# Do I need TLS decryption to detect threats?

Not for many of them. Who talks to whom, when, how often and how much, together with the unencrypted TLS handshake and DNS answers, stays visible without decryption. That is enough to see beaconing to a command-and-control server, scanning, lateral movement between internal hosts and unusual uploads, which are steps most intrusions take before they do damage. Decryption is needed to see content, such as a malicious file inside a download or the text of a command, and it brings costs: an interception proxy that holds keys and decrypted data, a company certificate on every managed device, apps that break, privacy and works-council questions, and blind spots on unmanaged devices. Many companies get better value from endpoint protection for files and processes on each machine, plus network detection for behaviour across all devices. NetSenX never decrypts traffic: its core detections run on every plan, and TLS fingerprints from the Starter plan where the agent captures packets.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/do-i-need-tls-decryption-to-detect-threats

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Why not decrypt TLS traffic for inspection?](https://netsenx.com/en/faq/why-not-decrypt-tls-traffic-for-inspection)
- [What does TLS inspection on a firewall break?](https://netsenx.com/en/faq/what-does-tls-inspection-on-a-firewall-break)
- [Can deep packet inspection work on encrypted traffic?](https://netsenx.com/en/faq/can-deep-packet-inspection-work-on-encrypted-traffic)
- [Can malware be detected from flow statistics alone?](https://netsenx.com/en/faq/can-malware-be-detected-from-flow-statistics)
- [Can encrypted traffic reveal what is inside it?](https://netsenx.com/en/faq/can-encrypted-traffic-reveal-what-is-inside)