NDR stands for network detection and response. It reads the traffic moving inside your network, not just what crosses the perimeter or what happens on a managed laptop. This page explains what that buys you, in plain terms.
MITRE ATT&CK techniques covered: T1071 Application Layer Protocol · T1021 Remote Services · T1046 Network Service Discovery · T1048 Exfiltration Over Alternative Protocol
NDR stands for network detection and response. It is a security capability that watches the traffic moving inside a network, identifies behaviour that indicates an intruder, and gives you something to act on. It is passive: it reads a copy of the traffic and sits outside the path packets actually take.
The acronym is heavily overloaded, which is worth clearing up because two of the other meanings are far more commonly searched than this one:
These are complementary, not competing. The useful question is which one can see the thing you are worried about:
An attacker inside your network has choices about almost everything. They can pick a host with no agent installed. They can disable or blind an agent that is installed. They can work from a device that could never run one, such as a printer, a camera, an ESXi host or a programmable controller. They can stay inside living-off-the-land tooling that looks like ordinary administration.
What they cannot do is move without using the network. Finding the file shares is network traffic. Reaching the finance system is network traffic. Calling home for instructions is network traffic. Taking the data out is network traffic. That is the whole argument for NDR: it watches the one layer the attacker has to use.
This is not a criticism of your existing stack. EDR is the right tool for what happens on a host, and a firewall is the right tool for the boundary. These are simply the things that sit outside both:
The sensor is passive. It receives a copy of traffic from a SPAN or mirror port on a switch, or from your cloud provider's traffic-mirroring feature. It is never placed inline, so it is not in the path of a single production packet. If the sensor is switched off, unplugged or fails outright, your network does not notice.
There is nothing to install on any server, workstation or controller. Deployment is a mirror configuration and a sensor, and the sensor can sit on your own premises as an appliance or in a cloud region you choose.
One honest caveat we would rather you hear from us: cloud packet mirroring is not equally complete on every platform. In our own testing, one major provider's mirroring does not deliver the reply side of connections that the instance itself initiated, which makes any detection that depends on reading the response blind on that platform. We test per platform and tell you what your feed actually contains before you buy anything.
Network detection and response. In other contexts the same three letters mean non-delivery report, the bounce message from an email server, or net dollar retention, a subscription-revenue metric. In security it is always network detection and response, and it is sometimes written NDR security to be clear.
A capability that reads the traffic moving inside a network, identifies behaviour consistent with an intruder, and reports it with the hosts and times involved. It is passive - it receives a copy of traffic and is never in the path - so it can observe every device that communicates, including the ones that can never run security software.
A switch is configured to send a copy of traffic to a sensor, usually through a mirror or SPAN port or a network tap. The sensor reconstructs the conversations, records what each one was, and applies detection to the behaviour: who contacted whom, how often, in what pattern, carrying how much. Nothing is installed on any monitored device.
EDR runs an agent on a host and sees what happened inside it. NDR needs no agent and sees what moved between hosts. Each is blind where the other is strong: EDR cannot see a printer, a camera, a hypervisor or a controller, and NDR cannot see what a process did in memory. Most organisations should have both.
XDR is a correlation layer across several telemetry sources, normally anchored on one vendor's endpoint product. It is an integration strategy rather than a sensor, and it is only as good as what is fed into it. Network telemetry is a frequent gap underneath an XDR, which is why the two are usually bought together rather than instead of each other.
No. A SIEM stores and searches logs that other systems generate. If nothing wrote a log for an event, the SIEM has nothing to find. NDR generates its own evidence from the traffic itself, which is why it catches activity between two machines that neither logs nor reports.
An IDS or IPS matches traffic against signatures of known attacks, usually at the perimeter. NDR works on behaviour rather than signatures and looks at internal traffic as well as traffic crossing the boundary, which is where an intruder spends most of their time once they are in.
No. The sensor reads a mirrored copy of network traffic. Nothing is installed on any host, which is also why it works on devices that can never run an agent.
It cannot. The sensor is never inline; it only receives a copy of traffic. Removing it or having it fail has no effect on the traffic path. The one thing to plan properly is the mirror configuration on the switch itself, which we walk through with your network team.
Signature and protocol findings appear on the first day, because they do not need history. Behaviour baselines take longer, since they have to learn normal first.
Tell us whether you suspect something is already inside, or whether you want to measure what your current tools would catch. Either way you get a concrete next step.
Contact us