Do I need NDR if I already have EDR?

Often yes, because EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine. and NDRNDR: network detection and response. Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker. fail in different places. EDR (endpoint detection and response) only sees machines where its agent runs and is healthy. It does not see printers, cameras, phones on the Wi-Fi, building systems, machines or a contractor's laptop, and attackers often switch it off first on the machine they take over. NDR (network detection and response) watches the traffic between devices, so it still sees a compromised host calling an outside server, scanning the network or copying data out, whatever happens to its endpoint agent. If your company is a handful of laptops with everything in the cloud, EDR and good backups may be enough for now. If you have a local network with servers and devices you cannot install anything on, NDR fills the gap. NetSenX raises beaconing, scanning, lateral movement and unusual outbound volume on every plan, Free included, so you can see what it adds on your own network before paying.

This answer is part of the guide: NDR vs EDR vs SIEM (and XDR, MDR): how they differ

← All 40 questions on NDR, EDR, SIEM, XDR, MDRAll topics