What should I ask when evaluating an NDR product?
Ask how it is priced, what it needs from you, what it cannot see, and how it proves an alert, and test it on your own network. Price: is it published, and what counts as a unit, a device, a sensor or a gigabit? Deployment: does it need hardware on every site, or can one sensor on a mirror port cover a segment? Visibility: which segments, encrypted traffic, cloud and remote laptops; ask the vendor to say plainly what is out of view. Alerts: does each one explain why it fired, and in words your team understands? False positives: how is the rate measured, and on whose data? Data: where is it stored, who are the sub-processors, what do you get back when you leave? Response: does it block, or only alert? Then run it for a few weeks on real traffic. NetSenX publishes its prices and has a Free plan with no time limit for that test.