NetSenX product capabilities
What NetSenX does on your network, and how you can check it
NetSenX watches how the hosts on your network behave, raises an alert when that behaviour looks like an attack, and explains every alert in plain language. Detection output passes through a conformal layer that states the confidence behind it, and every model version is recorded. Below is what each capability does, which plan it needs, and what it does not do.
Behavioural detection
Behaviour, not signatures
The engine scores how each host behaves on the network, so a new malware variant without a signature still leaves a trail.
It watches for the steps that come before data leaves: command-and-control beaconing, scanning, lateral movement and unusual outbound data volume.
NetSenX works alongside your EDR and SIEM. It adds the network view they do not have; it does not replace them.
Highlights
- Command-and-control (C2) beaconing
- Scanning and lateral movement
- Unusual outbound data volume
Bounded false positives
NetSenX Math Guarantee
A split-conformal layer derives a finite-sample false-positive bound on the alerts the engine surfaces, at a confidence level you configure, from benign traffic your analysts have labelled on your own network. The bound is a property of the construction, not a threshold tuned until the numbers looked good.
Each alert shows its confidence in plain words, together with the model version that produced it, and an alert whose score is not calibrated is labelled preliminary. Your auditors see the same evidence your team sees.
Your dashboard reports the bound your calibration data currently supports. When it supports none yet, the dashboard says so and names what would close the gap, instead of showing a figure it cannot back.
Highlights
- Split-conformal bound at a stated confidence level
- A plain not-yet-supported state instead of an invented number
- Included on every plan, Free included
Lateral movement
Network-wide correlation
Per-flow detection sees what happens on one connection. Attacks rarely stop at one host: after the first foothold, an intruder scans, signs in to the next machine and works towards the data.
From the Pro plan, NetSenX correlates the hosts on your network into a graph of who talks to whom, so lateral movement and groups of hosts beaconing to the same destination show up as one story instead of scattered alerts.
These alerts carry the hosts and connections behind them as evidence, ready for an incident write-up or a report to your authority.
Highlights
- Lateral movement and C2 clusters across hosts
- The hosts and connections behind each alert
- Named MITRE ATT&CK technique where one corresponds
Encrypted traffic
NetSenX TLS Fingerprint Engine
Attack tooling leaves a signature in the TLS handshake before it moves any data. From the Starter plan, NetSenX reads the handshake parameters and identifies suspicious clients at the handshake, before a payload is exchanged. The handshake is visible only where the agent captures packets: on Linux or as a sensor on a SPAN or TAP port, not in the basic mode used on macOS.
It works on encrypted connections without decrypting them: there is no interception proxy to run and no certificate to install on your devices.
One handshake feeds both the per-host behavioural score and the network-wide correlation.
Highlights
- Identification at the handshake, before any payload
- No TLS decryption
- Feeds per-host and network-wide detection
Plain-language triage
NetSenX AI Analyst Core
Many NDR alerts arrive as raw fields and leave as tickets. With the AI Analyst Core switched on, each alert gets a plain-language note: what happened, why it matters and what to do next.
Notes are written by version-pinned models whose lineage is recorded, and they are structured for CRA Article 14 and NIS2 Article 21 reporting, so the facts your incident report needs are already in one place.
It runs with your own AI provider key on every paid plan and is off until you set it up. Detection works without it.
Highlights
- A plain-language note per alert
- Structured for CRA and NIS2 reporting
- Model version recorded on every note
OT / ICS · Pro plan and up
Industrial protocols, observed passively
Modbus/TCP, DNP3, BACnet/IP, EtherNet/IP and S7comm are read from passive capture on a SPAN or TAP port.
Devices classified as OT are never actively probed, so there is no risk to PLCs or SCADA systems and nothing changes on the controllers.
OT traffic appears in the same dashboard as the IT network, with the same plain-language explanation on every alert.
Highlights
- Modbus/TCP, DNP3, BACnet/IP, EtherNet/IP, S7comm
- No active probing of OT devices
- From the Pro plan
Shadow AI · Pro plan and up
See which AI services your network uses
NetSenX flags traffic to external AI services and to language-model runtimes running on your own machines, so unapproved AI use becomes visible before it turns into a data-protection issue.
You see which host reached which AI service, when, and how much data moved. Encrypted traffic is never decrypted, so the content of a prompt stays unread.
Start by finding out what is actually in use; then write an AI policy your staff can follow.
Highlights
- External AI services and local model runtimes
- Which host, which service, how much data
- From the Pro plan
Evidence included
Audit-ready compliance
NetSenX tracks each incident against the NIS2 Article 23 deadlines — early warning within 24 hours, notification within 72 hours, final report within one month — and prepares a GDPR Article 33 breach notification for your DPO. Submitting reports stays with you.
Alerts, analyst decisions and configuration changes are written to an audit log you can hand to your auditor, and the evidence is organised for CRA, NIS2, GDPR and AI Act reviews.
SOC 2, ISO/IEC 42001 and ISO/IEC 27001 are in preparation; none is awarded yet, and we publish a date only once an audit is booked.
Highlights
- NIS2 deadlines tracked per incident
- Audit log of alerts, decisions and changes
- SOC 2, ISO 42001 and ISO 27001 in preparation
NetSenX Math Guarantee
A false-positive bound you can check, not a number you have to believe.
A split-conformal layer sits after detection and derives a false-positive bound on the alerts the engine surfaces, at a confidence level you configure, from benign traffic your analysts have labelled on your own network. Your dashboard reports the bound that data currently supports, and when the calibration set is too small it says so instead of showing a figure.
Split-conformal prediction
Each alert states its confidence in plain words, and says so when its score is not yet calibrated. Where the statistical guarantee applies, the false-positive bound among engine-surfaced alerts comes from the construction of the predictor at a stated confidence level; it is not a threshold tuned until the numbers looked good.
Model governance
Models are version-pinned and their lineage is recorded. The Math Guarantee belongs to the AI management system we are building to ISO/IEC 42001, not to a marketing footnote.
What we commit to
The mechanism and the evidence: the bound your calibration data supports, the sample size behind it, and a plain not-yet-supported state when it supports none. We do not publish a false-alarm figure we have not measured on your data.
Not yet calibrated
Too little analyst-labelled benign traffic to support any bound. The product says exactly that and names what would close the gap; it does not show a zero.
Active — wider bound
Calibration data supports a bound, but a looser one than the configured target. The product states that it stands behind the wider bound and still shows no figure, because the tighter target was never reached.
Active — target bound
Calibration size supports the configured confidence level. This is the one state that carries a number, and it never arrives alone: the bound, the count of audited samples behind it and the window they were measured over are shown together.
Awaiting recalibration
The calibration behind the bound has aged out, or the traffic it was built on has drifted from what the network looks like now. The bound is withdrawn until a fresh calibration replaces it; a stale number is not kept on screen because it used to be true.
Re-validating
A calibration update is being verified before it takes effect. The previous claim is withdrawn while that runs.
These are the states the product actually serves: no state reports a bound the calibration data does not support. We publish no comparison figures for other vendors, because we have not run those tests.
NetSenX AI Analyst Core
Every alert comes with a note an analyst can act on.
Raw alert data is paired with a plain-language note: what happened, why it matters and the recommended response, structured for your CRA Article 14 and NIS2 Article 21 reporting.
- alert.id
- ALR-2026-0521-04183
- alert.timestamp
- 2026-05-21T09:14:22+02:00
- alert.severity
- high
- alert.layer
- L1 behavioral + L3 graph
- src.host
- finance-srv-04.corp.local
- src.ip
- 10.42.18.27
- dst.fqdn
- delta-cargo-track[.]xyz
- dst.ip
- 185.244.62.117
- dst.tld_registered
- 2026-05-21T03:11:00Z (6h ago)
- protocol
- TLS 1.3 / HTTPS
- bytes.up
- 2.4 KB / 90s
- bytes.down
- 182 B / 90s
- pattern
- low-volume periodic beacon, jitter 5%
- detection.confidence
- 0.94
- conformal.bound
- served at the tenant's calibrated confidence level
Beaconing detected from finance-srv-04 to a previously unseen domain (delta-cargo-track.xyz) registered 6 hours ago. Outbound traffic is small, periodic and low-jitter: a pattern consistent with command-and-control after an initial compromise.
The graph layer also observed two peers on the finance subnet (finance-srv-02, finance-srv-09) looking up the same domain within the last 90 minutes.
Recommended response
- Isolate finance-srv-04 from the production VLAN.
- Capture a memory image before rebooting, for forensic review.
- Check the finance subnet for other hosts contacting the same domain or IP address.
- Open a ticket under your incident response runbook; the alert is already structured for CRA Article 14 incident logging.
See it on your own network
Start on the Free plan with up to 3 devices: no time limit, no credit card. Or book a 20-minute demo and we will walk a live alert from capture to analyst note, with the audit trail visible at every step.