1 Executive Summary

Almost all enterprises have many security tools in place already, many of which are still focused on perimeters/demilitarized zones (DMZs) and on hosts, such as servers and endpoints. Endpoint Protection Detection & Response (EPDR) tools are commonplace in enterprises, mid-market, and small-to-medium businesses (SMBs). Many organizations today are looking for security tools that provide additional visibility at the network layer. Some use legacy Intrusion Detection/Prevention Systems (IDS/IPS), sometimes for both hosts and networks. However, these solutions require intensive labor for rule creation, maintenance, and monitoring. IDS/IPS often generate many false positives. Thus, companies conducting request for proposals (RFPs) for network layer security tools are looking for more advanced Machine Learning (ML)-enhanced tools to reduce both the labor needed for analysis and false positives, as well as add value by improving anomaly detection and overall security posture. Most modern enterprises have a mix of on-premises networks and cloud-based resources to cover with network layer security solutions. NDR tools are the newer generation of IDS/IPS-like tools which utilize more comprehensive methods including ML to discover and respond to malicious activities within enterprises.

NDR solutions are specialized for the monitoring and analysis of network traffic, with the objective of detecting and responding to suspicious activities and potential threats. Unlike EPDR tools, which focus on individual devices, NDR solutions operate at the network level to identify anomalies and potential breaches based on traffic patterns, metadata, and communication between devices. This enables NDR tools to identify threats that might bypass endpoint protection or originate from compromised internal systems. Additionally, they are designed to manage the high volume of data present in network traffic, using advanced analytics and ML to identify unusual behaviors that could indicate an attack. For instance, NDR can detect the lateral movement of an attacker across various devices by analyzing network traffic patterns, which endpoint solutions may not be able to identify if they rely solely on local data.

Extended Detection and Response (XDR) solutions build on the capabilities of NDR by integrating data and insights from a range of security domains, such as network, endpoint, cloud, identity, and operational technology (OT). XDR is designed to provide a more unified and comprehensive view of the security landscape, allowing for correlated detection and response across different layers. By aggregating and analyzing data from these diverse sources, XDR can provide a more comprehensive view of threats, reduce the time to detect and respond, and improve overall incident management. In short, while NDR focuses on the network layer, XDR extends these capabilities across the entire security environment and enhances the ability to identify sophisticated, multi-vector attacks that span multiple security domains.

As a result, most vendors now include NDR as part of their XDR suite, recognizing the value of integrating network traffic analysis with security data from other domains. This approach offers a more comprehensive and effective detection and response capability, allowing for better correlation of events and anomalies across different environments. Vendors recognize that a unified approach leveraging NDR within XDR can improve threat detection, reduce response times, and optimize security operations by providing a holistic view of an organization's threat landscape.

NDR solutions are essential for use cases that involve monitoring and securing network traffic to detect advanced threats, such as malware implantation, botnet and fraud activity, lateral movement, DNS tunneling, data exfiltration, zero-day exploits, and other sophisticated TTPs. NDR is also useful for detecting policy violations, insider threats, and unusual behaviors that might indicate potential breaches, as well as facilitating post-compromise investigations and forensic analysis.

In addition to the standard capabilities, today's NDR solutions are expected to include advanced ML and artificial intelligence (AI) algorithms that can analyze high-volume network data in real-time to detect and respond to sophisticated threats. The flexible and scalable deployment options for OT and critical infrastructure environments provide enhanced versatility for NDR solutions. The extensive understanding of protocols, including those utilized in industrial control system (ICS), internet of things (IoT), and industrial internet of things (IIoT) settings, is also an advantage for those solutions which encompass those areas. NDR-as-a-Service or managed detection and response (MDR) offerings provide flexible and affordable management options for organizations that lack extensive in-house IT expertise. The use of generative AI and large language models (LLMs) facilitates the investigative and reporting processes, offering potentially intuitive and detailed insights into network traffic and potential threats.

Organizations that would benefit from acquiring an NDR solution include those with complex or large-scale network environments. These mainly include large enterprises with extensive internal networks, multi-cloud infrastructures, and numerous remote offices. SMBs with rapidly expanding information technology (IT) environments can also benefit from NDR solutions to gain deeper insight into their networks. Organizations in industries with stringent security and compliance requirements, such as finance, healthcare, and critical infrastructure, rely on NDR solutions for their advanced threat detection and response capabilities. Additionally, businesses facing frequent and sophisticated cyber threats should consider NDR solutions. For both SMBs and large enterprises, MDR can serve as an alternative to NDR by providing threat detection and response capabilities without the need for internal deployment of NDR solutions.

For more information on our research approach, see KuppingerCole Leadership Compass Methodology.

1.1 Key Findings

The key findings in this Leadership Compass on NDR solutions are:

• NDR tools can detect threats that might bypass endpoint protections or originate from other compromised systems.
• NDR is designed to manage high data volumes using advanced analytics and ML models to identify unusual behaviors indicative of attacks.
• In comparison to NDR, XDR offers a more unified and comprehensive view of the security landscape, resulting in enhanced threat detection, reduced response times, and optimized incident management.
• Many vendors now include NDR as part of their XDR suites.
• NDR solutions incorporate advanced ML and AI for real-time data analysis, flexible deployment options for OT environments, and enhanced protocol understanding for ICS, IIoT, and IoT.
• Modern NDR sensor deployment strategies include edge computing, virtual/cloud-based sensors, AI/ML integration, and minimizing performance impact through passive sensors.
• Organizations with complex or large-scale network environments, stringent security requirements, or rapid organizational growth can benefit from NDR.
• The emergence of 5G networks and the widespread use of IoT devices have further expanded the attack surface, necessitating more advanced network monitoring solutions.
• Despite its growth, the NDR market faces challenges such as deployment complexity, high costs, privacy concerns, and regulatory requirements, which can be barriers for smaller organizations.
• The market is witnessing consolidation through acquisitions by major players like OpenText, Sophos, and Arista Networks, who are integrating innovative technologies from startups.