NetWitness started in 1997 as a research project for a U.S. intelligence agency. The mission was straightforward but ambitious: capture and analyze every bit of network communication, delivering real-time alerts to federal investigators. That pioneering approach became the blueprint for modern network visibility. For nearly 15 years, network traffic forensics remained at the heart of what we do, earning us credibility and trust with customers who needed clear answers in high-stakes environments.

In 2011, RSA Security acquired NetWitness and expanded its capabilities. With visibility as the foundation of strong cybersecurity, RSA brought Endpoint Detection and Response (EDR) and Security Information and Event Management (SIEM) into the NetWitness Platform. The result was a unified solution spanning networks, endpoints, and logs, designed to keep pace with an evolving threat landscape.

Today, NetWitness has transformed into one of the most comprehensive and flexible platforms for threat detection, investigation, and response. Built for the world’s largest and most security-driven organizations, it delivers unmatched visibility, deep context, and automated insights that give security teams the confidence to confront even the most advanced attacks.

With a legacy of innovation, we’re trusted by thousands of organizations, including 35 of the Fortune 100.