ExtraHop(R) named a Leader in Gartner(R) Magic Quadrant(TM) for Network Detection and Response for second consecutive year. May 21, 2026 ExtraHop advances its vision to secure enterprises against a new era of AI threats. SEATTLE - May 21, 2026 - ExtraHop(R), a leader in modern network detection and response (NDR), has been named a Leader in the 2026 Gartner(R) Magic Quadrant(TM) for Network Detection and Response for two consecutive years. Recognized by Gartner as a Leader for its Ability to Execute and Completeness of Vision, ExtraHop also continued to maintain the second highest revenue in NDR in 2025 (Gartner(R), Market Share: Enterprise Network Equipment by Market Segment, Worldwide, 4Q25). ExtraHop is also a Leader in The Forrester Wave(TM): Network Analysis And Visibility Solutions, Q4 2025, 2025 GigaOm Radar for Network Detection and Response (NDR) Solutions, and IDC MarketScape: Worldwide Network Detection and Response 2024 Vendor Assessment. The ExtraHop NDR platform is engineered to deliver unparalleled scale for the world's most demanding enterprise networks. By unifying NDR, network performance monitoring (NPM), intrusion detection (IDS), and network forensics in a single high-performance platform, ExtraHop turns continuous raw network telemetry into a strategic advantage, enabling organizations to: * Build an agentic SOC with confidence: ExtraHop provides the high-fidelity network context essential to power autonomous security agents, enabling the agentic SOC to counter AI-assisted attacks in real time and with high accuracy. * Expose hidden threats: ExtraHop decrypts and decodes traffic at line rate to reveal threats hiding within encrypted TLS and Microsoft RPC workflows - capabilities critical for securing the post-Mythos threat landscape. * De-risk AI transformation: ExtraHop delivers the full-stack observability required to identify security gaps and performance bottlenecks within AI workloads, allowing organizations to scale AI initiatives without compromising enterprise security. "NDR is the foundation of modern defense, providing the critical context needed to power the agentic SOC," said Kanaiya Vasani, Chief Product Officer, ExtraHop. "Defending against post-Mythos threats requires the depth of network intelligence that we believe has led to ExtraHop being positioned as a Leader in the Gartner(R) Magic Quadrant(TM) for NDR. Because we've built our platform to decipher complex, evasive behaviors in real-time and enrich network intelligence with endpoint and identity information, both humans and AI agents have the decisive edge they need to outmaneuver attackers hiding in plain sight." A Smarter Agentic SOC with High-Fidelity Data and Integrations ExtraHop is building the intelligence engine for the agentic SOC, delivering the high-fidelity network context AI models need to accurately triage and neutralize threats. By correlating insights across devices, users, applications, and identities in real-time, ExtraHop provides the evidence AI agents need to see the full scope of an attack This cross-domain context is further strengthened by strategic integrations with leaders like CrowdStrike, Microsoft, and Google, ensuring the most comprehensive intelligence to detect and neutralize threats. ExtraHop rounds out the agentic SOC vision by providing the automated workflows necessary for autonomous defense. Through Smart Triage and Smart Investigations, the platform correlates disparate events into a unified narrative, and a natural-language AI Search Assistant eliminates manual complexity while accelerating response times. Faster Threat Detection, Investigation, and Response with Unified Network Insights and Context In an era of high-velocity, AI-powered attacks and post-Mythos exploits, ExtraHop provides the real-time insights required to stop threats before they escalate. These insights are built on a history of innovation. First to bring native TLS decryption to the NDR market, ExtraHop makes it easier for organizations to uncover threats without compromising data privacy or performance. By decrypting line-rate traffic in real time, the platform ensures that sophisticated, encrypted attacks are stripped of their cover. Complementing this is deep fluency in nearly 100 protocols (including the ability to decrypt SSL and Microsoft protocols) and always-on full packet capture. Together, these capabilities allow SOC teams to expose threats hiding in legitimate workflows and instantly gather the context needed to accelerate investigations and slash mean time to respond (MTTR). The impact is best illustrated by a healthcare customer who said, "This tool is our number 1 tool used in security, especially during a penetration test or incident." (Gartner Peer Insights(TM) Real-Time AI Observability to Secure and Govern the Agentic Enterprise This same network telemetry and deep-layer context provides the real-time visibility into AI workloads organizations need to monitor behavioral shifts, enforce strict governance, and ensure compliance across the agentic enterprise. This deep insight is critical for detecting subtle anomalies within AI interactions, such as prompt injection or unauthorized data access, that signal potential misuse or a sophisticated attack. By monitoring these activities, ExtraHop ensures that as AI scales, organizations maintain the integrity and oversight necessary to secure the future of autonomous operations. Additional resources: Gartner, Magic Quadrant for Network Detection and Response 2026, By Thomas Lintemuth, Charanpal Bhogal, Nahim Fazal, May 18, 2026 Gartner, Market Share: Enterprise Network Equipment by Market Segment, Worldwide, 4Q25, By Gurjyot Uppal, Vivek Tiwari and Christian Canales, February 2026 Gartner Peer Insights content consists of the opinions of individual end users based on their own experiences, and should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service depicted in this content nor makes any warranties, expressed or implied, with respect to this content, about its accuracy or completeness, including any warranties of merchantability or fitness for a particular purpose. Gartner, Magic Quadrant and Peer Insights are trademarks of Gartner, Inc. and/or its affiliates.

ExtraHop expands platform capabilities to support AI-driven SOCs. ExtraHop introduces advanced capabilities to equip security operations centres with autonomous AI, improving threat detection and response. * Wednesday, 25th February 2026 Posted 2 hours ago in by Sophie Milburn Security operations centres (SOCs) are increasingly integrating artificial intelligence (AI) to manage the rising complexity of cybersecurity threats. Recognising a gap in actionable insights, ExtraHop has unveiled a suite of enhancements aimed at empowering SOCs with autonomous AI capabilities. AI-driven SOCs can now leverage ExtraHop's advanced visibility and forensic capabilities. The platform aims to deliver deep network, identity, and Kubernetes telemetry, allowing AI agents to not only detect anomalies but also respond autonomously, minimising reliance on human intervention. The new capabilities utilise ExtraHop's network telemetry to deliver comprehensive, contextual insights. This seeks to ensure AI agents can identify and correlate activities across devices, users, applications, and identities. As a result, security teams can address threats at machine speed, enhancing overall efficiency. ExtraHop has reinforced its platform by embedding it with identity systems such as Entra ID, Active Directory, and Okta. This integration aims to enrich data on user interactions, providing SOC teams with the essential context for quick threat investigation and response, ultimately reducing Mean-time-to-Response (MTTR). The enhancements extend to cloud-native applications, allowing full visibility into Kubernetes environments. The platform seeks to enable SOC teams to capture, decrypt, and analyse Kubernetes traffic, providing data to inform AI-based decisions. With the introduction of the ExtraHop Query Language (EQL), AI agents can query voluminous network data to extract necessary information, fostering threat detection and automated responses via APIs and Model Context Protocol (MCP) servers. These developments aim to improve data visibility for modern SOCs and support the use of AI in threat detection and response as organisations expand their AI-driven cybersecurity strategies.

ExtraHop, a network detection and response leader, has expanded into Saudi Arabia, partnering with business expansion platform AstroLabs. The move follows nearly 50% year-over-year growth in net new customers across the Middle East, particularly in government, financial services and transportation sectors. The company is scaling investment in Saudi Arabia with localised technical resources to support its channel partner ecosystem. ExtraHop's expansion aims to serve the Kingdom's largest enterprises and critical infrastructure providers as they pursue Saudi Vision 2030's digital transformation goals. ExtraHop is recognised as a leader in Gartner's Magic Quadrant for Network Detection and Response 2025. The company's platform provides real-time threat detection, automated response capabilities and compliance support for hybrid environments.