Network Security · Advanced
Network Detection & Response (NDR)
AI traffic analytics for hidden threats.
9 options listedTypical cost: $50k-$300k/yrDETECT (DE)
Overview
NDR baselines east-west and north-south traffic to surface lateral movement, C2, and anomalies that evade signatures. It complements EDR and SIEM by watching the wire rather than the host. Pricing scales with monitored bandwidth and sensor count. Increasingly folded into XDR platforms.
Adds wire-level detection once a SOC/MDR can act on the signals.
Advantages
- Catches lateral movement and C2 that signatures miss
- Darktrace self-learning, Vectra strong identity/attack signal
- agentless deployment.
Trade-offs
- Expensive at bandwidth scale
- can be noisy or black-box
- needs analysts to action alerts
- overlaps XDR capabilities.
Vendors & tools in this area
Cisco (Secure Network Analytics)Commercial
Broad portfolio (firewall, ISE, Umbrella, Duo, Splunk); strong in Cisco shops.
Visit site →Corelight (NDR, Zeek-based)Commercial
Commercial NDR platform built by Zeek's original creators, wrapping Zeek/Suricata/YARA into a managed sensor fleet.
Visit site →Arista NDRCommercial
AI-driven NDR platform (formerly Awake Security) now part of Arista's cognitive networking/switch portfolio.
Visit site →