# What gaps does EDR leave that only the network shows?

Devices without an agent, agents that have been switched off, and the traffic pattern of an attack spread over several machines. EDR (endpoint detection and response) reports from inside each computer where it runs. It cannot report from a printer, a camera recorder, a NAS, a building controller, a guest phone or an unmanaged laptop someone plugged in. It cannot report from a server where it was uninstalled or tampered with. And each agent sees one host, so a slow pattern that only makes sense across many hosts, such as one machine touching dozens of file shares or quietly calling out every five minutes, is easy to miss. The network sees all of these because every device has to talk to do harm. NetSenX watches that traffic and keeps a network map of the devices it sees. It does not see inside a host, so the two tools complement each other.

FAQ: [NDR, EDR, SIEM, XDR, MDR](https://netsenx.com/en/faq/tools) · https://netsenx.com/en/faq/what-does-the-network-show-that-edr-misses

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/blog/2026-09-24_ndr-vs-edr-vs-siem

## Related questions

- [What happens if attackers disable our EDR?](https://netsenx.com/en/faq/what-happens-if-attackers-disable-our-edr)
- [How do we notice when a server's endpoint protection goes silent?](https://netsenx.com/en/faq/how-to-notice-when-endpoint-protection-goes-silent)
- [What is XDR, and is it the same as NDR?](https://netsenx.com/en/faq/what-is-xdr-and-is-it-the-same-as-ndr)
- [What is MDR, and do we need it?](https://netsenx.com/en/faq/what-is-mdr-and-do-we-need-it)
- [What is the difference between MDR and EDR?](https://netsenx.com/en/faq/what-is-the-difference-between-mdr-and-edr)