SAN FRANCISCO, Oct. 15, 2025 /PRNewswire/ -- Corelight, the fastest-growing leader in network detection and response (NDR), today announced it has been named a Leader in The Forrester Wave™: Network Analysis and Visibility Solutions, Q4 2025. The report evaluates the 12 most significant providers in the market, assessing them on their current offering, strategy, and customer feedback.
According to the evaluation, Corelight's Open NDR Platform received the highest score possible in the deployment and administration criteria, which Corelight believes reflects the solution's flexible deployment options and ease of management. The company also received the highest scores possible in the protocol coverage criterion.
"We believe this report by Forrester, our fifth major industry recognition this year, validates our data-centric approach to strengthening attack surface discovery and empowering security operations teams with the deep network context they need to detect and respond to increasingly sophisticated and persistent threats," said Brian Dye, Corelight CEO. "We see this as an acknowledgement of not just what we do today, but also the growth-driven investment against our vision, innovation, and long-term roadmap, earning us the highest possible score in the vision criterion."
Corelight's Key Strengths Recognized by Forrester
In Corelight's vendor profile, Forrester cited the following:
- Data-Centric Innovation: Forrester noted that Corelight "positions its solution as a network context force multiplier, strengthening attack surface discovery/prioritization and the future SOC." The report states that the company's innovation approach "aligns with a data-centric strategy tailored to its target users" and is "backed by substantial R&D investment."
- Comprehensive Detection Approach: According to the report, "Corelight minimizes reliance on a single approach to threat detection by relying on multiple mechanisms tailored to specific use cases."
- Open-Source Foundation: Forrester recognized Corelight's roots in the open-source community, noting the company's "advantage of access to the broader Zeek community."
Corelight's Open NDR platform provides organizations with deep network visibility through advanced traffic analysis, behavioral analytics, and threat intelligence integration. The solution enables security teams to detect lateral movement, insider threats, and advanced persistent threats that often evade perimeter defenses. The platform's key differentiators include:
- Industry-leading network evidence – Rich, actionable evidence with full context helps defenders understand attack vectors, spot lateral movement and reconstruct attacker behaviors with clarity and certainty.
- Proven multi-layered detection strategy – Fusing machine learning (ML), behavioral analytics, curated signatures, and threat intelligence provides defenders with prioritized, aggregated alerts based on risk and expert-tuned detections.
- Open source advantage – Built on an open-source foundation that is used by the world's elite defenders, customers benefit from curated community content contributions that help detect emerging threats faster.
- AI driven acceleration – Integration of large language models and ML-based detection algorithms enables evidence-backed summaries, guided triage, and analyst-ready workflows to accelerate investigations without locking customers into proprietary platforms.
- Flexible deployment options – With a strong and growing technical ecosystem, Corelight Open NDR can be seamlessly deployed in a wide range of architectures from cloud to on-premises to hybrid with integrations across the security stack.
- Leading customer support – An expert team of security professionals provides support and advice to customers from implementation and integration through the entire lifecycle of the customer relationship.
The Forrester Wave™: Network Analysis and Visibility Solutions, Q4 2025 evaluated vendors based on current offering, strategy, and market presence, with emphasis on decryption capabilities, API-first integration strategies, and analyst experience.
To learn more about Corelight's positioning as a Leader, visit https://corelight.com/blog/corelight-named-a-leader-in-2025-nav-solutions-by-forrester.
About Corelight
Corelight transforms network and cloud activity into evidence that security teams use to proactively hunt for threats, accelerate response to incidents, gain complete network visibility, and create powerful analytics. Corelight's customers include Global 2000 companies, major government agencies, and large research universities. Based in San Francisco, Corelight is an open-core security company founded by the creators of Zeek®, the widely used open source network security technology. For more information, visit www.corelight.com.
Forrester Disclaimer
Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. For more information, read about Forrester's objectivity here .
SOURCE Corelight