Can NDR detect threats in encrypted traffic without decrypting it?

Yes, from metadata. Timing, volume, destinations and the TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. handshake stay visible when the content is encrypted, so beaconing to a command-and-control server and unusual data transfers can be detected without breaking encryption. What stays invisible is the content of the session.

This answer also appears, with more context, here: Encrypted traffic analysis

← All 40 questions on Encryption and encrypted trafficAll topics