endace.com

One-line introduction

Endace is an enterprise-grade cybersecurity company from New Zealand, focused on Full Packet Capture and Network Recording solutions. Its core offering is the EndaceProbe hardware appliance series and accompanying software, which can continuously record every packet in network traffic at line rate and provide millisecond-level historical search and replay. For large organizations that need deep network forensics, threat hunting, and compliance auditing, Endace is widely recognized as a benchmark tool in the industry, and is especially adopted by high-security sectors such as finance, government, and telecommunications.

Business overview

Founded in 2001 and headquartered in Hamilton, New Zealand, Endace also has offices in the United States, the United Kingdom, Australia, and other regions. It is not a consumer-facing brand, but a provider focused on enterprise cybersecurity infrastructure. Its core business is a “Full Packet Capture and Network Recording” platform, meaning that unlike traditional IDS/IPS tools that only analyze traffic summaries, it preserves raw network traffic in full for deep analysis at any later point in time. Endace’s customers mainly include large banks, securities exchanges, national security agencies, telecom operators, and major internet companies. In the industry, Endace is often associated with concepts such as “network forensics” and “zero-trust network visibility.” Its appliances are typically deployed at core network nodes and serve as the underlying data foundation for security operations centers (SOCs). The company’s product line is mainly hardware probes, with virtualized versions also available, but its overall positioning is high-end and beyond the reach of ordinary users.

Who it is for

Endace has a very clearly defined target audience: enterprise security teams, network operations teams, and forensic investigators. More specifically, it is suitable for the following scenarios: first, financial institutions or critical infrastructure organizations that must meet strict data retention and audit compliance requirements, such as PCI DSS or the NIST framework; second, large SOC teams that need to quickly look back at attack traffic from days or even months earlier to reconstruct the full attack chain; third, cybersecurity research organizations that need to retain raw traffic over the long term for threat hunting and machine-learning model training. Endace is not suitable for individual users, small startups, or teams with only basic monitoring needs, because its deployment cost, operational complexity, and hardware requirements are all quite high. If you only need temporary packet capture and analysis, Wireshark or open-source tools such as Moloch, now renamed Arkime, may be more practical.

Key features and highlights

• Full packet capture at line rate: EndaceProbe can continuously capture and record all network packets at 1Gbps, 10Gbps, 40Gbps, or even 100Gbps without packet loss.
• Millisecond-level historical search: Supports fast searches by timestamp, IP address, protocol, application characteristics, and other criteria, allowing specific sessions to be located within several TB of historical data.
• Integration with mainstream security tools: Supports deep integration with SIEM/SOAR platforms such as Splunk, IBM QRadar, Palo Alto Networks, and Cisco, allowing alert events to be linked to raw packets with one click.
• Hardware-level timestamps and tamper resistance: Built-in GPS/PTP clock synchronization ensures nanosecond-level packet timestamp accuracy, while recorded data includes forensic-grade integrity verification.
• Flexible storage and archiving: Supports local SSD/HDD storage, and can also archive historical data to external NAS or cloud object storage to meet long-term compliance requirements.
• API and automation capabilities: Provides RESTful APIs, enabling security teams to automate packet capture, export, and alert workflows via scripts.

Pricing analysis

Endace does not publish monthly or annual pricing. Its pricing model is the typical “contact sales for enterprise quote” approach. Based on industry experience, a single EndaceProbe hardware appliance, including a one-year license, usually costs from tens of thousands to hundreds of thousands of US dollars, depending on capture rate, storage capacity, and add-on features. This places it in the high-end and relatively expensive tier among comparable products. Compared with open-source solutions such as Arkime + Elasticsearch, Endace’s hardware cost plus annual maintenance fees can be a heavy burden for small and medium-sized businesses. For large organizations, however, the investment is often treated as security insurance, because one successful data recovery or litigation-related forensic investigation may prevent losses far exceeding the cost of the equipment. It is worth noting that Endace does not offer a monthly subscription model, nor are there “hidden fees,” but annual technical support and software update contracts usually need to be renewed. This typically costs around 15%-20% of the initial purchase price.

How Chinese users can use it

Endace’s usability in mainland China is somewhat complicated. First, its official website is accessible from mainland China, but product documentation and the download center require registration, and some pages may load slowly. Second, Endace hardware must be shipped from New Zealand or the United States, so customs clearance procedures and import duties need to be handled by the buyer. Most importantly, Endace’s cloud management platform or some online activation services may require circumvention tools, because its infrastructure is hosted in overseas AWS regions. For payment, Endace supports international credit cards and corporate bank transfers, but usually does not accept Alipay or WeChat Pay. For Chinese enterprise users that need invoices, Endace can issue pro forma or commercial invoices from its New Zealand or US entities, but cannot provide Chinese VAT special invoices. This means domestic companies may need to purchase through an agent with import/export qualifications to satisfy financial compliance requirements. There are no fully equivalent domestic products, though Huawei HiSec Insight and NSFOCUS traffic analysis appliances have some functional overlap. However, their packet capture depth and forensic accuracy are not on the same level as Endace.

Pros and cons

Pros:

• Industry-leading full packet capture performance with packet-loss-free guarantees
• Extremely fast historical search, suitable for large-scale historical data analysis
• Strong integration with mainstream security tools and a mature ecosystem
• High-precision hardware timestamps that meet forensic standards
• Supports long-term archiving and offers strong compliance capabilities

Cons:

• Expensive, suitable only for large enterprises with sufficient budgets
• Complex deployment that requires professional network engineers to configure
• Network latency and compliance obstacles when used in China
• Does not provide Chinese VAT special invoices
• No publicly available free trial version, making evaluation costly

Comparison with similar products

• Arkime（formerly Moloch）: An open-source full packet capture solution that is free and backed by an active community. Suitable for technically capable teams that can build and operate it themselves, but it lacks hardware-level timestamps and official enterprise support, and its performance is limited by server hardware.
• Cisco Stealthwatch（now Cisco Secure Network Analytics）: Cisco’s traffic analytics platform, supporting NetFlow and some packet analysis capabilities. It offers strong integration, but its full packet capture capability is not as strong as Endace, and it is also expensive.
• ExtraHop Reveal(x): A cloud-native network detection and response platform that supports real-time traffic analysis and machine learning, but has a shorter packet retention period, making it better suited to real-time monitoring than long-term forensics.

Endace differentiates itself by focusing on the “recording” layer rather than analysis. It is more like a “video recorder” for security teams, while other products tend to be more like a “camera” plus an “alarm system.”

Summary and recommendation

Endace is best suited for the following scenario: your organization has clear compliance-driven data retention requirements, such as a financial institution that needs to retain transaction logs for more than six months, and your security team frequently needs to look back at historical traffic for attack investigations. If you are building an enterprise-grade SOC and have a sufficient budget, Endace can serve as the underlying data infrastructure. It is not suitable for individual security enthusiasts, budget-constrained small and medium-sized businesses, or teams that only need real-time alerts rather than historical records. Since Endace does not offer a publicly available free trial, it is recommended to contact sales through the official website and request a PoC, or proof of concept, or a remote demo before purchasing to confirm whether its functionality meets your actual needs. For Chinese users, if invoice and network issues cannot be resolved, it may be better to first evaluate open-source alternatives such as Arkime, or purchase through an overseas subsidiary.