Network detection and response (NDR) refers to a category of network security products that detect abnormal system behaviors by continuously analyzing network traffic. NDR solutions apply behavioral analytics to inspect raw network packets and metadata for both internal (east-west) and external (north-south) network communications.[1]
NDR is delivered through a combination of hardware and software sensors, along with a software or SaaS management console. Organizations use NDR to detect and contain malicious post-breach activity such as ransomware or insider malicious activity. NDR focuses on identifying abnormal behavior patterns and anomalies rather than relying solely on signature-based threat detection. This allows NDR to spot weak signals and unknown threats from network traffic, like lateral movement or data exfiltration.
NDR provides visibility into network activities to identify anomalies using machine learning algorithms.[2] The automated response capabilities can help reduce the workload for security teams. NDR also assists incident responders with threat hunting by supplying context and analysis.
Deployment options include physical or virtual sensors. Sensors are typically out-of-band, positioned to monitor network flows without impacting performance. Cloud-based NDR options integrate with IaaS providers to gain visibility across hybrid environments. Ongoing tuning helps reduce false positives. NDR competes against broader platforms like SIEM and XDR for security budgets. NDR can be used to complement EDR's blind spot.[3]
Key capabilities offered by NDR solutions include real-time threat detection through continuous monitoring, rapid incident response workflows to minimize damage, reduced complexity versus managing multiple point solutions, improved visibility for compliance and risk management, automated detection and response, endpoint and user behavior analytics, and integration with SIEM for centralized monitoring.
The origins of NDR trace back to network traffic analysis (NTA) solutions that emerged around 2019. NTA provided greater visibility into network activities to quickly identify and respond to potential threats.[4]
By 2020, NTA adoption was growing for real-time threat detection. That year, a study found that 87% of organizations used NTA, with 43% considering it a "first line of defense." The NTA market was valued at US$2.9 billion in 2022, and expected to reach US$8.5 billion by 2032. NTA evolved into NDR as a distinct product category. NDR combined detection capabilities with incident response workflows. This enabled detecting and reacting to threats across networks in real time.
Major attacks like WannaCry in 2017 and the SolarWinds breach in 2020 highlighted the need for solutions like NDR. Traditional perimeter defenses and signature-based tools proved insufficient against modern threats.
The use of artificial intelligence in NDR tools is growing, as security teams explore AI's potential to enhance NDR capabilities. Key AI use cases for NDR include:[5]
According to Gartner, NDR vendors include Cisco, Corelight, Darktrace, LinkShadow ExtraHop, Fortinet, IronNet, MixMode, Plixer, Trend Micro, Trellix, Vectra AI.