Leaders

High Performers

Contenders

Niche

Market Presence

Satisfaction

See Reviews

G2 Grid® Scoring

Network Detection and Response (NDR) Software Definition

Network detection and response (NDR) software is used to document business network activity for security threats and alert relevant parties or automate threat remediation. These tools work by monitoring east-west traffic and comparing them to established baselines. When traffic behavior deviates from normal functionality, the solution will detect the issue and assist in forensic investigation. Many tools include or integrate with other solutions that automate incident response processes to minimize the threat’s impact.

These tools are used by security professionals and IT staff to observe network traffic and detect anomalies related to user behavior. Other, older technologies may offer one component of network threat detection or incident response, but NDR combines the functionality of numerous security solutions. These tools use artificial intelligence and machine learning to analyze user behavior as well as existing security data; security professionals can then use that data to develop streamlined discovery and response workflows.

Network traffic analysis (NTA) is a similar emerging technology related to NDR. NTA is the core technology behind NDR; it refers to the analytical and monitoring capabilities used to develop baselines and response frameworks as NDR. But NTA solutions do not have the same level of response automation and end-user, behavioral anomaly detection used to trigger incident response. Endpoint detection and response (EDR) has a similar name, but products within that category only detect issues at the device level while NDR provides visibility to threats across the entire network.

To qualify for inclusion in the Network Detection and Response (NDR) category, a product must:

• Analyze network traffic in real time
• Utilize AI or ML to develop baselines for network behavior
• Automate threat and anomaly detection across the network
• Deploy network forensics upon detection for investigation and remediation

Network Detection and Response (NDR) Grid® Scoring Description

• Products in the Leader quadrant are rated highly by G2 users and have substantial Market Presence scores. Leaders include: Trend Vision One and Cisco Adaptive Wireless IPS Software
• High Performing products have high customer Satisfaction scores and low Market Presence compared to the rest of the category. High Performers include: Cisco Secure Network Analytics, ExtraHop, Corelight, Cortex XDR, Muninn AI Detect, CyberShark SOC-as-a-Service, Blumira Automated Detection & Response, and B1 Platform by CloudCover
• Contender products have relatively low customer Satisfaction scores and high Market Presence compared to the rest of the category. While they may have positive reviews, they do not have enough reviews to validate those ratings. Contenders include: Verizon Network Detection and Response and Arista NDR
• Niche products have relatively low Satisfaction scores and low Market Presence compared to the rest of the category. While they may have positive reviews, they do not have enough reviews to validate those ratings. Niche products include: Darktrace/Detect, InsightIDR, Vectra AI Platform, ManageEngine ADAudit Plus, NetWitness Platform, and Flowmon Platform