# NDR for small and mid-sized businesses

> What a small or mid-sized business needs from network detection and response, five questions to ask a vendor, and NetSenX plans with published prices.

Source page: https://netsenx.com/en/ndr-for-small-business

Last reviewed: November 7, 2026

NDR for a small or mid-sized business is network detection and response for a company without its own security operations centre. The detection is the same as in a large enterprise: watching the traffic between devices for scanning, lateral movement, command-and-control beaconing and unusual data leaving the network. What differs is everything around it. A team of one or two administrators needs alerts explained in plain language, coverage for printers, cameras and machines that cannot run an agent, and a price it can see before the first sales call.

## The fact to plan around

Under Commission Recommendation 2003/361/EC, a medium-sized enterprise has fewer than 250 staff and an annual turnover of up to EUR 50 million or a balance sheet total of up to EUR 43 million; a small enterprise has fewer than 50 staff and a turnover or balance sheet total of up to EUR 10 million. NIS2 (Directive (EU) 2022/2555, Article 2) generally applies from the medium-sized threshold upwards in the sectors of its Annexes I and II.

Source: [Commission Recommendation 2003/361/EC (definition of micro, small and medium-sized enterprises) — EUR-Lex](https://eur-lex.europa.eu/eli/reco/2003/361/oj)

## What one day without systems costs you

A figure in your own currency, from your own numbers, to set against a published price. Nothing you enter leaves your browser.

The fields start with example values, not with data about your company or your sector. Replace them with your own.

Lost revenue per day = annual revenue ÷ working days × share that stops ÷ 100. Idle staff per day = staff who cannot work × cost per person per day. Recovery cost per day = overtime and outside help. The recovery period multiplies the daily total by the days until systems are back.

### Detection at published prices

|  | A month | A year |
|---|---|---|
| Free | €0 | €0 |
| Solo | €19 | €190 |
| Starter | €49 | €490 |
| Pro | €99 | €990 |
| Business | €249 | €2,490 |
| Enterprise | from €999 | from €9,990 |

A month and a year of each plan, from the plan catalog. This is not a return-on-investment claim: detection does not prevent every outage, and the figures above are yours, not ours.

What NetSenX cannot do here: it does not shorten a restore or replace your backups and continuity plan. It shows an intrusion on the network early, while there may still be time to act before systems stop.

## Five questions to ask any NDR vendor

They apply whichever product you choose, NetSenX included.

1. **Are alerts explained in plain language?** A small team has no first-line analysts to translate raw fields. Ask to see a real alert: it should say what happened, on which host and why it was raised.
2. **Does it see devices that cannot run an agent?** Printers, cameras, door controllers and production machines are often the weakest part of a small network. A sensor on a SPAN or TAP port sees their traffic; an endpoint agent cannot be installed on them.
3. **Is the price published, and how are devices counted?** Ask for the monthly price and the counting rule before the first call. If one sensor on a SPAN or TAP port counts as one device, a small network needs only a few.
4. **Where is the data processed?** Network metadata includes IP addresses, which the Court of Justice of the EU has held can be personal data (Breyer, C-582/14). Ask where the data is stored, which sub-processors handle it and whether a data processing agreement is published.
5. **Can you try it on your own network?** A trial on your own traffic shows how many alerts a week you would really receive. Ask whether there is a free plan or a trial, and what it leaves out.

## Plans and published prices

From the NetSenX plan catalog: per month, in EUR, excluding VAT; annual billing gives two months free. A device is a host running the NetSenX agent; one agent on a SPAN or TAP port monitors a whole network segment and counts as one device.

| Plan | Devices | Alert history | Price per month |
|---|---|---|---|
| Free | 3 | 30 days | €0 |
| Solo | 1 | 60 days | €19 |
| Starter | 10 | 60 days | €49 |
| Pro | 25 | 90 days | €99 |
| Business | 100 | 365 days | €249 |
| Enterprise | Unlimited | Unlimited | from €999 |

## What NetSenX does today

- Detects scanning, lateral movement, C2 beaconing and unusual outbound data volume from network behaviour, on every plan, Free included.
- Sees devices that run no agent, such as printers, cameras and controllers, because one agent on a SPAN or TAP port watches the whole segment.
- Explains every alert in plain language, listing the network features that drove its score, on every plan.
- Stores customer data in the EU and publishes a data processing agreement under GDPR Article 28 with the full sub-processor list.

## What NetSenX does not do

NetSenX is not a managed detection service (MDR): an alert still needs someone on your side, or your IT provider, to investigate it. It does not replace endpoint protection (EDR) or backups, it sees only the segments you monitor and it never decrypts traffic. It does not decide whether NIS2 applies to your company.

## Questions buyers ask

### Does a small business need NDR?

Not every one does. A company with a handful of laptops and everything in the cloud may get more from endpoint protection and good backups. NDR earns its place when there is a local network with servers, printers, cameras or machines that cannot run an agent, or when NIS2 or a customer contract asks you to detect and report incidents.

### How much does NDR cost for a small business?

It depends on the number of devices and the features you need. NetSenX publishes its prices: the table on this page comes from the same plan catalog the product applies, from the Free plan to Enterprise.

### How are devices counted?

A device is a host running the NetSenX agent. One agent on a SPAN or TAP port monitors a whole network segment and counts as one device.

### Can a team without security specialists run NDR?

Yes, if the alerts are written for generalists. Every NetSenX alert explains in plain language what happened and lists the network features behind its score, on every plan. Investigating and containing an incident still needs someone: your administrator, your IT provider or an incident-response firm.

## Sources

- [Commission Recommendation 2003/361/EC (definition of micro, small and medium-sized enterprises) — EUR-Lex](https://eur-lex.europa.eu/eli/reco/2003/361/oj)
- [Directive (EU) 2022/2555 (NIS2), Articles 21, 23 and 41 — EUR-Lex](https://eur-lex.europa.eu/eli/dir/2022/2555/oj)
- [Court of Justice of the EU, Case C-582/14 (Breyer), judgment of 19 October 2016 — EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0582)

This page is general information, not legal advice. Check your obligations with your national authority or legal counsel.

## Related pages

- [What is NDR?](https://netsenx.com/en/what-is-ndr)
- [How to tell if someone is inside your network](https://netsenx.com/en/is-someone-inside-your-network)
- [NIS2 network monitoring](https://netsenx.com/en/nis2-network-monitoring)
- [EU data residency](https://netsenx.com/en/eu-data-residency)
- [Pricing and the Free plan](https://netsenx.com/en/pricing)