What is NDR, and what does it see that your other tools do not?

The wire is the one place an intruder cannot avoid

An attacker inside your network has choices about almost everything. They can pick a host with no agent installed. They can disable or blind an agent that is installed. They can work from a device that could never run one, such as a printer, a camera, an ESXi host or a programmable controller. They can stay inside living-off-the-land tooling that looks like ordinary administration.

What they cannot do is move without using the network. Finding the file shares is network traffic. Reaching the finance system is network traffic. Calling home for instructions is network traffic. Taking the data out is network traffic. That is the whole argument for NDR: it watches the one layer the attacker has to use.

What NDR sees that endpoint and perimeter tools do not

This is not a criticism of your existing stack. EDR is the right tool for what happens on a host, and a firewall is the right tool for the boundary. These are simply the things that sit outside both:

• Lateral movement. One internal host authenticating to another, across shares and remote services, is invisible at the perimeter and easy to misread as normal administration on a single endpoint.
• Command-and-control beaconing. Including deliberately slow channels that check in at long intervals specifically to stay under volume-based alerting.
• Tunnelled channels. Control and data hidden inside DNS queries or ICMP payloads, both of which routinely pass straight through web filtering.
• Agentless and unmanageable devices. Controllers, sensors, cameras, printers, appliances, network kit and building systems. No agent will ever run there.
• Protocol-level misuse. A service running on a port that does not match its protocol, or an industrial command that should never have been sent on that link.
• Data leaving to somewhere new. Unfamiliar destinations, asymmetric volumes, and uploads to cloud and AI services nobody approved.

How it deploys, and why it cannot break anything

The sensor is passive. It receives a copy of traffic from a SPAN or mirror port on a switch, or from your cloud provider's traffic-mirroring feature. It is never placed inline, so it is not in the path of a single production packet. If the sensor is switched off, unplugged or fails outright, your network does not notice.

There is nothing to install on any server, workstation or controller. Deployment is a mirror configuration and a sensor, and the sensor can sit on your own premises as an appliance or in a cloud region you choose.

What you actually receive

• Attack Stories that correlate reconnaissance, command and control, lateral movement and impact into one narrative rather than a queue of disconnected alerts.
• MITRE ATT&CK and ATT&CK for ICS mapping on findings, so your reporting lines up with the framework your auditors already know.
• Executive, incident and technical reports written in clear English, so the same finding can go to a board and to an engineer.
• The evidence underneath every finding, because a verdict you cannot check is not worth much.