CISO Tribune

Vendor comparison · 2 companies

Corelight vs Vectra AI

Corelight sells the Open NDR Platform, which transforms network data into evidence. Vectra AI sells the Vectra AI Platform, a security platform that covers network, identity and cloud. CISO Tribune files both under Network detection and response. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Corelight
  • Vectra AI
Corelight vs Vectra AI: Products, Customers and Funding Compared
CorelightCorelight sells the Open NDR Platform, which transforms network data into evidence.corelight.comVectra AIVectra AI sells the Vectra AI Platform, a security platform that covers network, identity and cloud.vectra.ai
What it sells
  • Investigator[1][4][9][10][12][13][15][18]A SaaS-based NDR platform for investigations. It uses Agentic Triage playbooks to triage alerts.
  • Corelight Sensors[8][12][13]Sensors that capture a copy of traffic out-of-band and turn it into network evidence with Zeek.
  • Smart PCAP[1][4][12]Links Zeek logs, detections and extracted files to only the packets needed for investigations.
  • AI/ML detections[8]A subscription-based module of AI/ML detections that can be purchased with Corelight Sensors.
  • Threat Intelligence[4][8][13]A licensed feature for Corelight Sensors and Investigator.
  • Cloud Sensors[14]Corelight sensors for cloud networks, available for AWS, GCP and Azure.
  • Vectra AI Platform[11]A platform that covers network, identity and cloud to detect attacker behavior. It brings together observability, threat detection, investigation and response, and posture improvement.
  • Vectra MXDR[8]A managed extended detection and response service staffed by Vectra AI analysts.
Categories
Headquarters
San Francisco, United States[3]San Jose, United States[2]
Founded
2016Not stated on its pages
Ownership and funding
Not stated on its pagesNot stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • October 6, 2026Corelight announced the establishment of Corelight Canada, a standalone entity intended to work more closely with customers, partners and public sector organizations in Canada.[17]
  • July 27, 2026Corelight announced the appointment of Amanda Berger as its Chief Customer Officer.[5]
  • June 9, 2026Corelight announced that its Open NDR Platform, including Investigator and Hosted Fleet Manager, was listed on the FedRAMP Marketplace as FedRAMP In Process at the Class C (Moderate) level.[18]
  • June 9, 2026Corelight announced it has reached FedRAMP In Process status.[6]
  • September 15, 2026Vectra AI announced Vectra AI Ascent, a new global partner program meant to build expertise, services and joint capabilities for addressing complex security challenges.[13]
  • August 5, 2026Vectra AI launched Vectra AI Pro, a product intended to give AI agents in security operations centers a more reliable view of attacker behavior.[15]
  • August 5, 2026Vectra AI announced Vectra AI Pro, a new offering intended to help organizations adopt AI across the SOC through trusted signal intelligence.[10]
  • July 14, 2026Vectra AI announced an expanded alliance with Endace under which Vectra AI will offer Endace Probes directly to its customers.[12]
  • December 16, 2025Vectra AI announced a control framework within the Vectra AI Platform that unifies controls before and after compromise across the hybrid attack lifecycle.[11]
G2 and Gartner Peer Insights
  • G2: listed, seen November 5, 2026[7]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, Corelight sells mainly to SOC teams that want network evidence for detection, investigation and threat hunting. Corelight describes customers extending visibility across hybrid and multi-cloud environments. Customer examples on its pages include a global beauty retailer protecting point-of-sale terminals and a major U.S mortgage lender with data centers and multi-cloud workloads in AWS and Azure.Not written yet
Last verified
September 27, 2026November 2, 2026

Where they overlap

  • Network detection and response is the primary category of both Corelight and Vectra AI.
  • Both are headquartered in the United States.

Where they differ, field by field

  • Corelight is also filed under Network visibility and traffic brokering. Vectra AI is also filed under Cloud detection and response and Identity threat detection and response.
  • Corelight lists Investigator, Corelight Sensors, Smart PCAP, AI/ML detections, Threat Intelligence and 1 more. Vectra AI lists Vectra AI Platform and Vectra MXDR.
  • Corelight is headquartered in San Francisco, United States. Vectra AI is headquartered in San Jose, United States.
  • Corelight was founded in 2016.

How they differ

CISO Tribune files both Corelight and Vectra AI under network detection and response as their primary category. Corelight is headquartered in San Francisco and was founded in 2016, while Vectra AI is headquartered in San Jose. CISO Tribune also files Corelight under network visibility and traffic brokering, and files Vectra AI under cloud detection and response and identity threat detection and response.

Corelight sells the Open NDR Platform, built around Corelight Sensors that capture a copy of traffic out-of-band and use Zeek to parse 70+ data types. Corelight also sells Investigator, a SaaS-based NDR platform with Agentic Triage playbooks, along with Smart PCAP, Cloud Sensors for AWS, GCP and Azure, and a subscription AI/ML detections module. Vectra AI sells the Vectra AI Platform, which covers network, identity and cloud and, by Vectra AI's account, offers over 200 AI-driven attacker behavior detections. Vectra AI also sells Vectra MXDR, a managed service staffed by Vectra AI analysts, while Corelight sells services that can include a resident engineer. Corelight and Vectra AI both describe integrations with Microsoft Sentinel.

Corelight's customer examples include a global beauty retailer and a major U.S mortgage lender, while Vectra AI cites Blackstone and says 2,000+ security teams use its platform. On June 9, 2026, Corelight announced that its Open NDR Platform reached FedRAMP In Process status, and on October 6, 2026, Corelight announced the establishment of Corelight Canada. Vectra AI launched Vectra AI Pro on August 5, 2026, and announced the Vectra AI Ascent partner program on September 15, 2026.

What it sells: Corelight

What Investigator does[1][4][9][10][12][13][15][18]
Investigator is Corelight's SaaS-based NDR platform that streamlines complex investigations. Agentic Triage uses transparent, expert-written playbooks. SIEM Verdict Export sends triage verdicts, reasoning chains and evidence links into a SIEM.
What Corelight Sensors does[8][12][13]
The sensor captures a copy of all traffic out-of-band, then deduplicates and cleans the data. Powered by Zeek, it performs deep protocol parsing across 70+ data types. The evidence is routed to Investigator, a SIEM or a data lake.
What Smart PCAP does[1][4][12]
Corelight Smart PCAP links Zeek logs, detections and extracted files to only the packets needed for investigations. Corelight says it lets teams store packets longer and find them faster.
What AI/ML detections does[8]
AI/ML detection is a subscription-based module that can be purchased with Corelight Sensors. It can be deployed across air-gapped, hybrid, cloud or multicloud environments. Models are enabled, managed and tuned through Fleet Manager. Many detections run directly on-sensor with no cloud dependency.
What Threat Intelligence does[4][8][13]
Threat Intelligence is a licensed feature for Corelight Sensors and Investigator. It is supported on all sensor options. It is managed through Fleet Manager or the sensor's Threat Intelligence framework.
What Cloud Sensors does[14]
Corelight Cloud Sensors are available for AWS, GCP and Azure. Corelight supports AWS, Azure and GCP native packet mirroring, and third-party packet brokers.

What it sells: Vectra AI

What Vectra AI Platform does[11]
Vectra AI says the platform uses behavioral detection and real-time network visibility to reduce exposure and stop attacks across network, identity, and cloud. Its detections surface lateral movement, credential theft, account compromise and privilege escalation. AI agents triage, stitch and prioritize detections.
What Vectra MXDR does[8]
Vectra AI says the service provides complete 24/7 coverage across identity, public cloud, SaaS and data center networks. Customers can choose full management or co-management based on their SOC's maturity.

Questions about Corelight and Vectra AI

What do Corelight and Vectra AI sell?
Corelight sells Investigator, Corelight Sensors, Smart PCAP, AI/ML detections, Threat Intelligence and 1 more. Vectra AI sells Vectra AI Platform and Vectra MXDR.
Are Corelight and Vectra AI in the same category?
Yes. Network detection and response is the primary category of both on CISO Tribune.
Where are Corelight and Vectra AI headquartered?
Corelight is headquartered in San Francisco, United States. Vectra AI is headquartered in San Jose, United States.
When were Corelight and Vectra AI founded?
Corelight was founded in 2016.
Who are Corelight and Vectra AI sold to?
From its own pages, Corelight sells mainly to SOC teams that want network evidence for detection, investigation and threat hunting.
What have Corelight and Vectra AI announced recently?
October 6, 2026: Corelight announced the establishment of Corelight Canada, a standalone entity intended to work more closely with customers, partners and public sector organizations in Canada. September 15, 2026: Vectra AI announced Vectra AI Ascent, a new global partner program meant to build expertise, services and joint capabilities for addressing complex security challenges.

About Corelight

Corelight sells the Open NDR Platform, which transforms network data into evidence. Corelight says that evidence powers AI-driven detection and expert-authored workflows.

Corelight sensors capture a copy of all traffic out-of-band. The sensor then deduplicates and cleans the data, discarding redundant multicast traffic. Powered by Zeek, the sensor performs deep protocol parsing across 70+ data types. The resulting evidence is routed to Corelight Investigator, a SIEM, or a data lake for long-term forensics.[9]

Investigator is Corelight's SaaS-based NDR platform. Corelight says it streamlines complex investigations by eliminating repetitive review steps and enables up to 10x faster triage. Agentic Triage uses transparent, expert-written playbooks to follow consistent triage logic for every investigation. SIEM Verdict Export sends every triage verdict, including the reasoning chain, evidence links and recommended next steps, directly into the customer's SIEM. Investigator also offers host isolation, IP blocking and identity actions through integrated EDR, firewall and identity provider workflows.[1][10]

Corelight fuses machine learning, behavioral analytics and curated signatures in its threat detection. AI/ML detection is a subscription-based module that can be purchased with Corelight Sensors, and AI/ML models are enabled, managed and tuned through Fleet Manager. Many of these detections run directly on-sensor, with no cloud dependency. Threat Intelligence is a licensed feature for Corelight Sensors and Investigator, and it is supported on all sensor options. Corelight Smart PCAP links Zeek logs, detections and extracted files to only the packets needed for investigations.[8][11][12][13]

For cloud environments, Corelight Cloud Sensors are available for AWS, GCP and Azure. Corelight supports AWS, Azure and GCP native packet mirroring, and third-party packet brokers. Performance and Asset Visibility is a Corelight Open NDR module that passively extracts asset classification and network performance telemetry from traffic the sensors are already collecting.[14][15]

Corelight also sells services. Corelight says it can provide a resident engineer to work alongside a customer's team, and services can be purchased standalone or bundled with the platform. Corelight describes integrations with Splunk Enterprise Security and Splunk SOAR, and with Microsoft Defender, Microsoft Sentinel and Microsoft Entra ID.[1][2][10][12][14][16]

Corelight on the record

Sources

Corelight full record

  1. [1]All productsCorelight · corelight.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]About corelightCorelight · corelight.com · undated page, accessed September 27, 2026 · Tier A
  3. [3]H i g growth partners invests in corelights 75m series d financingH.I.G. Capital · hig.com · published September 3, 2021 · Tier C
  4. [4]Corelight | Evidence-Based NDR & Threat Hunting PlatformCorelight · undated page, accessed October 24, 2026 · Tier A
  5. [5]Corelight Welcomes Veteran Customer Advocate Amanda Berger as Chief Customer OfficerCorelight · published July 27, 2026 · Tier A
  6. [6]Corelight Achieves FedRAMP In Process Certification, Advancing Network Detection and Response for Federal Government AgenciesCorelight · published June 9, 2026 · Tier A
  7. [7]Corelight Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 24, 2026 · Tier C
  8. [8]AI/ML Detections: Transparent, Evidence-Based NDR | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  9. [9]Network Visibility: Complete Visibility for Security Operations | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  10. [10]Investigator: Agentic AI Triage for NDR | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  11. [11]AI-Powered Threat Detection Platform | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  12. [12]Intrusion Detection System (IDS) Powered by Suricata | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  13. [13]Cyber Threat Intelligence for Open NDR | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  14. [14]Cloud Solutions | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  15. [15]Performance and Asset Visibility | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  16. [16]Professional & Consulting Services | CorelightCorelight · undated page, accessed November 5, 2026 · Tier A
  17. [17]Corelight establishes Corelight CanadaCorelight · published October 6, 2026 · Tier A
  18. [18]Corelight Achieves FedRAMP In Process Certification, Advancing Network Detection and Response for Federal Government AgenciesPR Newswire · published June 9, 2026 · Tier A

Vectra AI full record

  1. [1]Modern NDR for Modern Networks | Vectra AI PlatformVectra AI · undated page, accessed September 27, 2026 · Tier A
  2. [2]AI Cybersecurity Platform for Network, Identity & Cloud Security | Vectra AIVectra AI · undated page, accessed September 27, 2026 · Tier A
  3. [3]Vectra AI Platform Reviews 2026: Details, Pricing, & Features | G2G2 · undated page, accessed October 30, 2026 · Tier C
  4. [4]AI-Native Security & Observability Platform | Vectra AIVectra AI · undated page, accessed November 4, 2026 · Tier A
  5. [5]Advanced Threat Detection AI & SOC Automation - Vectra AIVectra AI · undated page, accessed November 4, 2026 · Tier A
  6. [6]Vectra AI Threat Detection for Security AnalystsVectra AI · undated page, accessed November 4, 2026 · Tier A
  7. [7]Cloud Threat Detection & Response for Microsoft 365 Security - Vectra AIVectra AI · undated page, accessed November 4, 2026 · Tier A
  8. [8]Managed Extended Detection and Response (MXDR) - Vectra AIVectra AI · undated page, accessed November 4, 2026 · Tier A
  9. [9]Security Integrations for Your Modern Security Stack | Vectra AIVectra AI · undated page, accessed November 4, 2026 · Tier A
  10. [10]Vectra AI Launches Vectra AI Pro to Accelerate the Agentic SOCVectra AI · published August 5, 2026 · Tier A
  11. [11]Vectra AI Pioneers a New Era of Continuous Control Across the Hybrid Attack LifecycleVectra AI · published December 16, 2025 · Tier A
  12. [12]Vectra AI and Endace Deliver AI-Native Security and Observability with Integrated Packet-Level ForensicsVectra AI · published July 14, 2026 · Tier A
  13. [13]Vectra AI Launches Ascent to Help Partners Address the New Era of AI-Driven AttacksPR Newswire · published September 15, 2026 · Tier A
  14. [14]Vectra AI Empowers Partners with Unified Microsoft Security Through New Vectra AI Shield SolutionVectra AI · published November 25, 2025 · Tier A
  15. [15]Vectra AI launches Vectra AI Pro to feed AI agents better attack signalsSiliconANGLE · published August 5, 2026 · Tier B
  16. [16]Vectra AI Reviews, Ratings & Features 2026 | Gartner Peer InsightsGartner Peer Insights · undated page, accessed November 4, 2026 · Tier C

Spot a factual error? Request a correction.