As AI infrastructure pushes enterprise data centre networks towards 400 Gbps, ExtraHop is targeting a growing security challenge: how to maintain full visibility across increasingly dense, high-speed east-west traffic without relying on sampling.
The race to build faster, denser AI infrastructure is creating a new challenge inside the data centre: security systems must now keep pace with networks moving unprecedented volumes of traffic between GPUs, servers, storage platforms and distributed workloads.
ExtraHop has responded with a 400 Gbps sensor designed to analyse enterprise data centre traffic at line rate, positioning its RevealX network detection and response (NDR) platform for the high-speed environments underpinning AI and cloud computing.
Scheduled for general availability in Q4 2026, the sensor is designed to ingest and analyse traffic without the sampling commonly used when security infrastructure cannot process the full volume crossing a network.
That distinction is becoming increasingly important as data centre architecture changes.
Enterprise facilities and neocloud environments are moving towards 400 Gbps networking to accommodate bandwidth-intensive AI workloads. GPU clusters, Kubernetes environments, model training, inference pipelines and communications between AI agents are generating increasingly dense east-west traffic within facilities.
For data centre operators, the result is not simply a networking challenge. It creates a potential visibility gap between the speed at which infrastructure operates and the capacity of security tools monitoring it.
ExtraHop said many detection and response systems remained centred on 100 Gbps environments, potentially requiring organisations to sample traffic or deploy clusters of monitoring infrastructure as network speeds increase.
The company argues that this can create blind spots in precisely the areas where modern attacks may be hardest to identify, including lateral movement between systems, identity compromise and ‘living-off-the-land’ techniques that exploit legitimate tools already present inside an environment.
AI changes the data centre traffic equation
The problem is being intensified by the rapid construction and expansion of AI-ready data centres.
AI infrastructure depends heavily on high-bandwidth, low-latency connectivity between compute resources. As organisations deploy increasingly powerful GPU clusters, enormous quantities of data move laterally across the data centre rather than simply travelling north-south between facilities and external users.
Chris Konrad, Vice President Global Cyber at World Wide Technology, said increasing AI workloads were putting existing security infrastructure under pressure.
“AI is compounding the volume of data moving across our infrastructure every day, and our security tooling has not kept pace with our data center,” he said.
“Complete visibility at this scale is no longer optional post-Mythos. AI-powered attacks move at record speed, and the AI-powered systems need to be able to tell the difference between a quiet network and a network they are only partially seeing.”
ExtraHop’s approach is to analyse data centre traffic at the full 400 Gbps line rate and convert the information into a continuously updated map covering devices, identities, workloads and network conversations.
Rather than requiring security operations centre (SOC) tools or AI agents to interpret raw network feeds, RevealX structures the information so that security systems can query it through APIs and Model Context Protocol (MCP).
Agents can then move deeper into the underlying evidence when required, accessing behavioural detections, asset information, protocol metrics, activity maps, Layer 7 transaction records and packet capture.
ExtraHop said RevealX supports more than 90 protocols.
The architecture is intended to address another emerging issue for data centre operators: the use of autonomous AI agents in cybersecurity.
As security systems become capable of investigating threats and taking action automatically, the quality and completeness of the information supplied to those systems becomes critical. An autonomous agent operating on incomplete telemetry could reach an incorrect conclusion and act on it almost immediately.
At data centre scale, where thousands of workloads and devices may be involved, that risk can multiply rapidly.
Building security for machine-speed infrastructure
Kanaiya Vasani, Chief Product Officer, ExtraHop, said the industry had concentrated heavily on adding AI to existing SOC environments while paying less attention to the underlying data feeding those systems.
“The reflex across the industry has been to bolt AI onto the SOC we already have, and the harder problem is the context substrate underneath,” he said.
“SIEMs, forensic data lakes and security warehouses are built to look backward. They are valuable as depth and memory, but they cannot be the first and only source of truth for an agent that has to decide something right now.”
Vasani said providing complete evidence at 400 Gbps could allow security agents operating across large networks to make decisions using a fuller picture of activity rather than sampled information.
The sensor also forms part of ExtraHop’s approach to the Agentic SOC Alliance’s three-layer Context, Harness and Model architecture, with the 400 Gbps capability sitting within the Context layer.
For data centre operators, one practical implication could be infrastructure consolidation.
Higher-capacity monitoring could reduce the number of sensors required to cover high-speed networks, potentially lowering hardware requirements and operational complexity. ExtraHop also wants the platform to provide a common real-time view that can be used by both SOC and network operations centre (NOC) teams.
The system continuously discovers network activity including large language model usage, MCP servers, tool endpoints and communication between AI agents, effectively creating a live inventory of emerging AI infrastructure.
That capability could become increasingly significant as AI workloads spread beyond dedicated clusters and become embedded across enterprise data centre estates.
Visibility becomes a data centre requirement
The launch reflects a wider change in the requirements being placed on data centre networks.
The industry’s transition from traditional enterprise computing towards cloud-native and AI-intensive infrastructure is driving higher port speeds and substantially greater volumes of east-west traffic. Security monitoring infrastructure must therefore scale alongside switches, servers, accelerators and storage.
The issue is particularly acute for facilities supporting AI training and inference, where the economic value concentrated within GPU infrastructure makes the environment an increasingly important security target.
For operators, simply installing faster networking equipment is consequently only part of the transition to AI-ready infrastructure. Monitoring, observability and cybersecurity platforms also have to operate at comparable speeds if organisations are to maintain visibility as network density increases.
ExtraHop’s move to 400 Gbps illustrates how that requirement is beginning to reshape the security layer of the modern data centre.
As compute infrastructure accelerates and autonomous systems assume greater responsibility for defending it, the ability to see what is happening across the network in real time could become as fundamental to AI data centre architecture as power, cooling and connectivity.
