# The problems you came here with

> The problems IT managers, lone admins and MSPs bring to us: what NetSenX does about each one today, and what it does not do.

Source page: https://netsenx.com/en/problems-we-solve

Written for the people who will run NetSenX: an IT manager at a company of 20 to 500 people, an administrator who is the whole IT department, and the MSP looking after many small customers. For each problem: what it feels like, what NetSenX does about it today, and what it does not do.

## What can go wrong for the business, in plain words

You do not need to know how a network works to own its risk. These are the five ways a cyber attack usually reaches the business, and what NetSenX does about each.

### Work stops

Systems go down, orders and invoices stop, production lines wait. Recovery takes days or weeks, and staff are paid to wait.

NetSenX warns your IT team when a computer starts behaving like an intruder, often before anything is switched off or locked.

### Ransom demands

Attackers lock your files and often copy them first, then ask for money twice: to unlock them and to keep them unpublished.

The copying and the spreading cross your network before the locking starts. NetSenX looks for exactly those steps.

### Fines

Under NIS2, the EU cybersecurity law, the maximum fine is at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4% for important ones. Under the GDPR, the EU data protection law, it is up to EUR 20 million or 4%.

NetSenX keeps the evidence an authority asks for: what was detected, when, and what your team did.

### Reporting deadlines

Companies covered by NIS2 must warn the authorities within 24 hours of learning about a serious incident, and follow up within 72 hours and one month.

NetSenX tracks those deadlines for every incident and prepares the data-breach notification for your data protection officer.

### Lost customer trust

Customers, insurers and large clients increasingly ask how you protect their data, and remember who could not answer.

Data stays in the EU, the data processing agreement is public, and every alert explains itself, so you can show what you watch and how.

## Questions your board will ask, answered truthfully

Twelve questions boards and owners really ask. Each answer has three parts: what you can say today without any tool, what NetSenX lets you show, and what nobody can promise.

### Are we hacked right now?

- **What you can say today:** Nobody can prove a negative. You can say what has been checked: which systems are patched, where multi-factor authentication is on, when a backup was last restored, and what this week's logs and alerts show.
- **What NetSenX lets you show:** The current alerts in plain language, the hosts behind them, open incidents and which network segments are actually monitored. Beaconing, scanning, lateral movement and unusual outbound volume are watched on every plan, Free included.
- **What nobody can promise:** That nobody is inside. A network sensor does not see segments it does not monitor, what happens inside a host, or a sign-in with a stolen but valid password.

### What exactly are we approving under NIS2?

- **What you can say today:** Article 20 of NIS2 makes the management body approve the risk-management measures of Article 21, oversee how they are implemented and follow training. National law sets how liability works.
- **What NetSenX lets you show:** Evidence that one of those measures, detecting incidents on the network, is running: alerts, decisions and configuration changes in an audit log on every plan, and each incident tracked against the Article 23 deadlines.
- **What nobody can promise:** That one tool covers Article 21. It lists many measures, from supply-chain security to backups and cryptography; NetSenX covers detection on the network.

### Can we show a buyer our incident history?

- **What you can say today:** What you can document today: incident tickets, e-mails, insurer notifications. A gap stated plainly is better than a history rebuilt from memory.
- **What NetSenX lets you show:** Alert history and the audit log of what your team decided, kept for the retention period of your plan, which the pricing page publishes, and PDF reports from the Starter plan.
- **What nobody can promise:** A record from before monitoring started. The history begins on the day the sensor goes live.

### What is our one number for cyber risk?

- **What you can say today:** A single score looks precise and is hard to defend. A few counts are better: open incidents, patch status of critical systems, multi-factor coverage, the date of the last successful restore test.
- **What NetSenX lets you show:** Counts the board can check: open alerts and incidents with their NIS2 deadlines, monitored segments and devices. A conformal layer bounds false positives among surfaced alerts once your own data supports it, and until then the dashboard says so.
- **What nobody can promise:** The probability that your company will be attacked this year. No honest source has that figure for one company.

### Our files are on a leak site. When did they leave?

- **What you can say today:** Start the incident process now: bring in your incident-response provider and lawyer, and check whether the GDPR Article 33 notification within 72 hours of becoming aware applies.
- **What NetSenX lets you show:** If the data crossed a monitored segment within your alert history: unusual outbound volume alerts with the host, the destination, the volume and the time.
- **What nobody can promise:** File names or content. NetSenX never decrypts traffic, and data that left by a path it does not monitor, or before monitoring started, is not in its records.

### Is our AI policy being followed?

- **What you can say today:** Which AI tools are approved, which data may go into them and whom to ask. Without a check, it is a policy on paper.
- **What NetSenX lets you show:** From the Pro plan: which hosts reach which external AI services and locally run model runtimes, when, and how much data moves.
- **What nobody can promise:** What was typed into a prompt, or AI use on phones and home networks that never cross your network.

### Should we worry about quantum computers?

- **What you can say today:** It is a planning topic, not an emergency. The EU roadmap of 23 June 2025 aims to protect high-risk use cases by the end of 2030 and as many systems as feasible by 2035, starting with an inventory.
- **What NetSenX lets you show:** NQCI, in preview, shows which connections use quantum-vulnerable and which use hybrid post-quantum key exchange. It is visible on every plan and active from the Pro plan, with packet capture on a Linux agent or a SPAN or TAP sensor.
- **What nobody can promise:** The year a capable quantum computer will exist, or a finished migration: NetSenX migrates nothing.

### What does a day without systems cost us?

- **What you can say today:** Work it out from your own numbers: revenue that stops, staff who cannot work and the recovery cost per day, multiplied by a realistic number of recovery days.
- **What NetSenX lets you show:** NetSenX does not compute your downtime cost. It shows activity inside the network as it happens, and its prices are published, so the comparison is yours to make.
- **What nobody can promise:** That detection prevents downtime. It informs; containing an attack and recovering stay with your team and your providers.

### They say they copied our data. Is it true?

- **What you can say today:** Do not decide alone: your lawyer, your insurer and an incident-response firm advise on paying. Ask what evidence of the theft the attackers can show.
- **What NetSenX lets you show:** Whether large, unusual uploads left monitored hosts in the days before, to which destinations and when.
- **What nobody can promise:** Proof that nothing was copied: data can leave by paths a sensor does not see. NetSenX does not advise on paying.

### Can we prove to our insurer that we monitor the network?

- **What you can say today:** Describe the set-up as it is: which segments are monitored, who reads the alerts and when. A truthful answer protects a claim better than a broad yes.
- **What NetSenX lets you show:** The monitored segments, the alert history, the audit log of decisions and PDF reports from the Starter plan.
- **What nobody can promise:** Round-the-clock human response. Detection runs all the time; people respond when your team or your provider does.

### If an incident is significant, what happens in the first 24 hours?

- **What you can say today:** Under Article 23 of NIS2: an early warning within 24 hours of becoming aware, a notification within 72 hours and a final report within one month. National law can add detail.
- **What NetSenX lets you show:** Each incident tracked against those deadlines, with the alert evidence in one place, and a GDPR Article 33 breach notification prepared for your data protection officer.
- **What nobody can promise:** The decision whether the incident is significant, and the submission itself: both stay with you.

### Will the monitoring read our employees' e-mails?

- **What you can say today:** Explain what is recorded and why, involve the works council and the data protection officer early, and document the assessment, in a data protection impact assessment (DPIA) where one is required.
- **What NetSenX lets you show:** Device and connection metadata: addresses, ports, volumes, timing, and server names from the TLS handshake and DNS answers. Encrypted traffic is never decrypted.
- **What nobody can promise:** That a set-up is lawful everywhere: that depends on national labour law and your workplace agreements.

## From installation to report, in five steps

1. **Install one small program** Your IT team installs the NetSenX agent on one computer connected to a mirror port of the network switch, or on the servers it chooses. From there it can see the traffic of a whole network segment.
2. **It learns what normal looks like** Like a night guard who learns who usually comes and goes, it notes which devices talk to which, when and how much. It does not read the content of messages.
3. **It spots unusual behaviour** When a device starts acting like an intruder, such as calling an unknown server every few minutes, knocking on many doors at once or sending large amounts of data out at night, it raises an alert.
4. **It explains the alert in plain words** Each alert says what happened, on which device and why it looks suspicious, so someone who is not a security specialist can decide what to do.
5. **It keeps the record for the report** If the alert turns out to be a serious incident, NetSenX tracks the legal reporting deadlines and keeps the record your report needs.

## What public research says

### Ransomware was present in breaches at…

- Small and medium businesses: 88 %
- Larger organisations: 39 %

Source: [Verizon, 2025 Data Breach Investigations Report (April 2025)](https://www.verizon.com/about/news/2025-data-breach-investigations-report)

### EU enterprises with consequences from ICT security incidents in 2023

- All enterprises: 21.54 %
- Small enterprises: 19.85 %
- Large enterprises: 38.28 %

Source: [Eurostat, ICT security in enterprises (Statistics Explained), reference year 2023](https://ec.europa.eu/eurostat/statistics-explained/index.php?title=ICT_security_in_enterprises)

### Breaches involving a third party

- 2024 report: 15 %
- 2025 report: 30 %

Source: [Verizon, 2025 Data Breach Investigations Report (April 2025)](https://www.verizon.com/about/news/2025-data-breach-investigations-report)

### An average breach

- $4.44M: global average cost of a data breach, in US dollars
- 241: days on average to identify and contain a breach

Source: [IBM, Cost of a Data Breach Report 2025 (press release, 30 July 2025)](https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls)

## Your company in one night: which situations apply to you?

Describe your company in a few clicks. The situations that apply to a company like yours appear on one night, from 18:00 to 08:30; open each one to see what NetSenX shows, what it cannot see and the plan it needs.

This shows which situations apply to a company like yours, not how likely they are: that would need a statistic nobody has about your company. Nothing you enter leaves your browser.

| Time | Situation | What NetSenX shows | What it cannot see | Plan | Applies when |
|---|---|---|---|---|---|
| 18:05 | A VPN account signs in from two countries within an hour | Nothing from the sign-in itself; what the session then does on the network, such as scanning or new sessions to servers, does show. | The sign-in and its location: those are in your VPN and identity logs. | Every plan, Free included | Some staff work remotely |
| 18:20 | The accounting PC calls an unknown server every five minutes | Command-and-control beaconing: small, regular connections to one new destination. | Which program on the PC makes the calls: endpoint protection sees that. | Every plan, Free included | Every company |
| 18:45 | A former employee's laptop still connects at night | The device's connections at night, if it is on a monitored segment or runs an agent. | Whether the account should still exist: that is your identity provider's list. | Every plan, Free included | Remote staff and at least 10 people |
| 19:10 | The meeting-room TV talks to unknown servers | Regular connections to new destinations and unusual outbound volume from the TV. | What the TV sends inside encrypted sessions. | Every plan, Free included | Every company |
| 19:30 | Someone pastes customer data into an AI chat | Traffic from the device to the AI service: which device, which service, how much. | What was pasted: NetSenX sees the connection, not the content. | From Pro | You use AI tools |
| 20:00 | A guest Wi-Fi device reaches internal servers | Scanning and new sessions from the guest segment towards internal addresses, if that segment is mirrored. | Anything on a guest network that is not mirrored. | Every plan, Free included | Every company |
| 20:30 | The building management system talks to the internet | Regular outside connections from the controllers, if their segment is mirrored. | Changes made through the vendor's own cloud portal. | Every plan, Free included | Machines or building systems, or manufacturing |
| 21:00 | A small computer is plugged into a wall socket | A new device on the network map and, if it talks, its regular outside connections. | A device that stays silent, or sits on a segment you do not mirror. | Every plan, Free included | Every company |
| 21:30 | The camera recorder phones home to another continent | Steady outside connections and unusual outbound volume from the recorder. | Whether your contract with the vendor allows it. | Every plan, Free included | Every company |
| 22:00 | An integrator's laptop is plugged into the production line | A new device on the production segment and its traffic towards the controllers. | What is installed on the laptop. | From Pro | Machines or building systems, or manufacturing |
| 22:30 | A printer suddenly scans the network | Scanning: one host connecting to many internal addresses and ports in a short time. | How the printer was taken over. | Every plan, Free included | Every company |
| 23:00 | Someone guesses passwords against an internal server | Brute force: many failed connection attempts against one service. | Whether a guess finally worked: the server's own log says so. | Every plan, Free included | Every company |
| 23:30 | A server talks to a freshly rented cloud server | A new rented cloud destination in the cloud review queue, and unusual outbound volume if data moves. | Who rented the server, and why. | Every plan, Free included | Every company |
| 00:00 | An office PC writes to a PLC | A write to a controller from a host that does not normally write to it. | Whether the new value is safe for the machine. | From Pro | Machines or building systems, or manufacturing |
| 00:30 | A workstation suddenly opens a session to the domain controller | Lateral movement: a new host-to-host session that does not match the workstation's normal. | Which account was used: the domain controller's logs say so. | Every plan, Free included | At least 20 people |
| 01:00 | A remote worker's infected home PC connects over the VPN | Beaconing or scanning from the VPN address range, if the VPN traffic is mirrored. | The home PC itself, before it connects. | Every plan, Free included | Some staff work remotely |
| 01:30 | Administration tools are used at 01:30 | New sessions over SMB, RDP or WinRM that do not match the host's normal. | Whether the tool use is legitimate: the network sees the session, not the intent. | Every plan, Free included | Every company |
| 02:00 | A PLC is stopped or reprogrammed at night | OT activity outside the usual working hours. | Changes made locally on the controller's own panel. | From Pro | Machines or building systems, or manufacturing |
| 02:15 | Ransomware reaches many file shares at once | Ransomware staging: one host reaching many shares in a short time. | The encryption itself on the host: endpoint protection sees that. | Every plan, Free included | Every company |
| 02:40 | The office network reaches the control level | Traffic crossing levels of the plant network that should stay apart. | Connections over links you do not mirror, such as a vendor modem. | From Pro | Machines or building systems, or manufacturing |
| 03:00 | The ERP server sends data out at 03:00 | Unusual outbound data volume against the server's own normal destinations, volumes and times. | Which files left, inside encrypted sessions. | Every plan, Free included | Every company |
| 03:20 | The nightly backup job looks like data theft | Uploads are compared with each host's own normal, so a backup that runs the same way every night stays quiet. | Whether the backup can actually be restored. | Every plan, Free included | Every company |
| 03:40 | A developer uploads a large archive to a personal cloud | Unusual outbound data volume to a destination the laptop rarely uses. | What the archive contains. | Every plan, Free included | At least 20 people |
| 04:00 | A 4G router is hidden in a machine cabinet | If its LAN side is on a mirrored segment: a new device and its traffic towards the controllers. | Traffic over the 4G link itself, which never crosses your network. | Every plan, Free included | Machines or building systems, or manufacturing |
| 04:30 | An old SSH server nobody remembers | In the NQCI SSH inventory, with the packet-capture sensor on a Linux agent or a SPAN/TAP sensor: the SSH version the server announces, and whether it is older than the fixed release. | Proof of a flaw: a version banner can be altered, and distributions backport fixes. | From Pro | Every company |
| 05:00 | Which servers still use quantum-vulnerable key exchange? | NQCI (preview) on monitored traffic, with the packet-capture sensor on a Linux agent or a SPAN/TAP sensor: which connections use quantum-vulnerable and which hybrid post-quantum key exchange. The basic macOS mode does not see handshakes. | Data someone recorded in the past: an inventory shows today's traffic. | From Pro | In NIS2 scope, or not sure |
| 05:30 | Warehouse scanners and handhelds join the network | New devices on the network map, and unusual traffic from them. | What the apps on the handhelds do inside encrypted sessions. | Every plan, Free included | Depends on the sector |
| 06:00 | Medical or lab devices that cannot run an agent | Their connections from a mirrored segment: new destinations, scanning, unusual volume. | The device's internal state and the patient data it holds. | Every plan, Free included | Depends on the sector |
| 06:30 | Shop tills and card terminals share the network | Scanning or new sessions from a till towards other devices. | Card data inside the payment terminal's encrypted session. | Every plan, Free included | Depends on the sector |
| 07:00 | The second site has devices nobody has listed | The network map of each mirrored site: the devices seen on monitored segments. | Devices at a site with no agent. | Every plan, Free included | More than one site |
| 08:10 | The NIS2 24-hour early warning clock starts | The incident tracked against the Article 23 deadlines, with the alerts that started it. | Whether the incident is significant, and the report itself. | Every plan, Free included | In NIS2 scope, or not sure |
| 08:30 | The board asks: are we hacked right now? | Each alert of the night in plain language, and your plan's alert history. | A promise that nothing is happening: the answer covers the segments you monitor. | Every plan, Free included | Every company |

## You cannot tell whether someone is inside, unless you watch

Intruders rarely announce themselves. Mandiant's M-Trends 2026 puts the global median dwell time, the time from intrusion to discovery, at 14 days for incidents investigated in 2025; IBM's Cost of a Data Breach 2025 puts the average time to identify and contain a breach at 241 days. Here is how a typical intrusion unfolds in one night, what NetSenX shows at each step, and what a network sensor cannot see.

### 18:02 A stolen password works

- **What the intruder does:** The intruder signs in through the VPN or a remote-access service with a password bought or phished elsewhere.
- **What NetSenX shows:** Nothing yet: a sign-in with valid credentials looks like a normal one on the network.
- **What the network cannot see:** The sign-in itself is in your VPN and identity logs, not in the traffic. Multi-factor authentication stops most of these.

### 18:20 The machine phones home

- **What the intruder does:** A small program on the first computer starts checking in with the intruder's server every few minutes, day and night.
- **What NetSenX shows:** Command-and-control beaconing: small, regular connections to one new destination, flagged on every plan, Free included.
- **What the network cannot see:** Which program makes the connection. Endpoint protection (EDR) sees that.

### 23:10 Looking around

- **What the intruder does:** From that computer, the intruder probes the internal network for file servers, backups and domain controllers.
- **What NetSenX shows:** Scanning: one host connecting to many internal addresses and ports in a short time.
- **What the network cannot see:** Searches made on the computer itself, such as reading the directory, which never cross the network.

### 01:30 Moving to the next machine

- **What the intruder does:** With passwords found on the first computer, the intruder opens remote sessions to servers it has never used, using the administrators' own tools.
- **What NetSenX shows:** Lateral movement: new host-to-host sessions over SMB, RDP or WinRM that do not match the host's normal.
- **What the network cannot see:** That the tool is legitimate: antivirus often lets built-in administration tools pass, and so does the network.

### 02:40 A device nobody ordered

- **What the intruder does:** Some intrusions bring their own hardware: a small computer or Wi-Fi bridge plugged into a free socket, talking to the outside world.
- **What NetSenX shows:** If it sits on a monitored segment and talks, its regular outside connections show up as beaconing and unusual traffic.
- **What the network cannot see:** A device that stays silent, or sits on a segment you do not mirror.

### 03:00 Data leaves in small pieces

- **What the intruder does:** Files are copied out at night, at lunchtime or at weekends, in pieces sized to stay under simple volume alarms.
- **What NetSenX shows:** Unusual outbound data volume: each host's uploads compared with its own normal destinations, volumes and times of day.
- **What the network cannot see:** The file names and content inside encrypted sessions.

### 08:30 Someone becomes aware

- **What the intruder does:** Your team reads the alerts over coffee. If the incident is significant and NIS2 applies, the 24-hour early warning clock starts now.
- **What NetSenX shows:** Each alert in plain language, the audit log of what was seen and done, and the NIS2 Article 23 deadlines tracked for the incident.
- **What the network cannot see:** Whether the incident is significant, and the report itself: those decisions stay with you.

Sources: [Mandiant (Google Cloud), M-Trends 2026](https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026/) · [IBM, Cost of a Data Breach Report 2025 (press release, 30 July 2025)](https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls)

## With and without NetSenX: what changes is when you know

NetSenX does not stop this night from happening. What changes is when you know. Move through the night: the left lane is what happens when nobody watches the network, the right lane is the alert each step produces, or nothing where the network cannot see.

| Time | What the intruder does | What NetSenX shows | What the network cannot see |
|---|---|---|---|
| 18:02 | A stolen password works | Nothing yet: a valid sign-in looks normal. | The sign-in itself is in your VPN and identity logs, not in the traffic. Multi-factor authentication stops most of these. |
| 18:20 | The machine phones home | Alert: command-and-control beaconing. | Which program makes the connection. Endpoint protection (EDR) sees that. |
| 23:10 | Looking around | Alert: internal scanning. | Searches made on the computer itself, such as reading the directory, which never cross the network. |
| 01:30 | Moving to the next machine | Alert: lateral movement. | That the tool is legitimate: antivirus often lets built-in administration tools pass, and so does the network. |
| 02:40 | A device nobody ordered | Alert: beaconing and unusual traffic, if the device talks on a monitored segment. | A device that stays silent, or sits on a segment you do not mirror. |
| 03:00 | Data leaves in small pieces | Alert: unusual outbound data volume. | The file names and content inside encrypted sessions. |
| 08:30 | Someone becomes aware | Alerts explained in plain language, NIS2 deadlines tracked. | Whether the incident is significant, and the report itself: those decisions stay with you. |

- On Free, this night's alerts stay in the alert history for 30 days.
- On Solo, this night's alerts stay in the alert history for 60 days.
- On Starter, this night's alerts stay in the alert history for 60 days.
- On Pro, this night's alerts stay in the alert history for 90 days.
- On Business, this night's alerts stay in the alert history for 365 days.
- On Enterprise, the alert history has no time limit.

Every alert in this night is on every plan, Free included: the plan changes how long the evidence stays, not whether you see it.

For context, from the sources below: the global median time from intrusion to discovery was 14 days for incidents investigated in 2025, and the average time to identify and contain a breach was 241 days. These are averages across other organisations, not a measurement of NetSenX.

Sources: [Mandiant (Google Cloud), M-Trends 2026](https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026/) · [IBM, Cost of a Data Breach Report 2025 (press release, 30 July 2025)](https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls)

## Know where your encryption will need replacing

The EU has asked Member States to move to post-quantum cryptography: Commission Recommendation (EU) 2024/1101 of 11 April 2024, and the NIS Cooperation Group's coordinated roadmap of 23 June 2025, which aims to protect high-risk use cases by the end of 2030 and as many systems as feasible by 2035. Every migration starts with an inventory: where you use which cryptography.

### Why it matters

A large quantum computer running Shor's algorithm could break RSA and elliptic-curve cryptography, which protect almost every key exchange and signature today. Symmetric encryption such as AES is only modestly weakened. No such computer exists yet, and nobody can name the year one will.

### What replaces it

NIST published the first post-quantum standards on 13 August 2024: FIPS 203 (ML-KEM) for key exchange, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures. Browsers already offer hybrid key exchange such as X25519MLKEM768, which combines a classical and a post-quantum method.

### Harvest now, decrypt later

Traffic recorded today could be read once such a computer exists. That matters for data that must stay secret for years: health records, designs, long contracts. It is a planning question, not an emergency.

### What NetSenX does

NQCI, the NetSenX crypto inventory (in preview), shows from the network which connections use quantum-vulnerable key exchange and which use hybrid post-quantum key exchange. It is visible on every plan and active from the Pro plan. It needs the packet-capture sensor, which is off by default: switched on for a Linux agent, or a sensor on a SPAN or TAP port. The agent's basic mode, used on macOS, does not see TLS handshakes.

### What it does not do

It does not migrate anything and does not make you compliant: replacing the cryptography is work for you and your vendors. It sees connections that cross a monitored segment, not cryptography inside applications or on disk.

### Should you start now? Mosca's rule of thumb

Add how many years your data must stay secret to how many years your migration will take. If the total is more than the years until a capable quantum computer exists, start now. Nobody knows that last number, so try a few.

Nobody knows this number, so compare three estimates. The verdict below follows the earliest.

x + y > z

Sources: [Commission Recommendation (EU) 2024/1101 of 11 April 2024 on a Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptography](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024H1101) · [NIS Cooperation Group, A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography (23 June 2025)](https://digital-strategy.ec.europa.eu/en/library/coordinated-implementation-roadmap-transition-post-quantum-cryptography) · [NIST, NIST Releases First 3 Finalized Post-Quantum Encryption Standards (13 August 2024)](https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards)

## Who this page is for

- **IT manager, 20 to 500 people**: You own security without a security team, report to a board that now asks about NIS2, and need to know what is happening on the network without reading logs all day.
- **The lone administrator**: You are the IT department. Anything you install has to run without babysitting, explain itself and not cost a weekend.
- **MSP or IT service provider**: You look after many small customers, each with its own network, and need each one kept separate.

## “We would not know if someone was already inside our network.”

**What NetSenX does:** NetSenX watches how every host behaves on the network and flags command-and-control beaconing, scanning, lateral movement and unusual outbound data volume, on every plan, Free included.

**What it does not do:** It does not see what happens inside a host without touching the network; endpoint protection (EDR) covers that. An alert is a reason to investigate, not proof of an intrusion.

More on this: https://netsenx.com/en/is-someone-inside-your-network

## “We get alerts nobody has time to read, and most of them are noise.”

**What NetSenX does:** Every alert explains in plain language which network features drove its score, on every plan. A split-conformal layer bounds false positives among the alerts it surfaces once your own calibration data supports it; until then the dashboard says so. On paid plans, the AI Analyst Core can add a plain-language note to each alert with your own AI provider key.

**What it does not do:** It is not a managed detection service: nobody at NetSenX watches your alerts around the clock, and deciding what to do with an alert stays with you.

More on this: https://netsenx.com/en/features

## “Half of our network is printers, cameras and machines we cannot install anything on.”

**What NetSenX does:** One agent on a SPAN or TAP port watches a whole network segment, so devices that run no agent are covered. From the Pro plan, Modbus/TCP, DNP3, BACnet/IP, EtherNet/IP and S7comm are read from passive capture.

**What it does not do:** OT devices are never actively probed, and traffic on a segment you do not mirror stays out of view.

More on this: https://netsenx.com/en/ot-network-monitoring

## “NIS2 says we have to report a significant incident within 24 hours.”

**What NetSenX does:** NetSenX tracks each incident against the NIS2 Article 23 deadlines (24 hours, 72 hours, one month), prepares a GDPR Article 33 breach notification for your DPO and keeps an audit log of alerts, analyst decisions and configuration changes. PDF reports from the Starter plan.

**What it does not do:** It does not decide whether your company is in scope or whether an incident is significant, and it does not submit reports to your CSIRT or authority for you.

More on this: https://netsenx.com/en/nis2-incident-reporting-deadlines

## “Almost everything is encrypted now, and we do not want to break TLS to inspect it.”

**What NetSenX does:** NetSenX analyses encrypted traffic from timing, volume and destinations, and from the Starter plan also from the TLS handshake. It never decrypts: there is no interception proxy and no certificate to install. The handshake is visible only where the agent captures packets: on Linux or as a sensor on a SPAN or TAP port, not in the basic mode used on macOS.

**What it does not do:** It cannot read the content of an encrypted session.

More on this: https://netsenx.com/en/encrypted-traffic-analysis

## “Staff paste company data into AI tools we never approved.”

**What NetSenX does:** From the Pro plan, NetSenX flags traffic to external AI services and to locally run language-model runtimes: which host, which service and how much data.

**What it does not do:** It does not read prompts or what was sent, and it does not block a service by itself.

More on this: https://netsenx.com/en/shadow-ai-detection

## “Enterprise NDR is priced for enterprises, and nobody publishes a price.”

**What NetSenX does:** NetSenX publishes its prices and has a Free plan with no time limit. A device is a host running the agent, and one agent on a SPAN or TAP port counts as one device for the whole segment it watches.

**What it does not do:** On-premises deployment and white-label reports are on the Enterprise plan only.

More on this: https://netsenx.com/en/pricing

## “Our data has to stay in the EU, and legal wants the sub-processor list.”

**What NetSenX does:** Customer data is stored in the EU: the database in Ireland, the API in Frankfurt and Paris. A data processing agreement under GDPR Article 28 is published with the full sub-processor list.

**What it does not do:** On-premises deployment, for data that must not leave your site, is on the Enterprise plan only.

More on this: https://netsenx.com/en/eu-data-residency

## “We look after IT for many small customers and cannot build a SOC for each.”

**What NetSenX does:** Each customer is its own tenant, kept apart in the database by row-level security, and each can start on the Free plan. White-label reports are on the Enterprise plan; the partner programme covers MSSPs and resellers.

**What it does not do:** NetSenX does not run a managed service on your behalf; investigating alerts stays with you or your team.

More on this: https://netsenx.com/en/partners