Corelight, which offers a network traffic analysis and security service to enterprises, raises $75M Series D, bringing its total raised to $160M
Corelight, a San Francisco-based startup that claims to offer the industry's first open network detection and response (NDR) platform …
Context & Ripple Effects
Corelight has been climbing the venture ladder steadily since its Accel-led Series A in 2017, through a General Catalyst-led Series B in 2018, to a $50M Series C in 2019 that left it at $84M raised. This $75M Series D roughly doubles that total to $160M, funding the expansion of what it calls the first open network detection and response platform, built on the open-source Bro project.
The round also sets up the arc that follows: by 2024, Accel is back leading a much larger $150M Series E at a $900M valuation, with Corelight claiming it is months from $100M in ARR — making this Series D the step where the company scaled from promising startup to a nine-figure-revenue-track NDR vendor.
First-order effects
- Corelight gains $75M of fresh capital — its largest round yet at the time — to scale sales and development of its open NDR platform for enterprise network traffic analysis.
- Enterprise security buyers evaluating network detection tools now face a better-funded open-source-derived alternative, pressuring incumbent NDR offerings on openness as a selling point.
Second-order effects
- The round's success draws its own lead investor deeper in: Accel's return to lead the subsequent $900M-valuation Series E signals that the D round's growth thesis was validated, concentrating more capital behind one NDR vendor rather than seeding new entrants.
- Rival network-security startups chasing the same enterprise budgets must match Corelight's fundraising cadence or cede the 'open NDR' positioning it is claiming as a category.
Third-order effects
- If the pattern holds — successive rounds nearly doubling each time, culminating in a $150M raise on a path to $100M ARR — the NDR market consolidates around a handful of heavily capitalized platforms built on open-source foundations, squeezing out underfunded point tools.
- The trajectory reinforces the broader model of commercializing open-source security projects into venture-backed platforms, where community-developed telemetry like Bro becomes proprietary product differentiation.
The trend: Enterprise network detection is becoming a capital-intensive platform category, with open-source-derived vendors like Corelight raising progressively larger rounds to lock in the space before consolidation.