ExtraHop launches 400 Gbps sensor for RevealX platform

ExtraHop has launched a 400 Gbps sensor for its RevealX network detection and response platform, designed to analyse enterprise data centre traffic at full line speed.

The release targets a growing gap as data centres and cloud environments move to faster networking while many security tools still process traffic at 100 Gbps. That has often forced security teams to rely on sampled traffic rather than full analysis, reducing visibility into network activity.

According to ExtraHop, the new sensor captures live network traffic and converts it into structured context that security operations teams and automated tools can query directly. It is aimed at environments with dense east-west traffic, including GPU clusters, Kubernetes workloads, model training pipelines, and AI inference systems.

ExtraHop argues this matters because AI adoption is increasing internal network traffic just as attackers are moving faster. In large enterprise data centres and so-called neocloud environments, the combination has made partial visibility harder to justify.

World Wide Technology, cited by ExtraHop as a customer voice, linked the issue to the speed of modern attacks and the limits of existing tools.

"AI is compounding the volume of data moving across our infrastructure every day, and our security tooling has not kept pace with our data center," said Chris Konrad, Vice President, Global Cyber, World Wide Technology. "Complete visibility at this scale is no longer optional post-Mythos. AI-powered attacks move at record speed, and the AI-powered systems need to be able to tell the difference between a quiet network and a network they are only partially seeing."

Traffic growth

Network detection and response products typically inspect traffic patterns to identify suspicious behaviour, lateral movement, and compromised identities. In high-speed data centre environments, however, the volume of traffic moving between applications, workloads, and users can overwhelm tools built for lower throughput.

ExtraHop says accelerated AI deployment has intensified that challenge. Enterprises are running more machine learning workloads, more agent-to-agent communications, and more encrypted traffic within their own estates, making it harder for defenders to monitor internal activity in detail.

The company says sampling creates blind spots where intrusions can go unnoticed, especially when attackers use living-off-the-land techniques or move laterally through legitimate accounts and services. It also argues that clustering lower-speed sensors to cover faster networks adds cost and operational complexity.

RevealX is intended to process full traffic feeds at 400 Gbps and present them as a structured map of devices, identities, workloads, and interactions across the network. Users and software agents can query that information through application programming interfaces and model context protocol interfaces, then drill down to protocol activity, transaction records, and packet capture when required.

Agent focus

The launch also reflects a broader shift in security operations toward automated investigation and response. Many security vendors now present AI agents as a way to speed triage and decision-making, but their effectiveness depends heavily on the quality and completeness of the data they receive.

ExtraHop framed the new sensor as part of the underlying data layer those systems need. Rather than having models infer meaning from raw logs, the platform prepares network evidence in a structured form from the start, it said.

Kanaiya Vasani, Chief Product Officer at ExtraHop, said the industry had focused too heavily on adding AI to existing security operations without addressing the underlying data problem.

"The reflex across the industry has been to bolt AI onto the SOC we already have, and the harder problem is the context substrate underneath," said Kanaiya Vasani, Chief Product Officer, ExtraHop. "SIEMs, forensic data lakes, and security warehouses are built to look backward. They are valuable as depth and memory, but they cannot be the first and only source of truth for an agent that has to decide something right now. RevealX is the prevention side of that equation: structured, queryable evidence whose latency budget matches the attack. At 400 Gbps, the busiest networks in the world can hand their agents complete evidence instead of a sample, which is the difference between autonomy a CISO can defend to a regulator and autonomy that is confidently wrong at scale."

ExtraHop also tied the product to a three-layer security operations model described by the Agentic SOC Alliance, which separates context, orchestration, and model functions. In that framework, the sensor is positioned as part of the context layer for large-scale environments.

The company says the sensor should let organisations reduce the number of sensors required on high-speed networks while giving security and IT operations teams a single view of network activity. It also says the product can maintain a live inventory of AI-related assets and communications, including model use, MCP servers, tool endpoints, and agent-to-agent traffic.

The launch highlights how AI-driven infrastructure changes are reshaping the security tooling market. As networking speeds rise and internal traffic volumes increase, vendors are under pressure to show that their products can inspect more of the wire without relying on selective collection or retrospective analysis.