Networks have a cruel sense of humor. They are most invisible when everything works and suddenly become the entire company when something does not. A game lags. A checkout page stalls. A cloud bill swells. Somewhere, an engineer opens six dashboards and a spreadsheet while a conference call fills with people asking the same question in different accents: is it the network?
Kentik built its business around shortening that conversation. The San Francisco company collects the exhaust that routers, switches, firewalls, clouds and active tests already produce - traffic flows, BGP routes, interface counters, logs, traces and performance measurements - then stores, enriches and queries it as one body of evidence. Its customers include enterprises whose applications cross the public internet and service providers whose product is the network itself. Akamai, Booking.com, Dropbox, Zoom, GoDaddy and Square Enix are among the names Kentik publicly lists.
This is not consumer software. The public Pro plan starts at $2,000 a month, billed annually, and larger deployments require a quote. But the relevant comparison is rarely a $9 app. It is the cost of excess transit, a missed attack, an overbuilt circuit or 40 engineers spending an afternoon proving that their particular layer is innocent.
A search engine for packet footprints
Kentik began in January 2014 as CloudHelix. Co-founders Avi Freedman, Ian Applegate and Ian Pye had interviewed network operators about the tools they wished existed. The answers were practical: keep high-resolution history for longer, accept richer data, remain open to queries and serve more than the tiny priesthood fluent in legacy traffic tools. Justin Biegel soon joined as the fourth co-founder and led customer outreach.
The first product, Kentik Detect, emerged in 2015. It accepted flow records from network devices and made them searchable at a scale that appliance-era products struggled to match. Yelp, Box, OpenDNS and Neustar were early paying customers. The company’s original trick was not inventing NetFlow. It was treating the records less like exhaust to sample and discard, and more like a dataset worth keeping.
That architecture let an operator ask where traffic came from, where it went, which customer or service drove it and how behavior changed over time. Results that once took minutes could arrive in seconds. The distinction sounds small until an attack is growing, an executive is waiting or an expensive transit link is approaching its billing peak.
“In 2021, we had no visibility. We were guessing.”Steve Orlando · CEO, Seaborn Networks
The first thing to fail was the appliance
Kentik’s founding critique was aimed at monitoring boxes with finite memory, sampled data and narrow baselines. A device could report what passed through it, but modern applications did not respect the edge of one box. They crossed data centers, carriers, content-delivery networks and, later, multiple public clouds. An attack distributed across several connections could look modest from each local vantage point while remaining obvious in aggregate.
Cloud computing made the mismatch harder to ignore. Ownership fractured: an application team controlled code, a platform team ran Kubernetes, a cloud team managed accounts, and the network team still received the page when latency climbed. Kentik changed its mind about the size of the job. Flow analytics was a useful wedge, not a complete operating picture.
The company added synthetic monitoring in 2020, cloud observability in 2021 and a modern NMS in 2024. Kentik NMS brought device health, SNMP, streaming telemetry, syslog and traps into the same investigative environment as traffic. Kentik Protect covered DDoS detection and mitigation workflows. Kentik Cloud mapped paths and costs across AWS, Azure, Google Cloud, OCI and on-premises infrastructure. Synthetics supplied active evidence through tests such as ping and traceroute.
The $4 million answer
The most revealing Kentik case study is about money, not uptime. Seaborn Networks operates submarine fiber routes connecting the Americas. Its executives said the company once priced service partly from market instinct because it lacked a granular view of where customer traffic traveled and what each route cost to deliver. Top-line growth could conceal an unprofitable customer.
Kentik’s Traffic Costs workflow joined contracts and network links to flow dimensions such as customer, ASN, geography and path. That let Seaborn see effective delivery cost, identify expensive routes and make different peering, purchasing and pricing decisions. The company says those changes reduced annual network costs by $4 million.
The chart above is illustrative, but the progression is real. Raw counters matter to an engineer. A route connected to a customer and a contract matters to engineering, sales and finance. That broader audience is part of Kentik’s difference from a generic observability suite: it enriches telemetry with internet-routing and peering context that is native to the network business.
Other public examples land closer to operations. GoDaddy standardized on Kentik for traffic engineering, capacity planning, forensics and DDoS detection after running it beside a legacy tool. Midco says consolidating workflows and using AI Advisor reduced its time to insight by more than 60 times. Square Enix uses the platform to inspect traffic across points of presence, data centers, cloud providers and its core while millions of players expect low latency.
An adviser, not an autopilot
Kentik’s 2025 AI Advisor release recast the interface around a question. A user can ask why latency spiked in Frankfurt. The agent plans an investigation, chooses tools, queries flow, routes, device metrics, cloud paths or synthetic tests, and returns an explanation with data the operator can inspect. Runbooks add local knowledge; an API, Slack access and MCP support bring investigations into existing workflows.
The restraint is important. AI Advisor recommends actions but does not automatically change the network. It also cannot reason over evidence it never received. If a customer sends flow but not device metrics, questions requiring both remain partly blind. Kentik itself says the adviser is strongest when Core, NMS, Cloud and Synthetics are connected.
That is the condition under which the playbook fails: a small, simple network may not justify an annual enterprise contract; a team without clean telemetry will automate confusion; and a buyer seeking one generic tool for every layer may prefer a broad observability suite. Kentik is most convincing where the network is large enough, distributed enough and expensive enough that context changes decisions.
A specialist in a crowded rack
Kentik sits between several familiar tool categories without fitting neatly inside one. Datadog and New Relic begin closer to applications, logs and infrastructure metrics, then add network views. ThousandEyes specializes in active internet and digital-experience testing. NETSCOUT, SolarWinds, Broadcom, Riverbed, LiveAction, Plixer, Auvik and Forward Networks approach the problem through different combinations of packets, flows, devices, paths and configuration. A determined team can also assemble collectors, Prometheus, Grafana and vendor utilities into a capable internal stack.
The trade is breadth against network depth and operating effort. A broad suite may reduce vendors and connect an incident to application traces. A self-managed stack offers control and can cost less in license fees, provided the team is willing to own ingestion, storage, enrichment and upgrades. Kentik’s case is sharper: SaaS retention at high cardinality, internet-routing context, provider economics and one investigation that can cross flow, device health, cloud paths and synthetic tests. It is designed for the moment when “the network” is not one place.
That positioning also explains the annual contract. Kentik is not selling a prettier ping graph to a small office. It is selling less time between an anomaly and an answer across infrastructure where minutes, routes and percentage points of utilization carry real cost. Buyers should test that claim with their own telemetry, their own slow investigations and a before-and-after total-cost model. A successful proof should retire work, not merely add another tab.
“The single pane of glass is dead.”Justin Ryburn · Field CTO, Kentik
What builders can copy
Kentik’s expansion offers a disciplined product lesson. Start with one painful dataset that customers already generate. Make the slow question fast. Preserve access to the underlying evidence. Then expand into adjacent decisions - security, capacity, cloud performance and cost - without pretending that one dashboard can understand every domain.
The portable Kentik playbook
- Interview operators for the questions their existing tools cannot answer, not a wish list of features.
- Turn existing exhaust into durable data before asking customers to deploy another proprietary source.
- Add business context so a technical signal can change a financial or customer decision.
- Make AI show its evidence and keep consequential actions under human control.
Kentik raised roughly $102 million across seed, Series A, Series B, growth financing and a $40 million Series C. In August 2026, Infoblox completed its acquisition of the company for an undisclosed price. The pairing has a clear logic: Infoblox knows what assets are on the network and how DNS intends to connect them; Kentik sees how traffic actually moves and services perform.
Integration is now the risk. Product combinations sound tidy in announcement language and become difficult in permissions, data models and sales packaging. If Infoblox preserves Kentik’s depth while joining asset identity to live behavior, the result could make agentic operations more grounded. If it flattens that specialty into a broad suite, customers may get the pane of glass Kentik just declared dead.
Keep exploring
See the product, follow the engineers and watch the system at work.