Blind spots in IT infrastructure: what is NDR and how does it help protect your data?
Updated: Oct 29
You have invested in a next-generation firewall and switched on every possible feature. You have installed proper malware protection on your computers and servers (ahead of the curve, you went straight for EDR). Do you think you have proper visibility of what is happening in your infrastructure?
If the solutions above are well configured, you are already in a better position than many, but there are still quite a few blind spots left uncovered.
Network detection and response (NDR) is a key technology for eliminating these blind spots: it lets you see what is happening at the network traffic level, especially in east-west traffic.
In this article, we cover:
What NDR is and what it is not
Who needs NDR and when
What must be in place before considering NDR
How to choose the right NDR and why we recommend Gatewatcher
What is NDR?
NDR (Network Detection and Response) is a cybersecurity technology that monitors and analyses network traffic in real time to detect threats based on behaviour, not just signatures.
It:
Collects network metadata (NetFlow, IPFIX, full packets, etc.)
Learns what is "normal" in your environment
Looks for anomalies such as lateral movement, command-line attacks, data exfiltration, etc.
Can detect threats even in encrypted traffic
Unlike traditional IDS/IPS systems, it does not rely only on known patterns: NDR understands context and can respond to unknown threats.
What is NDR not?
NDR does not replace:
EDR/XDR, which monitor endpoints
SIEM, which correlates logs from different systems
Firewalls or IPS, which apply rules or block known threats
NDR does not block traffic on its own (unless integrated with another system). Its strength lies in detection and visibility, which you can then act on with threat removal measures.
Who needs NDR, and for whom does it make sense?
A small business with 5 laptops and a router: not yet.
But if:
You have 50+ users, segmented networks or multiple VLANs
You have both cloud and on-prem infrastructure
Your network has IoT, OT or other unmanaged devices (e.g. cameras, HVAC, industrial automation)
You need to comply with the NIS2 regulation or the ISO 27001 security standard
You lack visibility of what is happening inside the network
... then NDR is the next logical step. It is especially useful for smaller teams that do not have the resources to comb through every log entry by hand.
What problems does NDR solve?
Attackers do not announce themselves loudly. They enter quietly through weak links (phishing, unpatched vulnerabilities, etc.) and move quietly within the network.
NDR helps to:
Detect anomalous traffic within the network
Detect lateral movement and scanning
Find malware and compromised devices
Expose shadow IT and suspicious devices
Discover data exfiltration, including over encrypted channels
Protect legacy or unmanaged systems
Most importantly, NDR reduces detection time (dwell time), which is critical for stopping an attack before greater damage is done.
BONUS: We have seen in practice how NDR helps make your existing cybersecurity investments pay off by detecting configuration errors in firewalls, IDS/IPS solutions, web application firewalls and so on. With NDR, you can quickly see when simple attacks that should not get past perimeter or endpoint protection still do so because of configuration errors.
When is the right time to implement NDR?
NDR is certainly not your first cybersecurity investment. It comes as part of the second or third layer of defence.
Consider NDR if you already have:
A next-generation firewall (e.g. Stormshield or Clavister) and VPN installed and configured
Endpoint and server protection (ideally EDR)
If you have visibility at the perimeter and on endpoints, but not of what happens between them, now is the right time.
A SOC is not a prerequisite: modern NDRs such as Gatewatcher provide clear views, context and integrations. Using a SIEM is not a prerequisite for NDR either.
How to choose an NDR, and why we chose and recommend Gatewatcher
Not all NDRs are equal.
When choosing, ask:
How transparent is the detection logic? Can I investigate why something was detected?
Does it support encrypted traffic analysis (TLS 1.3, decryption or TLS fingerprinting)?
How well does it integrate with a SIEM? Can it be used without a SOC?
Is the solution of European origin, to avoid political and data protection risks?
Replicant IT’s partner is Gatewatcher: an NDR solution created in France and used in EU critical infrastructure.
We chose Gatewatcher because:
It is transparent and easy to understand: unlike some "black boxes", you can investigate in depth why something was detected.
Its detection engine combines AI and rule-based approaches, enabling systematic analysis and significantly speeding up the process compared with platforms based on machine learning alone.
It scales from smaller networks to large organisations.
It has simple, clear licensing logic.
Gatewatcher complies with European regulations and data protection requirements, without the geopolitical risks of US technology.
If you want visibility, threat detection and response capability in your network, get in touch and test it!
NDR is the solution you need to eliminate the blind spot in one of the most important parts of the attack surface: the network. Once perimeter protection (firewall) and endpoint protection (EPP, EDR) are in place, it is time to think about how to ensure visibility, threat detection and response capability in the network. It is time to think about NDR.
If you would like to test Gatewatcher’s NDR, get in touch!
