# Can network access control (NAC) replace network monitoring?

No, they do different jobs. Network access control (NAC) decides which devices may join the network and which segment they land in, often using 802.1X, device certificates or a check of the device's health. It does not watch what an admitted device does afterwards, and most intrusions use devices and accounts that were let in legitimately: a phished laptop, a supplier's account, a printer with old firmware. Use both if you can: NAC to keep unknown devices out and put known ones in the right place, monitoring to see when a known device starts behaving like an intruder. For a small company, NAC can start simply, with port security on switches and certificate-based Wi-Fi. NetSenX covers the monitoring part: it flags scanning, lateral movement and beaconing from admitted devices on every plan, and its network map shows the devices seen on monitored segments.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/can-network-access-control-replace-monitoring

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Does a VPN contradict zero trust?](https://netsenx.com/en/faq/does-a-vpn-contradict-zero-trust)
- [What is zero-trust network access (ZTNA)?](https://netsenx.com/en/faq/what-is-zero-trust-network-access-ztna)
- [Is a firewall still needed if we have zero trust or SASE?](https://netsenx.com/en/faq/is-a-firewall-still-needed-with-zero-trust-or-sase)
- [How do segmentation and least privilege limit lateral movement?](https://netsenx.com/en/faq/how-does-segmentation-limit-lateral-movement)
- [Where do I start segmenting a flat office network?](https://netsenx.com/en/faq/where-to-start-segmenting-a-flat-office-network)