Problems we solve
The problems you came here with
Written for the people who will run NetSenX: an IT manager at a company of 20 to 500 people, an administrator who is the whole IT department, and the MSPMSP: managed service provider. A company that runs IT for other companies. looking after many small customers. For each problem: what it feels like, what NetSenX does about it today, and what it does not do.
For leadership
What can go wrong for the business, in plain words
You do not need to know how a network works to own its risk. These are the five ways a cyber attack usually reaches the business, and what NetSenX does about each.
Work stops
Systems go down, orders and invoices stop, production lines wait. Recovery takes days or weeks, and staff are paid to wait.
NetSenX warns your IT team when a computer starts behaving like an intruder, often before anything is switched off or locked.
Ransom demands
Attackers lock your files and often copy them first, then ask for money twice: to unlock them and to keep them unpublished.
The copying and the spreading cross your network before the locking starts. NetSenX looks for exactly those steps.
Fines
Under NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies., the EU cybersecurity law, the maximum fine is at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4% for important ones. Under the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679)., the EU data protection law, it is up to EUR 20 million or 4%.
NetSenX keeps the evidence an authority asks for: what was detected, when, and what your team did.
Reporting deadlines
Companies covered by NIS2 must warn the authorities within 24 hours of learning about a serious incident, and follow up within 72 hours and one month.
NetSenX tracks those deadlines for every incident and prepares the data-breach notification for your data protection officer.
Lost customer trust
Customers, insurers and large clients increasingly ask how you protect their data, and remember who could not answer.
Data stays in the EU, the data processing agreement is public, and every alert explains itself, so you can show what you watch and how.
For the board
Questions your board will ask, answered truthfully
Twelve questions boards and owners really ask. Each answer has three parts: what you can say today without any tool, what NetSenX lets you show, and what nobody can promise.
Are we hacked right now?
What you can say today
Nobody can prove a negative. You can say what has been checked: which systems are patched, where multi-factor authentication is on, when a backup was last restored, and what this week's logs and alerts show.
What NetSenX lets you show
The current alerts in plain language, the hosts behind them, open incidents and which network segments are actually monitored. Beaconing, scanning, lateral movement and unusual outbound volume are watched on every plan, Free included.
What nobody can promise
That nobody is inside. A network sensor does not see segments it does not monitor, what happens inside a host, or a sign-in with a stolen but valid password.
What exactly are we approving under NIS2?
What you can say today
Article 20 of NIS2 makes the management body approve the risk-management measures of Article 21, oversee how they are implemented and follow training. National law sets how liability works.
What NetSenX lets you show
Evidence that one of those measures, detecting incidents on the network, is running: alerts, decisions and configuration changes in an audit log on every plan, and each incident tracked against the Article 23 deadlines.
What nobody can promise
That one tool covers Article 21. It lists many measures, from supply-chain security to backups and cryptography; NetSenX covers detection on the network.
Can we show a buyer our incident history?
What you can say today
What you can document today: incident tickets, e-mails, insurer notifications. A gap stated plainly is better than a history rebuilt from memory.
What NetSenX lets you show
Alert history and the audit log of what your team decided, kept for the retention period of your plan, which the pricing page publishes, and PDF reports from the Starter plan.
What nobody can promise
A record from before monitoring started. The history begins on the day the sensor goes live.
What is our one number for cyber risk?
What you can say today
A single score looks precise and is hard to defend. A few counts are better: open incidents, patch status of critical systems, multi-factor coverage, the date of the last successful restore test.
What NetSenX lets you show
Counts the board can check: open alerts and incidents with their NIS2 deadlines, monitored segments and devices. A conformal layer bounds false positives among surfaced alerts once your own data supports it, and until then the dashboard says so.
What nobody can promise
The probability that your company will be attacked this year. No honest source has that figure for one company.
Our files are on a leak site. When did they leave?
What you can say today
Start the incident process now: bring in your incident-response provider and lawyer, and check whether the GDPR Article 33 notification within 72 hours of becoming aware applies.
What NetSenX lets you show
If the data crossed a monitored segment within your alert history: unusual outbound volume alerts with the host, the destination, the volume and the time.
What nobody can promise
File names or content. NetSenX never decrypts traffic, and data that left by a path it does not monitor, or before monitoring started, is not in its records.
Is our AI policy being followed?
What you can say today
Which AI tools are approved, which data may go into them and whom to ask. Without a check, it is a policy on paper.
What NetSenX lets you show
From the Pro plan: which hosts reach which external AI services and locally run model runtimes, when, and how much data moves.
What nobody can promise
What was typed into a prompt, or AI use on phones and home networks that never cross your network.
Should we worry about quantum computers?
What you can say today
It is a planning topic, not an emergency. The EU roadmap of 23 June 2025 aims to protect high-risk use cases by the end of 2030 and as many systems as feasible by 2035, starting with an inventory.
What NetSenX lets you show
NQCI, in preview, shows which connections use quantum-vulnerable and which use hybrid post-quantum key exchange. It is visible on every plan and active from the Pro plan, with packet capture on a Linux agent or a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. sensor.
What nobody can promise
The year a capable quantum computer will exist, or a finished migration: NetSenX migrates nothing.
What does a day without systems cost us?
What you can say today
Work it out from your own numbers: revenue that stops, staff who cannot work and the recovery cost per day, multiplied by a realistic number of recovery days.
What NetSenX lets you show
NetSenX does not compute your downtime cost. It shows activity inside the network as it happens, and its prices are published, so the comparison is yours to make.
What nobody can promise
That detection prevents downtime. It informs; containing an attack and recovering stay with your team and your providers.
They say they copied our data. Is it true?
What you can say today
Do not decide alone: your lawyer, your insurer and an incident-response firm advise on paying. Ask what evidence of the theft the attackers can show.
What NetSenX lets you show
Whether large, unusual uploads left monitored hosts in the days before, to which destinations and when.
What nobody can promise
Proof that nothing was copied: data can leave by paths a sensor does not see. NetSenX does not advise on paying.
Can we prove to our insurer that we monitor the network?
What you can say today
Describe the set-up as it is: which segments are monitored, who reads the alerts and when. A truthful answer protects a claim better than a broad yes.
What NetSenX lets you show
The monitored segments, the alert history, the audit log of decisions and PDF reports from the Starter plan.
What nobody can promise
Round-the-clock human response. Detection runs all the time; people respond when your team or your provider does.
If an incident is significant, what happens in the first 24 hours?
What you can say today
Under Article 23 of NIS2: an early warning within 24 hours of becoming aware, a notification within 72 hours and a final report within one month. National law can add detail.
What NetSenX lets you show
Each incident tracked against those deadlines, with the alert evidence in one place, and a GDPR Article 33 breach notification prepared for your data protection officer.
What nobody can promise
The decision whether the incident is significant, and the submission itself: both stay with you.
Will the monitoring read our employees' e-mails?
What you can say today
Explain what is recorded and why, involve the works council and the data protection officer early, and document the assessment, in a data protection impact assessment (DPIA) where one is required.
What NetSenX lets you show
Device and connection metadata: addresses, ports, volumes, timing, and server names from the TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. handshake and DNS answers. Encrypted traffic is never decrypted.
What nobody can promise
That a set-up is lawful everywhere: that depends on national labour law and your workplace agreements.
How NetSenX works
From installation to report, in five steps
No network diagram needed.
1.Install one small program
Your IT team installs the NetSenX agent on one computer connected to a mirror port of the network switch, or on the servers it chooses. From there it can see the traffic of a whole network segment.
2.It learns what normal looks like
Like a night guard who learns who usually comes and goes, it notes which devices talk to which, when and how much. It does not read the content of messages.
3.It spots unusual behaviour
When a device starts acting like an intruder, such as calling an unknown server every few minutes, knocking on many doors at once or sending large amounts of data out at night, it raises an alert.
4.It explains the alert in plain words
Each alert says what happened, on which device and why it looks suspicious, so someone who is not a security specialist can decide what to do.
5.It keeps the record for the report
If the alert turns out to be a serious incident, NetSenX tracks the legal reporting deadlines and keeps the record your report needs.
The numbers behind the problem
What public research says
Every figure below is taken from a named public source, with its date. Hover or tap a bar for the exact value; each chart has a table version.
Ransomware was present in breaches at…
Share of confirmed breaches in which ransomware was present, by organisation size.
Show as table
| Ransomware was present in breaches at… | Value |
|---|---|
| Small and medium businesses | 88 % |
| Larger organisations | 39 % |
- Small and medium businesses: 88 %
- Larger organisations: 39 %
Source: Verizon, 2025 Data Breach Investigations Report (April 2025)
EU enterprises with consequences from ICT security incidents in 2023
Share of EU enterprises that experienced at least one consequence of an ICT security incident, such as unavailable services or destroyed data.
Show as table
| EU enterprises with consequences from ICT security incidents in 2023 | Value |
|---|---|
| All enterprises | 21.54 % |
| Small enterprises | 19.85 % |
| Large enterprises | 38.28 % |
- All enterprises: 21.54 %
- Small enterprises: 19.85 %
- Large enterprises: 38.28 %
Source: Eurostat, ICT security in enterprises (Statistics Explained), reference year 2023
An average breach
- global average cost of a data breach, in US dollars
- $4.44M
- days on average to identify and contain a breach
- 241
Source: IBM, Cost of a Data Breach Report 2025 (press release, 30 July 2025)
Breaches involving a third party
Show as table
| Breaches involving a third party | Value |
|---|---|
| 2024 report | 15 % |
| 2025 report | 30 % |
- 2024 report: 15 %
- 2025 report: 30 %
Source: Verizon, 2025 Data Breach Investigations Report (April 2025)
Your company in one night
Your company in one night: which situations apply to you?
Describe your company in a few clicks. The situations that apply to a company like yours appear on one night, from 18:00 to 08:30; open each one to see what NetSenX shows, what it cannot see and the plan it needs.
22 situations apply to a company like yours. 7 of them on one night:
18:05A VPN account signs in from two countries within an hour
- What NetSenX shows
- Nothing from the sign-in itself; what the session then does on the network, such as scanning or new sessions to servers, does show.
- What it cannot see
- The sign-in and its location: those are in your VPN and identity logs.
- Plan
- Every plan, Free included
19:30Someone pastes customer data into an AI chat
- What NetSenX shows
- Traffic from the device to the AI service: which device, which service, how much.
- What it cannot see
- What was pasted: NetSenX sees the connection, not the content.
- Plan
- From Pro
21:30The camera recorder phones home to another continent
- What NetSenX shows
- Steady outside connections and unusual outbound volume from the recorder.
- What it cannot see
- Whether your contract with the vendor allows it.
- Plan
- Every plan, Free included
00:30A workstation suddenly opens a session to the domain controller
- What NetSenX shows
- Lateral movement: a new host-to-host session that does not match the workstation's normal.
- What it cannot see
- Which account was used: the domain controller's logs say so.
- Plan
- Every plan, Free included
02:15Ransomware reaches many file shares at once
- What NetSenX shows
- Ransomware staging: one host reaching many shares in a short time.
- What it cannot see
- The encryption itself on the host: endpoint protection sees that.
- Plan
- Every plan, Free included
04:30An old SSH server nobody remembers
- What NetSenX shows
- In the NQCI SSH inventory, with the packet-capture sensor on a Linux agent or a SPAN/TAP sensor: the SSH version the server announces, and whether it is older than the fixed release.
- What it cannot see
- Proof of a flaw: a version banner can be altered, and distributions backport fixes.
- Plan
- From Pro
08:30The board asks: are we hacked right now?
- What NetSenX shows
- Each alert of the night in plain language, and your plan's alert history.
- What it cannot see
- A promise that nothing is happening: the answer covers the segments you monitor.
- Plan
- Every plan, Free included
All 22 situations that apply
- 18:05 A VPN account signs in from two countries within an hour · Every plan, Free included
- 18:20 The accounting PC calls an unknown server every five minutes · Every plan, Free included
- 18:45 A former employee's laptop still connects at night · Every plan, Free included
- 19:10 The meeting-room TV talks to unknown servers · Every plan, Free included
- 19:30 Someone pastes customer data into an AI chat · From Pro
- 20:00 A guest Wi-Fi device reaches internal servers · Every plan, Free included
- 21:00 A small computer is plugged into a wall socket · Every plan, Free included
- 21:30 The camera recorder phones home to another continent · Every plan, Free included
- 22:30 A printer suddenly scans the network · Every plan, Free included
- 23:00 Someone guesses passwords against an internal server · Every plan, Free included
- 23:30 A server talks to a freshly rented cloud server · Every plan, Free included
- 00:30 A workstation suddenly opens a session to the domain controller · Every plan, Free included
- 01:00 A remote worker's infected home PC connects over the VPN · Every plan, Free included
- 01:30 Administration tools are used at 01:30 · Every plan, Free included
- 02:15 Ransomware reaches many file shares at once · Every plan, Free included
- 03:00 The ERP server sends data out at 03:00 · Every plan, Free included
- 03:20 The nightly backup job looks like data theft · Every plan, Free included
- 03:40 A developer uploads a large archive to a personal cloud · Every plan, Free included
- 04:30 An old SSH server nobody remembers · From Pro
- 05:00 Which servers still use quantum-vulnerable key exchange? · From Pro
- 08:10 The NIS2 24-hour early warning clock starts · Every plan, Free included
- 08:30 The board asks: are we hacked right now? · Every plan, Free included
This shows which situations apply to a company like yours, not how likely they are: that would need a statistic nobody has about your company. Nothing you enter leaves your browser.
A night in your network
You cannot tell whether someone is inside, unless you watch
Intruders rarely announce themselves. Mandiant's M-Trends 2026 puts the global median dwell time, the time from intrusion to discovery, at 14 days for incidents investigated in 2025; IBM's Cost of a Data Breach 2025 puts the average time to identify and contain a breach at 241 days. Here is how a typical intrusion unfolds in one night, what NetSenX shows at each step, and what a network sensor cannot see.
A stolen password works
- What the intruder does
- The intruder signs in through the VPN or a remote-access service with a password bought or phished elsewhere.
- What NetSenX shows
- Nothing yet: a sign-in with valid credentials looks like a normal one on the network.
- What the network cannot see
- The sign-in itself is in your VPN and identity logs, not in the traffic. Multi-factor authentication stops most of these.
The machine phones home
- What the intruder does
- A small program on the first computer starts checking in with the intruder's server every few minutes, day and night.
- What NetSenX shows
- Command-and-control beaconing: small, regular connections to one new destination, flagged on every plan, Free included.
- What the network cannot see
- Which program makes the connection. Endpoint protection (EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine.) sees that.
Looking around
- What the intruder does
- From that computer, the intruder probes the internal network for file servers, backups and domain controllers.
- What NetSenX shows
- Scanning: one host connecting to many internal addresses and ports in a short time.
- What the network cannot see
- Searches made on the computer itself, such as reading the directory, which never cross the network.
Moving to the next machine
- What the intruder does
- With passwords found on the first computer, the intruder opens remote sessions to servers it has never used, using the administrators' own tools.
- What NetSenX shows
- Lateral movement: new host-to-host sessions over SMB, RDP or WinRM that do not match the host's normal.
- What the network cannot see
- That the tool is legitimate: antivirus often lets built-in administration tools pass, and so does the network.
A device nobody ordered
- What the intruder does
- Some intrusions bring their own hardware: a small computer or Wi-Fi bridge plugged into a free socket, talking to the outside world.
- What NetSenX shows
- If it sits on a monitored segment and talks, its regular outside connections show up as beaconing and unusual traffic.
- What the network cannot see
- A device that stays silent, or sits on a segment you do not mirror.
Data leaves in small pieces
- What the intruder does
- Files are copied out at night, at lunchtime or at weekends, in pieces sized to stay under simple volume alarms.
- What NetSenX shows
- Unusual outbound data volume: each host's uploads compared with its own normal destinations, volumes and times of day.
- What the network cannot see
- The file names and content inside encrypted sessions.
Someone becomes aware
- What the intruder does
- Your team reads the alerts over coffee. If the incident is significant and NIS2 applies, the 24-hour early warning clock starts now.
- What NetSenX shows
- Each alert in plain language, the audit log of what was seen and done, and the NIS2 Article 23 deadlines tracked for the incident.
- What the network cannot see
- Whether the incident is significant, and the report itself: those decisions stay with you.
Sources: Mandiant (Google Cloud), M-Trends 2026 · IBM, Cost of a Data Breach Report 2025 (press release, 30 July 2025)
The same night, two lanes
With and without NetSenX: what changes is when you know
NetSenX does not stop this night from happening. What changes is when you know. Move through the night: the left lane is what happens when nobody watches the network, the right lane is the alert each step produces, or nothing where the network cannot see.
08:30 Someone becomes aware. Without NetSenX: Nobody knows yet. You find out when a customer, a bank or the attacker tells you. With NetSenX: Alerts explained in plain language, NIS2 deadlines tracked.
On Free, this night's alerts stay in the alert history for 30 days. Every alert in this night is on every plan, Free included: the plan changes how long the evidence stays, not whether you see it.
Show the two lanes as a table
| Time | What the intruder does | What NetSenX shows | What the network cannot see |
|---|---|---|---|
| 18:02 | A stolen password works | Nothing yet: a valid sign-in looks normal. | The sign-in itself is in your VPN and identity logs, not in the traffic. Multi-factor authentication stops most of these. |
| 18:20 | The machine phones home | Alert: command-and-control beaconing. | Which program makes the connection. Endpoint protection (EDR) sees that. |
| 23:10 | Looking around | Alert: internal scanning. | Searches made on the computer itself, such as reading the directory, which never cross the network. |
| 01:30 | Moving to the next machine | Alert: lateral movement. | That the tool is legitimate: antivirus often lets built-in administration tools pass, and so does the network. |
| 02:40 | A device nobody ordered | Alert: beaconing and unusual traffic, if the device talks on a monitored segment. | A device that stays silent, or sits on a segment you do not mirror. |
| 03:00 | Data leaves in small pieces | Alert: unusual outbound data volume. | The file names and content inside encrypted sessions. |
| 08:30 | Someone becomes aware | Alerts explained in plain language, NIS2 deadlines tracked. | Whether the incident is significant, and the report itself: those decisions stay with you. |
For context, from the sources below: the global median time from intrusion to discovery was 14 days for incidents investigated in 2025, and the average time to identify and contain a breach was 241 days. These are averages across other organisations, not a measurement of NetSenX.
Sources: Mandiant (Google Cloud), M-Trends 2026 · IBM, Cost of a Data Breach Report 2025 (press release, 30 July 2025)
Post-quantum cryptography
Know where your encryption will need replacing
The EU has asked Member States to move to post-quantum cryptography: Commission Recommendation (EU) 2024/1101 of 11 April 2024, and the NIS Cooperation Group's coordinated roadmap of 23 June 2025, which aims to protect high-risk use cases by the end of 2030 and as many systems as feasible by 2035. Every migration starts with an inventory: where you use which cryptography.
Why it matters
A large quantum computer running Shor's algorithm could break RSA and elliptic-curve cryptography, which protect almost every key exchange and signature today. Symmetric encryption such as AES is only modestly weakened. No such computer exists yet, and nobody can name the year one will.
What replaces it
NIST published the first post-quantum standards on 13 August 2024: FIPS 203 (ML-KEM) for key exchange, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures. Browsers already offer hybrid key exchange such as X25519MLKEM768, which combines a classical and a post-quantum method.
Harvest now, decrypt later
Traffic recorded today could be read once such a computer exists. That matters for data that must stay secret for years: health records, designs, long contracts. It is a planning question, not an emergency.
What NetSenX does
NQCI, the NetSenX crypto inventory (in preview), shows from the network which connections use quantum-vulnerable key exchange and which use hybrid post-quantum key exchange. It is visible on every plan and active from the Pro plan. It needs the packet-capture sensor, which is off by default: switched on for a Linux agent, or a sensor on a SPAN or TAP port. The agent's basic mode, used on macOS, does not see TLS handshakes.
What it does not do
It does not migrate anything and does not make you compliant: replacing the cryptography is work for you and your vendors. It sees connections that cross a monitored segment, not cryptography inside applications or on disk.
Should you start now? Mosca's rule of thumb
Add how many years your data must stay secret to how many years your migration will take. If the total is more than the years until a capable quantum computer exists, start now. Nobody knows that last number, so try a few.
Estimate A: 10 + 5 = 15 > 10 start now
Estimate B: 10 + 5 = 15 ≤ 15 time on your side
Estimate C: 10 + 5 = 15 ≤ 25 time on your side
Start now: your data would still need protecting when such a computer could read it.
Sources: Commission Recommendation (EU) 2024/1101 of 11 April 2024 on a Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography · NIS Cooperation Group, A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography (23 June 2025) · NIST, NIST Releases First 3 Finalized Post-Quantum Encryption Standards (13 August 2024)
Who this page is for
IT manager, 20 to 500 people
You own security without a security team, report to a board that now asks about NIS2, and need to know what is happening on the network without reading logs all day.
The lone administrator
You are the IT department. Anything you install has to run without babysitting, explain itself and not cost a weekend.
MSP or IT service provider
You look after many small customers, each with its own network, and need each one kept separate.
For: IT manager, 20 to 500 people · The lone administrator · MSP or IT service provider
“We would not know if someone was already inside our network.”
What NetSenX does
NetSenX watches how every host behaves on the network and flags command-and-control beaconing, scanning, lateral movement and unusual outbound data volume, on every plan, Free included.
What it does not do
It does not see what happens inside a host without touching the network; endpoint protection (EDR) covers that. An alert is a reason to investigate, not proof of an intrusion.
For: IT manager, 20 to 500 people · The lone administrator
“We get alerts nobody has time to read, and most of them are noise.”
What NetSenX does
Every alert explains in plain language which network features drove its score, on every plan. A split-conformal layer bounds false positives among the alerts it surfaces once your own calibration data supports it; until then the dashboard says so. On paid plans, the AI Analyst Core can add a plain-language note to each alert with your own AI provider key.
What it does not do
It is not a managed detection service: nobody at NetSenX watches your alerts around the clock, and deciding what to do with an alert stays with you.
For: IT manager, 20 to 500 people · The lone administrator
“Half of our network is printers, cameras and machines we cannot install anything on.”
What NetSenX does
One agent on a SPAN or TAP port watches a whole network segment, so devices that run no agent are covered. From the Pro plan, Modbus/TCP, DNP3, BACnet/IP, EtherNet/IP and S7comm are read from passive capture.
What it does not do
OTOT: operational technology. The computers that run machines, production lines, building systems and utilities. devices are never actively probed, and traffic on a segment you do not mirror stays out of view.
For: IT manager, 20 to 500 people
“NIS2 says we have to report a significant incident within 24 hours.”
What NetSenX does
NetSenX tracks each incident against the NIS2 Article 23 deadlines (24 hours, 72 hours, one month), prepares a GDPR Article 33 breach notification for your DPODPO: data protection officer. The person responsible for data protection in a company under the GDPR. and keeps an audit log of alerts, analyst decisions and configuration changes. PDF reports from the Starter plan.
What it does not do
It does not decide whether your company is in scope or whether an incident is significant, and it does not submit reports to your CSIRTCSIRT: computer security incident response team. The national team to which serious incidents are reported. or authority for you.
For: IT manager, 20 to 500 people · The lone administrator
“Almost everything is encrypted now, and we do not want to break TLS to inspect it.”
What NetSenX does
NetSenX analyses encrypted traffic from timing, volume and destinations, and from the Starter plan also from the TLS handshake. It never decrypts: there is no interception proxy and no certificate to install. The handshake is visible only where the agent captures packets: on Linux or as a sensor on a SPAN or TAP port, not in the basic mode used on macOS.
What it does not do
It cannot read the content of an encrypted session.
For: IT manager, 20 to 500 people
“Staff paste company data into AI tools we never approved.”
What NetSenX does
From the Pro plan, NetSenX flags traffic to external AI services and to locally run language-model runtimes: which host, which service and how much data.
What it does not do
It does not read prompts or what was sent, and it does not block a service by itself.
For: IT manager, 20 to 500 people · The lone administrator · MSP or IT service provider
“Enterprise NDR is priced for enterprises, and nobody publishes a price.”
What NetSenX does
NetSenX publishes its prices and has a Free plan with no time limit. A device is a host running the agent, and one agent on a SPAN or TAP port counts as one device for the whole segment it watches.
What it does not do
On-premises deployment and white-label reports are on the Enterprise plan only.
For: IT manager, 20 to 500 people · MSP or IT service provider
“Our data has to stay in the EU, and legal wants the sub-processor list.”
What NetSenX does
Customer data is stored in the EU: the database in Ireland, the API in Frankfurt and Paris. A data processing agreement under GDPR Article 28 is published with the full sub-processor list.
What it does not do
On-premises deployment, for data that must not leave your site, is on the Enterprise plan only.
For: MSP or IT service provider
“We look after IT for many small customers and cannot build a SOC for each.”
What NetSenX does
Each customer is its own tenant, kept apart in the database by row-level security, and each can start on the Free plan. White-label reports are on the Enterprise plan; the partner programme covers MSSPs and resellers.
What it does not do
NetSenX does not run a managed service on your behalf; investigating alerts stays with you or your team.
Terms used on this page
- MSP (managed service provider)
- A company that runs IT for other companies.
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.
- GDPR (General Data Protection Regulation)
- The EU data protection law (Regulation (EU) 2016/679).
- SPAN (switch port analyser)
- A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.
- TAP (test access point)
- A small device that copies the traffic on a network cable for a sensor to watch.
- TLS (Transport Layer Security)
- The encryption that protects most internet traffic, such as HTTPS.
- EDR (endpoint detection and response)
- Security software installed on each computer that watches what happens on that machine.
- OT (operational technology)
- The computers that run machines, production lines, building systems and utilities.
- DPO (data protection officer)
- The person responsible for data protection in a company under the GDPR.
- CSIRT (computer security incident response team)
- The national team to which serious incidents are reported.
Try it on your own network
Start on the Free plan, or book a demo and bring the problem you have.