, available for AWS, GCP and Azure.
Categories
Headquarters
Not stated on its pagesSan Francisco, United States[3]
Founded
Not stated on its pages2016
Ownership and funding
Privately heldNot stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • October 20, 2026Blackwall announced it raised $100 million at a $2.2 billion valuation in a C round led by AVP, with existing investors Dawn Capital, MMC Ventures and Tera Ventures.[9]
  • October 6, 2026Corelight announced the establishment of Corelight Canada, a standalone entity intended to work more closely with customers, partners and public sector organizations in Canada.[17]
  • July 27, 2026Corelight announced the appointment of Amanda Berger as its Chief Customer Officer.[5]
  • June 9, 2026Corelight announced that its Open NDR Platform, including Investigator and Hosted Fleet Manager, was listed on the FedRAMP Marketplace as FedRAMP In Process at the Class C (Moderate) level.[18]
  • June 9, 2026Corelight announced it has reached FedRAMP In Process status.[6]
G2 and Gartner Peer Insights
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 5, 2026[7]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, Blackwall sells mainly to hosting providers and service providers, who offer its security to their own customers. Blackwall describes itself as channel-first, protecting websites through hosting providers around the world. Blackwall solutions are aimed at hosting providers, cloud platforms and enterprise networks. GateKeeper is described as protecting SMB customers worldwide. Service providers can white-label the product and keep control over how security features are delivered to their customers.From its own pages, Corelight sells mainly to SOC teams that want network evidence for detection, investigation and threat hunting. Corelight describes customers extending visibility across hybrid and multi-cloud environments. Customer examples on its pages include a global beauty retailer protecting point-of-sale terminals and a major U.S mortgage lender with data centers and multi-cloud workloads in AWS and Azure.
Last verified
October 21, 2026September 27, 2026

Where they overlap

  • Blackwall and Corelight are both filed under Network visibility and traffic brokering.

Where they differ, field by field

  • Blackwall's primary category is Bot and abuse management; Corelight's is Network detection and response.
  • Blackwall is also filed under DDoS protection and WAF and WAAP.
  • Blackwall lists GateKeeper. Corelight lists Investigator, Corelight Sensors, Smart PCAP, AI/ML detections, Threat Intelligence and 1 more.
  • Corelight is headquartered in San Francisco, United States.
  • Corelight was founded in 2016.
  • Blackwall is privately held.

What it sells: Blackwall

What GateKeeper does[4][6]
GateKeeper is described as the flagship product of Blackwall and is deployed across 2.3M+ websites and applications. GateKeeper is described as protecting SMB customers worldwide against emerging threats. The latest version of Blackwall's GateKeeper is v1.6.x.

What it sells: Corelight

What Investigator does[1][4][9][10][12][13][15][18]
Investigator is Corelight's SaaS-based NDR platform that streamlines complex investigations. Agentic Triage uses transparent, expert-written playbooks. SIEM Verdict Export sends triage verdicts, reasoning chains and evidence links into a SIEM.
What Corelight Sensors does[8][12][13]
The sensor captures a copy of all traffic out-of-band, then deduplicates and cleans the data. Powered by Zeek, it performs deep protocol parsing across 70+ data types. The evidence is routed to Investigator, a SIEM or a data lake.
What Smart PCAP does[1][4][12]
Corelight Smart PCAP links Zeek logs, detections and extracted files to only the packets needed for investigations. Corelight says it lets teams store packets longer and find them faster.
What AI/ML detections does[8]
AI/ML detection is a subscription-based module that can be purchased with Corelight Sensors. It can be deployed across air-gapped, hybrid, cloud or multicloud environments. Models are enabled, managed and tuned through Fleet Manager. Many detections run directly on-sensor with no cloud dependency.
What Threat Intelligence does[4][8][13]
Threat Intelligence is a licensed feature for Corelight Sensors and Investigator. It is supported on all sensor options. It is managed through Fleet Manager or the sensor's Threat Intelligence framework.
What Cloud Sensors does[14]
Corelight Cloud Sensors are available for AWS, GCP and Azure. Corelight supports AWS, Azure and GCP native packet mirroring, and third-party packet brokers.

Questions about Blackwall and Corelight

What do Blackwall and Corelight sell?
Blackwall sells GateKeeper. Corelight sells Investigator, Corelight Sensors, Smart PCAP, AI/ML detections, Threat Intelligence and 1 more.
Are Blackwall and Corelight in the same category?
They share Network visibility and traffic brokering. Blackwall's primary category is Bot and abuse management and Corelight's is Network detection and response.
Where are Blackwall and Corelight headquartered?
Corelight is headquartered in San Francisco, United States.
When were Blackwall and Corelight founded?
Corelight was founded in 2016.
Who owns Blackwall and Corelight?
Blackwall is privately held.
Who are Blackwall and Corelight sold to?
From its own pages, Blackwall sells mainly to hosting providers and service providers, who offer its security to their own customers. From its own pages, Corelight sells mainly to SOC teams that want network evidence for detection, investigation and threat hunting.
What have Blackwall and Corelight announced recently?
October 20, 2026: Blackwall announced it raised $100 million at a $2.2 billion valuation in a C round led by AVP, with existing investors Dawn Capital, MMC Ventures and Tera Ventures. October 6, 2026: Corelight announced the establishment of Corelight Canada, a standalone entity intended to work more closely with customers, partners and public sector organizations in Canada.

About Blackwall

Blackwall sells a web traffic management platform for the hosting market. Blackwall is a security infrastructure company focused on protecting web ecosystems from automated threats. Blackwall raises $100M at a $2.2B valuation to scale its global web traffic management platform. Blackwall describes itself as an AI-enabled security and web infrastructure company dedicated to safeguarding web ecosystems from automated threats.[2][3][4]

Blackwall is a channel-first web security company protecting millions of websites through hosting providers around the world. Every website connected to Blackwall initially operates in monitoring mode. The Blackwall platform analyses traffic in real time, detects malicious activity and generates security alerts that are delivered to website owners through Blackwall hosting partners.[5]

Blackwall integrates into a service provider's existing environment and tools, so the provider can package, price and deliver security its own way. Service providers can create new security tiers and add-ons on the infrastructure they already operate. Blackwall lets service providers make protection available across their entire customer base, from a simple upsell to security included by default. Blackwall offers modular security and traffic components that providers mix and match into tailored packages for every client tier.[1][2]

Blackwall technology can be white-labelled, and providers maintain control over how security features are delivered to their customers. Service providers can automate provisioning and management within their existing environment. Blackwall describes a model in which providers deploy across their client base and retain control of the customer relationship.[2]

Blackwall offers a component that visualises traffic patterns, visitor behaviour and anomalies for clients. Blackwall offers a component that stops malicious automated traffic and scraping. Blackwall offers a component that protects workloads against application-layer attacks. Blackwall offers a component that shields applications from common vulnerabilities, injection attacks and emerging threats. Blackwall offers a component that tailors security policies and traffic handling to individual client requirements. Blackwall offers a component that caches assets at the edge to accelerate content delivery and reduce origin server load.[1][2]

GateKeeper is described as the flagship product of Blackwall and is deployed across 2.3M+ websites and applications. GateKeeper is described as protecting SMB customers worldwide against emerging threats. The latest version of Blackwall's GateKeeper is v1.6.x. Blackwall provides several methods to integrate web servers with the Blackwall service.[4][6][7]

Blackwall is a brand and trademark of Botguard OÜ. BotGuard is legally registered in Estonia. Blackwall is backed by European investors. The Blackwall team is distributed across Europe, APAC and the Americas. Blackwall solutions are aimed at hosting providers, cloud platforms and enterprise networks.[1][3][4][8]

Blackwall on the record

Sources

Blackwall full record

  1. [1]blackwall.comBlackwall · blackwall.com · undated page, accessed October 21, 2026 · Tier A
  2. [2]Blackwall – Cybersecurity, Bot Protection & Web SecurityBlackwall · undated page, accessed November 10, 2026 · Tier A
  3. [3]About Us – BlackwallBlackwall · undated page, accessed November 10, 2026 · Tier A
  4. [4]Pre-Sales Solutions Architect - LATAM - BlackwallBlackwall · undated page, accessed November 10, 2026 · Tier A
  5. [5]Senior Product Manager - Conversion Optimisation - BlackwallBlackwall · undated page, accessed November 10, 2026 · Tier A
  6. [6]Blackwall DocsBlackwall · undated page, accessed November 10, 2026 · Tier A
  7. [7]Web Server Overview - Blackwall DocsBlackwall · undated page, accessed November 10, 2026 · Tier A
  8. [8]Blackwall Legal Information – BlackwallBlackwall · undated page, accessed November 10, 2026 · Tier A
  9. [9]Blackwall Raises $100M at $2.2B Valuation to Scale Its Global Web Traffic Management Platform for the Hosting MarketBusiness Wire · published October 20, 2026 · Tier A

Corelight full record

  1. [1]All productsCorelight · corelight.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]About corelightCorelight · corelight.com · undated page, accessed September 27, 2026 · Tier A
  3. [3]H i g growth partners invests in corelights 75m series d financingH.I.G. Capital · hig.com · published September 3, 2021 · Tier C
  4. [4]Corelight | Evidence-Based NDR & Threat Hunting PlatformCorelight · undated page, accessed October 24, 2026 · Tier A
  5. [5]Corelight Welcomes Veteran Customer Advocate Amanda Berger as Chief Customer OfficerCorelight · published July 27, 2026 · Tier A
  6. [6]Corelight Achieves FedRAMP In Process Certification, Advancing Network Detection and Response for Federal Government AgenciesCorelight · published June 9, 2026 · Tier A
  7. [7]Corelight Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 24, 2026 · Tier C
  8. [8]AI/ML Detections: Transparent, Evidence-Based NDR | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  9. [9]Network Visibility: Complete Visibility for Security Operations | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  10. [10]Investigator: Agentic AI Triage for NDR | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  11. [11]AI-Powered Threat Detection Platform | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  12. [12]Intrusion Detection System (IDS) Powered by Suricata | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  13. [13]Cyber Threat Intelligence for Open NDR | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  14. [14]Cloud Solutions | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  15. [15]Performance and Asset Visibility | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  16. [16]Professional & Consulting Services | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  17. [17]Corelight establishes Corelight CanadaCorelight · published October 6, 2026 · Tier A
  18. [18]Corelight Achieves FedRAMP In Process Certification, Advancing Network Detection and Response for Federal Government AgenciesPR Newswire · published June 9, 2026 · Tier A

Spot a factual error? Request a correction.