NDR is good at finding sneaky and complicated threats like APTs, zero-day exploits, and other tricky attacks that traditional IDS might miss because they usually look for known patterns.