The Evolving Role of NDR

1Enterprise Strategy Group | Getting to the bigger truth.™

The Evolving Role of NDR
Leveraging AI and Cloud Visibility
to Support XDR Strategies
John Grady, Senior Analyst

september 2022

© 2022 TechTarget, Inc. All Rights Reserved.

Back to Contents

The Evolving Role of NDR

2

Research Objectives
The potential for serious business disruptions makes detecting threats quickly and accurately critical to preventing data loss,
compliance violations, and lost revenue. Even as resources and users leave the traditional perimeter, the network should play a keyrole in detecting threats to avoid business disruption. Specifically, network-based tools provide consistent, comprehensive visibility
across distributed, heterogeneous environments and remain outside the scope of attacker manipulation. Yet the number of threat
detection and response tools that are available can leave users unsure of where to prioritize.
In order to gain insight into these trends, ESG surveyed 376 IT, cybersecurity, and networking professionals responsible for evaluating,purchasing, and managing network security products and services for their organizations.

This study sought to:Gain insights into the challenges security teams face withthe current threat detection and response landscape.

Examine how NDR tools are used today and where
they fit into broader XDR plans and strategies.

Gauge the key capabilities organizations require from NDR
tools and the use cases they are seeking to address.

Understand why security teams are prioritizing
NDR and the benefits they are seeing.

© 2022 TechTarget, Inc. All Rights Reserved.

The Evolving Role of NDR

keyfindings

Organizations Face Many Threat
Detection and Response Challenges

Security Teams Are Prioritizing
NDR for a Variety of Reasons

Diverse Use Cases Require a
Range of Capabilities

Encrypted threats are a significant problem
and can cause issues across the attack chain.

Many use NDR as a first line of defense
due to high fidelity, ease of use, andbreadth of coverage.

Breadth of coverage and investigative
capabilities are most important.

page 4page 8page 11

Strong AI Has Become
Integral to NDRNDR Emerges as a Key Component
to XDR Strategies

Security Teams Cite Both Security
and Business Benefits from NDR

Users expect AI to improve both threat
detection and operational efficiency.

A majority view NDR as foundational to
XDR, and a cloud focus will be critical.

Many reported fewer breaches, lower
costs, and accelerated cloud migrations.

page 14page 16

page 19

click to follow© 2022 TechTarget, Inc. All Rights Reserved.

Organizations
Face Many
Threat Detection
and Response
Challenges

The Evolving Role of NDR

5Complexity, Threats, and SOC Workload Remain Key Issues
Threat detection and response (TDR) continues to become more difficult for many security teams for a variety of reasons. Nearly half of organizations (45%) cited the increasing threat
detection and response workload, which in many ways is the result of having to defend more distributed and dynamic environments against increasingly persistent adversaries.
Environmental complexity plays a key role, with 40% of organizations citing the increase in cloud-based resources and 36% pointing to the increase in devices on the network as top
challenges. The threat landscape is also top of mind, with 37% pointing to the sophistication of threats, and 35% citing the volume of threats as challenges.
| Threat detection and response challenges.

45+55+S
35+65+S
25+75+S

45%

The threat detection/response
workload has increased35%

The volume of threats has
increased, making it difficult
to keep pace

25%

Threat detection/response isdependent on many manual
processes at my organization© 2022 TechTarget, Inc. All Rights Reserved.

54+46+S
29+71+S
23+77+S

40%

More resourcesin the cloud

29%

Communication/collaboration
issues between SOC andother IT teams

23%

My organization’s SOC
analysts do not have theright level of skills

37+63+S
27+73+S
22+78+S

37%

The sophistication of threats has
increased, making it difficult tofind legitimate attacks

27%

Inconsistent/incomplete
visibility across different
security layers

22%

The tools my organization uses
do not work as promised

36+64+S
27+73+S
18+82+S

36%

More deviceson the network

27%

My organization uses
numerous disparate threat
detection/response tools

18%

My organizationis understaffed

Back to Contents

The Evolving Role of NDR

6“Many security teams canhave difficulty detecting andstopping threats targeting
their organization.”Issues Are Prevalent Across the Attack Chain
As a result of these challenges, many security teams can have difficulty detecting and stopping threats targeting
their organization. Further, issues persist across most of the MITRE ATT&CK Framework. While nearly one-third(32%) of respondents cited difficulty identifying and blocking command and control communications, many
also reported issues during the evasive and persistence phases. Problems detecting credential access, privilege
escalation, execution, and initial access were all cited by 28% of organizations. Detecting reconnaissance andlateral movement were less problematic, but still reported by 19% and 18% of organizations, respectively.

| Areas of greatest difficulty within MITRE ATT&CK framework.

32+68+S 31+69+S 31+69+S 28+72+S 28+72+S
28+72+S 28+72+S 23+77+S 19+81+S 18+82+S
32%

31%

31%

28%

28%

28%

28%

23%

19%

18%

Commandand control

Execution© 2022 TechTarget, Inc. All Rights Reserved.

DefenseevasionInitialaccessPersistence

Exfiltration

Credential
accessReconnaissance

Privilege
escalation

Lateralmovement

Back to Contents

The Evolving Role of NDR

7

Attackers Use Encryption Frequently and Across Multiple Stages
The use of encryption to obfuscate attacks is one reason detection has become more difficult over time. In fact, 24%of organizations have suffered an attack that leveraged encryption once, while nearly half (45%) have suffered multiple
attacks that used this approach. Further, encryption is frequently used across multiple stages of the attack. More than
two-thirds (70%) of organizations that had suffered an encrypted attack reported that data was exfiltrated throughencrypted channels. This was followed by 64% that indicated that command and control communications wereencrypted and/or malware was encrypted during delivery. A key reason for this is likely a lack of visibility, with only
34% of organizations reporting that they have visibility into all the encrypted traffic in their environment.

24+4531U| Has your organization ever fallen victim to an attack that usedencrypted traffic to avoid detection?

© 2022 TechTarget, Inc. All Rights Reserved.

24%

Yes, once

45%

Yes, multiple times

Only 34%of organizations have visibility into
ALL their encrypted traffic.

How attacks leveraged encryption.

Data exfiltration was executed throughencrypted channels

70%

Command and control traffic was hidden in
encrypted channels

64%

Malware was delivered through encryptedchannels

64%

Back to Contents

The Evolving Role of NDR

8Security Teams Are
Prioritizing NDR for a
Variety of Reasons© 2022 TechTarget, Inc. All Rights Reserved.

Back to Contents

The Evolving Role of NDR

9NDR Is Often Used as a First Line of Defense
Security teams have a variety of choices when it comes to threat detection and response tools. Security
information and event management (SIEM) and endpoint detection and response (EDR) are staples
in the SOC, and extended detection and response (XDR) has seen a surge in interest over the last
18 months. Yet even with all these options, 46% say NDR is most effective for threat detection andresponse. As a result, many are prioritizing NDR. Specifically, 42% say they tend to use NDR as a firstline of defense for threat detection. An additional 33% use NDR in conjunction with other tools, such as
SIEM, EDR, and XDR, as a first line of defense.

46%

of organizations identify network detection
and response technology as most effective
for threat detection and response.

| How organizations use NDR for threat detection and response.

My organization tends(or expects) to use NDR tools
as a first line of defense forthreat detection

My organization tends(or expects) to use EDR
as a first line of defense forthreat detection

My organization tends(or expects) to use XDR
as a first line of defense forthreat detection

My organization tends(or expects) to use SIEM
as a first line of defense forthreat detection

My organization uses or will
use both NDR tools and othertools (such as EDR, SIEM, and
XDR) together as a first line ofdefense for threat detection

42%

13%

7%

5%

33%

42+58+S 13+87+S 7+93+S 13+87+S 33+67+S© 2022 TechTarget, Inc. All Rights Reserved.

Back to Contents

The Evolving Role of NDR

10NDR Is Used Due to High Fidelity, Ease of Use, and Breadth of Coverage
The reasons for which an organization may choose to use NDR tools can vary. Both false positives and false negatives can have a significant impact on security teams, making highefficacy critical. As a result, more than half (53%) of organizations use NDR because they feel it provides the highest fidelity. Ease of deployment (48%) and ease of management (47%)
were also commonly cited and can help organizations struggling with the cybersecurity skills gap achieve better efficiency. Finally, 45% noted the visibility NDR offers across different
parts of the environment as a reason for their use. With attackers seeking to exploit the siloed visibility many organizations have across cloud and on-premises resources, achieving
more consistent visibility has become a priority.
| Primary reasons for using NDR.

53+47+S
45+55+S
36+64+S© 2022 TechTarget, Inc. All Rights Reserved.

53%

NDR tools provide thehighest fidelity

45%

Network-based tools provide thebroadest visibility across different
parts of our environment

36%

Alignment with ourorganization’s skill level

48+52+S
44+56+S
28+72+S48%

NDR tools areeasiest to deploy

44%

To support adefense-in-depth strategy

28%

Current tools aren’t effective atcorrelating alerts, causing us to
struggle to keep up with alert triage

47+53+S
41+59+S
24+76+S47%

NDR tools areeasiest to manage

41%

Network-based tools are
more difficult for attackers tocircumvent/tamper with

24%

Other tools struggle to detectand investigate advance threats

Back to Contents

The Evolving Role of NDR

11Diverse Use Cases
Require a Range ofCapabilities© 2022 TechTarget, Inc. All Rights Reserved.

Back to Contents

The Evolving Role of NDR

12“NDR Can Support a Diverse Set of Use Cases

At the top of the list,
56% of respondents seek toimprove their organization’s
response capabilities.”| Use cases supported by NDR.

56+44+S
46+54+S

56%

Improving response
capabilities

46%

Detecting attacks
that have been missedby other tools© 2022 TechTarget, Inc. All Rights Reserved.

52+48+S
43+57+S

Security teams use NDR to support a number of use cases. At the top of the list, 56% of respondents seek toimprove their organization’s response capabilities. Relatedly, 47% use NDR to accelerate their incident response
processes. The evolution of traditional network traffic analytics (NTA) toward NDR is really focused on these points:
streamlining workflows and facilitating integrations to ensure that once a threat is detected, it can be addressed
quickly and effectively. More than half of respondents (52%) use NDR to monitor cloud environments, further
validating the previous point about the need for consistency across internal and external environments. Alongsimilar lines, 41% use NDR to monitor assets on which agents cannot be deployed. This could point to cloudenvironments as well as IoT devices, both of which can benefit from agentless deployment models.

52%

Monitoring cloudenvironments

43%

Enabling
threat hunting

49+51+S
41+59+S

49%

Detecting advanced
attacks using multi-sensor
XDR telemetry

41%

Monitoring assets
on which agents cannot
be deployed

47+53+S
39+61+S

47%

Accelerating incident
response processes

39%

Supporting
forensics activities

Back to Contents

The Evolving Role of NDR

13| Most important NDR attributes.

Coverage and Investigative
Capabilities Are Deemed
Most Important
Supporting such a variety of use cases
requires a number of capabilities. To address
different parts of the environment consistently,
understanding IoT/OT protocols (40%),
deployment flexibility (34%), and coverage for
IaaS environments (31%) are all important.
Additionally, the ability to consume SaaS
telemetry (33%) is a newer feature that canhelp round out NDR coverage. When it comesto investigating incidents, security analysts
typically have a preference as to how they liketo work. Some prefer to turn to the SIEM earlyin the process, reflected by the fact that 35%
cited the need for integrations with SIEM and
SOAR tools. Conversely, others may spend
more time in the NDR console itself, either totriage and perform initial analysis or because
their organization does not use a SIEM. As aresult, 34% highlighted the need for a strong UI
to investigate events directly. Finally, 30% citedthe need to detect encrypted threats without
decrypting, highlighting threat posed fromthese types of attacks.

© 2022 TechTarget, Inc. All Rights Reserved.

Understanding of IoT/OT protocols to protect connected environments

40%

Integrations with SIEM and SOAR technologies

35%

A strong UI for investigating events directly in the NDR console

34%

Highly customizable for analysts to drive hunting activities

34%

Deployment flexibility

34%

Ability to consume SaaS telemetry and provide detections

33%

Coverage for IaaS environments

31%

Encrypted threat detection without decrypting

30%

Native response control capabilities

27%

Full packet capture

26%

AI/ML

23%

Support for IDS signatures

21%

Guided workflows to support analysts

21%

In-line IPS blocking

20%

Back to Contents

The Evolving Role of NDR

14Strong AI Has Become
Integral to NDR© 2022 TechTarget, Inc. All Rights Reserved.

Back to Contents

The Evolving Role of NDR

15

Expected Benefits from Incorporating AI/ML as Part of NDROver the last few years, NDR vendors have added artificial intelligence and machine learning capabilities to their tools. The need for AI/ML support is recognized by users, with 46% indicatingstrong AI capabilities are critical to NDR, and an additional 45% saying strong AI is important. There is clearly a belief that AI can enable better detections, with 61% of organizations interested
in AI-enabled NDR for better detection accuracy, and 59% for better detection speed.
AI/ML may provide benefits from an efficiency and workflow perspective as well. Specifically, accurately prioritizing alerts (47%), informing/directing analyst workflows (45%), and automating
response (42%) were all frequently mentioned by respondents. Especially in cloud environments where scale and speed are critical, these capabilities can help security teams keep pace.

| Importance of AI in NDR tools.

Reasons for leveraging AI/ML capabilities as part of NDR solutions.

46+459U

46%

Strong AI capabilities
are a critical attributeof NDR tools

45%

Strong AI capabilities
are an important
attribute of NDR tools© 2022 TechTarget, Inc. All Rights Reserved.

Improving detection accuracy

61%

Improving detection speed

59%

Identifying network devices and entities

47%

Accurately prioritizing alerts

47%

Informing/directing analyst workflows

45%

Identifying gaps in compliance42%

Supporting automated response capabilities

42%

Back to Contents

The Evolving Role of NDR

16

NDR Emerges as a
Key Component to
XDR Strategies© 2022 TechTarget, Inc. All Rights Reserved.

Back to Contents

The Evolving Role of NDRMost View NDR As
Foundational to XDR
XDR is on the radar for many organizations. In fact, morethan half of organizations (52%) say they are in the processof deploying XDR, with an additional 41% planning toin the next 12-24 months. While XDR at times has been
described as an extension of EDR, most organizations
seem to disagree. Specifically, 56% say that NDR will form
the foundation of their organization’s XDR strategy. Morethan one-third (35%) say NDR will be a secondary part of
XDR. Only 3% say NDR will remain independent from XDR.
For many, this will form the basis of their cloud detection
and response strategies, with 40% indicating NDR is mosteffective at collecting, processing, and analyzing cloud
telemetry data, and 30% believing XDR is most effective.

17| Most effective TDR tool for collecting, processing, and analyzing cloud telemetry data.

NDR

XDR

Tools fromcloud service providers

40%

30%

17%

40+60+S 30+70+S 17+83+S 13+87+S| Role of NDR in an XDR strategy.

of organizations are in theprocess of deploying an XDR solution.

© 2022 TechTarget, Inc. All Rights Reserved.

13%

Chart Title

NDR will form the foundation of our organization’s XDR strategy

52%

EDR

56%

NDR will be a secondary part of our organization’s XDR strategy
NDR will be a part of our organization’s XDR strategy, but we do
not have a timeline
NDR will remain independent of our organization’s XDR strategy

35%

5%

3%

Back to Contents

The Evolving Role of NDR

18Limited Agreement on How NDR Will Be Consumed
Nearly half of organizations (48%) say they would prefer to get NDR and other XDR capabilities from the same vendor. At the same time, 43% indicate an alliance approach is most attractive.
Overall, 8% will look to service providers (either for integration or management). So, while there is consensus that XDR should be vendor-led, as opposed to service provider-led, organizations
disagree on the best approach. Ultimately, choosing a path will depend on the tools that have already been deployed, vendor relationships, and the outcomes expected from XDR.

| How NDR will likely be consumed as part of an XDR strategy.

We would prefer to get
NDR from the same vendor
offering other tools supporting
our XDR strategy

We would prefer that our
NDR vendor participate in technology
alliances with other vendors to
support our XDR strategy

We would prefer that
NDR and the other tools
supporting our XDR strategy be
integrated by a service provider

We would prefer to consume
NDR and the other tools
supporting our XDR strategy asa managed service

48%

43%

6%

2%

48+52+S 43+57+S 6+94+S 2+98+S© 2022 TechTarget, Inc. All Rights Reserved.

Back to Contents

The Evolving Role of NDR

19

Security Teams Cite
Both Security andBusiness Benefits
from NDR© 2022 TechTarget, Inc. All Rights Reserved.

Back to Contents

The Evolving Role of NDR

20

Improved Analyst Efficiency and Time to Detection Are Common Benefits from NDR
Security teams reported a variety of benefits due to their organization’s use of NDR. In fact, respondents claimed at least three benefits on average. Improved SOC analyst efficiency wasreported by 60% of organizations. Similarly, 59% cited reduced mean time to detection, and nearly half (49%) indicated they had fewer data breaches. In addition to positive security
outcomes, 49% claimed reduced operational costs, and 47% noted reduced operational complexity. While cited least often, nearly a quarter (24%) said that NDR had helped accelerate
cloud migrations. So, while threat detection and response strategies can vary widely, NDR can help organizations achieve both better security and business outcomes.
| Benefits realized from NDR.
Improved SOC analyst efficiency

60%

Reduced mean time to detection

59%

Reduced operational costs

49%

Fewer data breaches

49%

Reduced operational complexity

47%

Reduced mean time to response
Accelerated cloud migrations© 2022 TechTarget, Inc. All Rights Reserved.

44%“

Respondents
claimed at least
three benefits
on average.”

24%

Back to Contents

The Evolving Role of NDR

21Corelight provides security teams with network evidence so they can protect the world’s most criticalorganizations and companies. Corelight’s global customers include Fortune 500 companies, major
government agencies, and large research universities. Based in San Francisco, Corelight is an open-core
security company founded by the creators of Zeek®, the widely-used network security technology.

LEARN MORE

About ESGEnterprise Strategy Group is an integrated technology analysis, research, and strategy firm providing market
intelligence, actionable insight, and go-to-market content services to the global technology community.

© 2022 TechTarget, Inc. All Rights Reserved.

Back to Contents

The Evolving Role of NDR

22

Research Methodology and Demographics
To gather data for this report, ESG conducted a comprehensive online survey of IT, cybersecurity, and networking professionals from private- and public-sector organizations inNorth America between August 5, 2022 and August 16, 2022. To qualify for this survey, respondents were required to be IT, cybersecurity, or networking professionals responsible for
evaluating, purchasing, and managing network security products and services for their organizations. All respondents were provided an incentive to complete the survey in the form of
cash awards and/or cash equivalents.
After filtering out unqualified respondents, removing duplicate responses, and screening the remaining completed responses (on a number of criteria) for data integrity, we were left
with a final total sample of 376 IT, cybersecurity, and networking professionals.

Respondents by Number of Employees

10,000 to 19,999, 5%

20,000 or
more, 2%

Respondents by Age of Company
More than
50 years, 9%500 to 999,
11%

Less than 5
years, 1%

Respondents by Industry
Financial
5 to 10years, 20%

5,000 to9,999, 15%
21 to 50
years, 26%

2,500 to4,999, 26%

1,000 to2,499, 41%

35%

Manufacturing

22%

Retail/wholesale

10%

Technology

9%

Healthcare

5%

Business services

3%

Communications and media

1%

Government

1%

Other

13%

11 to 20years, 44%© 2022 TechTarget, Inc. All Rights Reserved.

Back to Contents

All product names, logos, brands, and trademarks are the property of their respective owners. Information contained in this publication has been obtained by sources TechTarget, Inc. considers to be reliable but is not warranted by TechTarget, Inc. Thispublication may contain opinions of TechTarget, Inc., which are subject to change. This publication may include forecasts, projections, and other predictive statements that represent TechTarget, Inc.’s assumptions and expectations in light of currently
available information. These forecasts are based on industry trends and involve variables and uncertainties. Consequently, TechTarget, Inc. makes no warranty as to the accuracy of specific forecasts, projections or predictive statements contained herein.
This publication is copyrighted by TechTarget, Inc. Any reproduction or redistribution of this publication, in whole or in part, whether in hard-copy format, electronically, or otherwise to persons not authorized to receive it, without the express consent of
TechTarget, Inc., is in violation of U.S. copyright law and will be subject to an action for civil damages and, if applicable, criminal prosecution. Should you have any questions, please contact Client Relations at cr@esg-global.com.

Enterprise Strategy Group is an integrated technology analysis, research, and strategy firm providing market
intelligence, actionable insight, and go-to-market content services to the global technology community.
© 2022 TechTarget, Inc. All Rights Reserved.