What does network detection catch that antivirus misses?

Behaviour between machines, which antivirus on a single computer cannot see. Four patterns matter most. Beaconing: a host calling the same outside server at regular intervals, which is how attackers' software receives instructions (command and control, C2C2: command and control. The channel an attacker's software uses to receive instructions from the attacker's server.). Scanning: one device knocking on many addresses or ports to map your network. Lateral movement: a workstation suddenly opening administrative sessions to servers it never used, often with legitimate tools that antivirus allows. Unusual outbound volume: much more data leaving a host than normal, for example at night. Network detection also covers devices where no antivirus can be installed, such as printers, cameras and machines. NetSenX raises these four on every plan, Free included, and explains each alert in plain language. What it does not see is what happens inside a computer without touching the network, such as a malicious file being opened: that remains the job of antivirus or EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine..

← All 40 questions on NDR, EDR, SIEM, XDR, MDRAll topics