Competitive Landscape: Network Detection and Response

IaaS and SaaS NDR Opportunities

NDR for IaaS Environments

• They must have the scalability/capacity to deal with cloud “bursts,” aka spikes in computing demand.
• Regulatory/compliance standards must be met when storing workload network telemetry in the cloud, including data sovereignty, anonymity and security standards.
• AI/machine learning (ML)-driven detections (supervised ML and/or unsupervised ML) are a top NDR requirement. Anomalous behavior detection becomes more important in the cloud when cyberattacks are not based on malware or things that would be identified by payload inspection.

NDR for SaaS and Cloud Identity Applications

• Increased attack surface of SaaS applications. The growing use of cloud-based applications such as Microsoft 365, partly driven by hybrid and remote working, is a target area for malicious actors. These aim to exploit vulnerabilities of legitimate SaaS services that are often unable to detect camouflaged or sophisticated malicious activity, aimed at delivering malware to users or at gaining access to internal systems. An example is the use of Microsoft Teams to send a phishing message with a link, which downloads malware that exploits the use of legitimate files, opening the door for data exfiltration.
• Identity-based cyberattacks. Any Microsoft cloud business application (e.g., OneDrive, SharePoint, Teams), as well as Microsoft Entra ID, is based on account authentication and therefore a growing target for sophisticated cyberattacks that evade endpoint and network security monitoring. NDR can increase security in these environments by detecting threats such as attackers performing admin-level operations in Microsoft Entra ID, redundant access creation and abnormal Microsoft 365 operations and download activity.
• Growing awareness of the shared responsibility implications of the public cloud service model. Shared responsibility implies that, while the cloud provider is responsible for network controls and applications, data stored in the cloud is owned by the customer. Hence, the customer is responsible for securing that data and for identity management, to prevent leakage and insider threats.

NDR/XDR Opportunity

• The majority of NDR evaluations are for stand-alone deployments today, but this could change as XDR platforms make progress, especially for midmarket buyers.
• Larger enterprises have broadly resisted adopting XDR products. They will broadly continue to deploy NDR as a stand-alone monitoring solution, further limiting XDR from becoming the natural evolution of NDR in the future.

Managed Detection and Response (MDR) Services

• Growing demand from organizations to outsource security. Gartner projects that by 2025, 60% of organizations will be actively using remote threat disruption and containment capabilities delivered directly by MDR providers, up from 30% today. This encompasses organizations of all sizes, from SMBs with lack of personnel resources to large enterprises looking to outsource threat detection, investigation and response operational delivery. NDR vendors can offer MDR services themselves or partner with detection and response service providers. As clients with larger size and increased security maturity consider the adoption of MDR, Gartner sees more MDR providers willing to support wider compatibility with existing technology investments.
• Vertical-market synergies. Interest in MDR services stands out in government, finance and healthcare, which are also key verticals for NDR. This means that similar types of organizations are attracted by the outsource or “shared responsibility” model of MDR.
• Tapping into the OT opportunity. This industry has a business requirement to protect critical business processes in the “detect and respond” aspect of operational technology (OT), in many cases under heavy regulatory compliance requirements. OT environments require specialization of security talent and technologies themselves. Thus, Gartner sees MDR’s differentiation in this area as a key to OT sales and service line targeting (see Emerging Tech: Security — Leverage Emerging MDR Trends to Grow Your Security Service Revenue).

• Growing competition. Gartner estimates that there are more than 600 providers claiming to offer MDR services.
• Value proposition. While many MDR providers will openly advertise the NDR technology that they use (e.g., from Corelight, Darktrace, ExtraHop), others competitively position their MDR offering against specific NDR solutions. However, there is a fundamental difference in the delivery of technology capability and the functional extent of a human-driven service. In addition to advertising a broader package and feature differentiation, a key value proposition from these MDR providers is 24/7 monitoring/threat hunting and expert analysis (in essence the benefits of outsourcing).

NDR for OT/IoT

• Time-sensitive networking (TSN) capabilities creating opportunities to move away from industrial protocols. The emergence of TSN in wired switching and in wireless as part of the upcoming 802.11be standard (aka Wi-Fi 7, expected to be ratified in 2024) is creating opportunities for organizations to move away from proprietary industrial protocols, with cost optimization being a driver.
• IT security tapping into the OT/IoT space. The convergence creates a need to move away from specific OT security solutions to the broader tools used in IT systems. These tools are the same monitoring tools, network access control (NAC)-based authentication including 802.1X, Lightweight Directory Access Protocol (LDAP), the use of tunneling capabilities with VXLAN encapsulation to address the Layer 2 limitations of microsegmentation, and so on.

• Complexity. OT/IoT networks are generally complex environments, as there are over 100 proprietary protocols used in industrial networks. NDR greatly lags compared to cyber-physical systems (CPS) protection platforms, which can offer vast support of industrial communication protocols — up to several hundred — including proprietary OT protocols (e.g., Emerson ROC, Siemens S7 Communication, Schneider Electric TriStation).
• Limitations of standard Ethernet networks. We still see many industrial networks designed based on Token Ring, a LAN topology from the 1980s, due to the limitations of traditional “best-effort” 802.3 Ethernet to assure adequate network latency and low jitter for critical industrial applications.

Use of GenAI in NDR

• Enhanced threat hunting capabilities. We see GenAI first developing to assist in incident response use cases. This could encompass large language models (LLMs) contextualizing and accelerating investigation workflows (validation and triage), automation of IR processes, support of more-advanced natural language queries, enhancements in content processing, and so on.
• Improved defense optimization. Detection based on GenAI techniques can develop to better simulate diverse attack scenarios and suggest optimal defensive strategies, strengthening network security posture.

• Explainability and transparency. Understanding how GenAI models arrive at certain conclusions can be difficult, creating potential issues with trust and decision making.
• Biased datasets. Classification ML needs to be highly accurate and reliable for GenAI to deliver value. Biased training data can lead to biased algorithms that misinterpret network activity or overlook certain threats. Careful data curation and monitoring are crucial.
• Overreliance and trust issues. Potential overdependence on GenAI can lead to neglecting other security measures and potential human error in interpreting its outputs.