Endace provides always-on packet capture and network visibility technology that gives cybersecurity, network operations, and IT teams a definitive record of network activity across on-premises, private cloud, and public cloud environments. Its platforms are designed to capture, index, and retain high-speed packet data at scale so teams can investigate threats, outages, performance issues, and compliance events with packet-level evidence rather than sampled or incomplete telemetry.
At the center of the portfolio is the EndaceProbe platform and the EndaceFabric architecture, which connect physical and virtual probes with centralized search, investigation, and management. Endace also uses an open architecture that lets customers integrate packet history into existing security and performance tools, host selected analytics on the platform, and extend visibility across hybrid cloud estates, including AWS, Azure, and Microsoft Sentinel workflows.
Offerings, Capabilities, and Integrations
Endace delivers always-on full packet capture, centralized investigation, and management capabilities for distributed network estates. Its technology is built to preserve complete network history across core, edge, virtual, and cloud environments, then make that history searchable through browser-based investigation tools, APIs, and workflow integrations. This supports threat hunting, incident response, network troubleshooting, application performance analysis, and forensic review from a common packet-evidence layer.
The company emphasizes interoperability alongside capture depth. Endace supports integration with SIEM, SOAR, IDS, NDR, and performance monitoring workflows, and it enables hosted analytics on the EndaceProbe platform through Application Dock and DockOS. That approach helps organizations keep existing monitoring investments while adding deeper packet-level context, faster pivot-from-alert investigation, and shared visibility across security and operations teams.
Products and Services
- EndaceProbe: Physical packet capture appliance that continuously records high-speed network traffic, indexes packet history, and provides a platform for investigation and hosted analytics across enterprise and service-provider environments.
- EndaceProbe Cloud: Public cloud version of EndaceProbe for AWS and Microsoft Azure that records east-west and north-south cloud traffic to extend packet-level visibility across hybrid cloud environments.
- EndaceProbe vProbe: Virtual machine implementation of EndaceProbe for private cloud and virtualized environments, giving teams visibility into virtual and east-west traffic without requiring physical appliances.
- EndaceVision: Browser-based investigation and visualization interface that lets analysts search, filter, decode, and analyze recorded packet history directly on Endace platforms.
- InvestigationManager: Centralized investigation software for estate-wide search, data mining, and analysis across multiple EndaceProbes and vProbes from a single interface.
- EndaceCMS: Central management server for monitoring, configuring, updating, and administering connected Endace appliances across distributed environments.
- EndaceFlow: High-performance NetFlow generator hosted on EndaceProbe that produces unsampled flow records and links flow telemetry back to packet evidence for faster investigation.
- DockOS: Prebuilt Linux virtual machine image for Endace Application Dock that simplifies deployment of open-source and custom traffic analysis tools on EndaceProbe.
- EndaceFabric: Architecture for connecting physical and virtual EndaceProbes into a unified recording fabric with centralized visibility, search, investigation, and management.
Target Customers
Endace primarily serves organizations that run large, complex, or mission-critical networks and need definitive packet evidence for security and performance investigations. Typical users include security operations, network operations, incident response, IT operations, and DevOps teams working across on-premises, private cloud, and public cloud infrastructure.
Its target markets include government, defense, banking, healthcare, telecommunications, education, retail, energy, and large enterprise environments. Endace is especially relevant for teams managing high-speed links, distributed hybrid cloud estates, virtualized workloads, or compliance-driven environments where complete network history is more valuable than sampled telemetry.
Cloud Integrations and Marketplace
- Microsoft Marketplace: Endace has a verified Microsoft Marketplace listing for Endace Vision for Microsoft Sentinel, enabling analysts to pivot from Sentinel alerts to related Endace packet evidence.
- Microsoft Azure: EndaceProbe Cloud is designed for deployment in Microsoft Azure public cloud environments to capture and retain packet data for unified hybrid cloud investigation and response.
- AWS: EndaceProbe Cloud is designed for deployment in AWS public cloud environments to record cloud packet traffic and extend packet-level visibility across hybrid network estates.
Key People
- Stuart Wilson: CEO
- Cary Wright: VP Product Management
- Mark Evans: VP Marketing
Key Facts
- Headquarters: Ellerslie, Auckland, New Zealand
- Employees: Approximately 139
- Annual Revenue: Approximately US$35M-US$42M
- Parent Company: Echidna Limited
- Subsidiaries: Several legal entities, including Endace Technology Limited, Endace Measurement Systems Limited, Endace Fulfilment and Logistics Limited, and Endace Technology India Private Limited.
- Publicly Listed: Private
