ExtraHop is a cybersecurity company providing AI-based network intelligence that stops advanced threats across cloud, hybrid, and distributed environments.
History
Jesse Rothstein and Raja Mukerji founded ExtraHop in 2007 in Seattle, Washington, USA. The co-founders were formerly senior engineers at F5 Networks and architects of the BIG-IP v9 product.
Early on, ExtraHop acquired $6.6 million in funding from the Madrona Venture Group and other private investors including Marc Andreessen and Ben Horowitz. In May 2014, the company closed a $41 million Series C round led by Technology Crossover Ventures (TCV). Other participants in this round included existing investors Meritech Capital Partners and Madrona Venture Group, as well as private investors including Sujal Patel, former CEO and founder of Isilon Systems. This round brought ExtraHop’s total venture funding to $61.6 million.
After debuting as a Visionary in the Gartner Magic Quadrant for Network Performance Monitoring and Diagnostics in 2017, in 2018 ExtraHop formally expanded into the cyber security market with the release of the Reveal(x) product, followed 2 years later by the launch of SaaS-based Reveal(x) 360. In January 2019, the company announced having booked $100 million in revenue for the previous year.
In July 2021, ExtraHop was acquired by Bain Capital Private Equity and Crosspoint Capital Partners for $900 million. In February 2022, the company announced that it had appointed Patrick Dennis as CEO. By October 2023, Dennis was moved to an advisory role with co-founder and managing partner at Crosspoint Greg Clark taking over as ExtraHop CEO. Clark had prior CEO roles at Forescout Technologies and Blue Coat Systems.
ExtraHop operates globally with offices in Seattle, Washington (HQ); London, UK; Germany; France; Australia; Singapore; and Japan.
Products
ExtraHop sells products for Enterprise Security and IT Operations use cases. The company launched the Reveal(x) network intelligence product for Security Operations teams in 2018. In 2020, the company introduced Reveal(x) 360, a fully SaaS-based version of their network detection and response platform.
Reveal(x) and Reveal(x) 360 (hereinafter referred to as "Reveal(x)") use what the company calls "cloud-scale machine learning" (ML) algorithms and rule-based techniques to detect behaviors, anomalies, and software vulnerabilities to provide security recommendations in actionable Detection Cards, and curate threat intelligence indicators of compromise of known threats.
Reveal(x) securely decrypts and analyzes traffic in real time, to collect intelligence and network threat telemetry that drive ML detections. These include:
–Detection of encrypted lateral movement, living off the land, and encrypted exploit attempts of CVEs such as PrintNightmare, ProxyLogon, Log4Shell, and Spring4Shell.
–Detection of cloud attack techniques (eg, AWS IMDS proxying, AWS services enumeration)
–Hygiene detections (eg, insecure protocols, passwords in plaintext)
–IoT detections (abnormal behavior observed on an IoT device of a specific make and model)
–Network-based detection of abuse of encrypted Microsoft protocols (Active Directory, Kerberos, SMBv3, MSRPC), as well as TLS 1.3
–User behavior (eg, abnormal login behavior)
ExtraHop Reveal(x) works by extracting metadata from raw network traffic across more than 70 protocols, including the ability to decrypt Microsoft application and authentication protocols and Transport_Layer_Security#TLS_1.3. This data includes natively discovered information about endpoints/users such as MAC, Hostname, OS, software, application layer information, usernames, geolocation, passive DNS, and whois. Reveal(x) data can be enriched with threat intelligence and endpoint process data from partner products. ExtraHop detections include a timeline of related events, MITRE ATT&CK techniques, next steps for investigation and remediation, and 1-click access to forensic data such as transaction records and decrypted packets. These data can also be explored/filtered as a starting point for threat hunts. Customers can build, reuse, and share libraries of saved queries to speed recurring threat hunting tasks.