# Can NetSenX detect threats in encrypted traffic?

Yes, from metadata: encrypted traffic is never decrypted. NetSenX looks at flow metadata and a few protocol fields — timing, volume, destinations and the TLS handshake — so beaconing and unusual data transfers stay visible without breaking encryption or reading content.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/can-netsenx-detect-threats-in-encrypted-traffic

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Can NDR detect threats in encrypted traffic without decrypting it?](https://netsenx.com/en/faq/can-ndr-detect-threats-in-encrypted-traffic-without-decrypting-it)
- [What does NetSenX read from an encrypted connection?](https://netsenx.com/en/faq/what-does-netsenx-read-from-an-encrypted-connection)
- [Do I need TLS decryption to detect threats?](https://netsenx.com/en/faq/do-i-need-tls-decryption-to-detect-threats)
- [Why not decrypt TLS traffic for inspection?](https://netsenx.com/en/faq/why-not-decrypt-tls-traffic-for-inspection)
- [What does TLS inspection on a firewall break?](https://netsenx.com/en/faq/what-does-tls-inspection-on-a-firewall-break)