ExtraHop has introduced a 400 Gbps sensor for its RevealX network detection and response (NDR) platform, targeting full-traffic analysis in enterprise data centers running at 400 Gbps. The company says the sensor ingests and analyzes traffic at line rate, aiming to reduce “blind spots” created when tools sample traffic instead of inspecting it in full.
The sensor is designed to operate at 400 Gbps and feed RevealX with full-fidelity traffic for detection and response workflows. ExtraHop describes the platform as building a “live, continuously updated semantic map” of devices, identities, workloads, and network conversations as activity occurs. Instead of working directly from a raw packet or flow feed, RevealX exposes structured context for querying through APIs and MCP, with the ability to drill down into evidence as needed.
ExtraHop lists the evidence available for on-demand investigation as real-time behavioral detections, assets and entities, protocol metrics and activity maps, L7 transaction records across more than 90 protocols, and full-fidelity packet capture. The company also frames the approach as starting investigations at a “highest-signal layer” and pulling deeper detail only when required, which is a practical architectural choice for teams trying to control storage, processing, and investigative latency as east-west traffic volumes rise.
For data center operators, the blunt reality is that 400 Gbps links can outpace security tooling quickly, and sampling strategies can leave gaps precisely where lateral movement happens. If ExtraHop can truly sustain full analysis at 400 Gbps in production conditions, it has the potential to simplify sensor placement and reduce clustering overhead on high-speed fabrics. But line-rate inspection at this scale is unforgiving: pipeline design, encryption visibility approaches, and how the platform behaves under sustained microburst conditions will matter as much as the headline throughput number.
Chris Konrad, Vice President Global Cyber at World Wide Technology, said, “Complete visibility at this scale is no longer optional post-Mythos. AI-powered attacks move at record speed, and the AI-powered systems need to be able to tell the difference between a quiet network and a network they are only partially seeing.”
ExtraHop said the 400 Gbps sensor will be generally available in Q4 2026.
Source: ExtraHop
