EP272 More Than Just Packets: Is NDR a "First-Class" Cloud Security Control?

Key takeaways

Network Detection and Response (NDR) is experiencing a revival as an essential security control, even in 2026, due to its ability to provide comprehensive visibility into network activity.
Despite advancements in encryption, cloud architectures, and zero trust models, network visibility remains vital for detecting lateral movements, unknown threats, and behavioral anomalies, often filling gaps that identity-based or agent-based solutions cannot cover.
Effective NDR solutions leverage innovative architectures such as zero-copy packet processing, enabling scalability and cost-efficiency in high-bandwidth environments, making them economically viable for widespread deployment.
Organizations should prioritize understanding and inventorying their assets and network relationships in real time, as this foundational knowledge is critical for deploying effective security controls.
Deploying NDR offers additional benefits such as performance monitoring and bandwidth management, providing a dual advantage and justifying the investment in such technologies.

Summary

Revisiting Network Detection and Response (NDR) in 2026

This section discusses the resurgence of NDR as a critical security control, countering the misconception that it had become obsolete compared to EDR. The speakers emphasize that the network continues to be an essential source of intelligence for organizations, especially with the complexities introduced by cloud environments, encryption, and high bandwidth traffic. NDR provides a holistic view of enterprise activities — the network acts as a 'holograph' of the entire organization — and is valuable in detecting lateral movements, unseen threats, and anomalies without deploying agents everywhere. The discussion highlights that despite advances in endpoint security, the network remains the most comprehensive and reliable source for monitoring and security, especially against modern sophisticated threats.

Challenges of Encryption, Cloud, and Zero Trust for Network Visibility

The episode addresses the sophisticated nature of modern encrypted traffic and the misconception that encryption renders network monitoring obsolete. Instead, the speakers describe techniques such as obtaining symmetric keys from middleboxes or proxies to decrypt TLS traffic without violating security boundaries. They also explore the difficulty in maintaining visibility in hybrid cloud and SaaS environments, where east-west traffic, microservices, and dynamic workloads complicate monitoring. Zero Trust models, while conceptually robust, do not eliminate the need for network visibility, as lateral movement and unknown interactions still occur. The core argument is that network monitoring remains vital for understanding the true state of security and asset relationships in a complex, encrypted, and cloud-enabled landscape.

Cost, Performance, and Practical Deployment of NDR Solutions

The discussion emphasizes that effective NDR solutions, like ExtraHop, leverage architecture designs such as zero-copy packet processing to handle high-bandwidth environments efficiently, reducing costs associated with storage and analysis. The speakers highlight that deploying NDR can provide dual benefits: improving security monitoring and performance oversight simultaneously, thus justifying the investment. They argue that scalable, high-performance solutions facilitate broader adoption and help organizations gain comprehensive insights without excessive infrastructure costs. Moreover, the importance of patience and proper implementation to realize the full value of NDR is stressed — such solutions require significant initial development but pay off over time.

Show notes

Guest:

Raja Mukerji, Co-Founder & Chief Scientist, Extrahop
Rafal Los, VP of Client Relations and Strategic Initiatives, Extrahop

Topics:

Is Network Detection and Response (NDR) coming back after being shoved to the side by EDR a bit? Is this for real?
What's the value proposition of NDR in 2026, because some people still don't understand it? How does NDR apply to the world of WFH, cloud/SaaS, encryption, high bandwidth, etc?
Is the value of NDR the same, or different, when it comes to public (or private) cloud?
How does NDR fill visibility gaps that identity and agent-based solutions cannot?
What does NDR offer that built-in cloud security tooling (as of right now) does not? Would you call NDR a key cloud security control?
Does NDR help with shadow AI?
NDR elephant in the room is sometimes cost. How does cost change the value prop when compared to on-premise or physical infrastructure?

Resources: