# Can antivirus or EDR alone catch lateral movement?

Partly. Endpoint detection and response (EDR) sees what happens on each machine where it runs, such as a remote-administration tool starting or credentials being dumped, and good EDR catches a lot of lateral movement that way. What it misses are the hosts without an agent, such as printers, cameras, appliances and unmanaged servers, agents that attackers have switched off, and movement that uses legitimate tools with valid passwords, which looks normal on each single machine. The network sees the relationship between hosts: a workstation suddenly opening administrative sessions to servers it never used. That is why the two work best together. NetSenX flags lateral movement and scanning on every plan, Free included, and from the Pro plan correlates hosts into one story; it does not see what runs inside a host, which remains the EDR's job.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/can-antivirus-or-edr-alone-catch-lateral-movement

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [Why is a flat network dangerous?](https://netsenx.com/en/faq/why-is-a-flat-network-dangerous)
- [Why do update agents and monitoring tools look like beaconing?](https://netsenx.com/en/faq/why-do-update-agents-look-like-beaconing)
- [What is DNS tunnelling?](https://netsenx.com/en/faq/what-is-dns-tunnelling)
- [Can data be stolen through DNS without anyone noticing?](https://netsenx.com/en/faq/can-data-be-stolen-through-dns-without-anyone-noticing)
- [Can malware hide in DNS over HTTPS, and can we still see it?](https://netsenx.com/en/faq/can-malware-hide-in-dns-over-https)