[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:network-detection-response":3},{"control":4,"products":25,"stories":50,"lessons":94,"related":119,"compare":148},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":21,"updated_at":24},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.","Analysis of network traffic to spot lateral movement, command-and-control traffic and data theft, including from devices that cannot run a security agent.","Printers, industrial equipment, appliances and unmanaged devices cannot run endpoint protection, and attackers know it. Network detection covers those blind spots, and is often how intrusions that slipped past endpoint tools get caught.",[11,12,13,14],"How does it handle encrypted traffic?","Does it cover cloud network traffic as well as on-premises?","How many alerts a day should we expect, and how are they prioritised?","Can it work with our endpoint tools and SIEM to respond?","Risk: lateral movement and data theft through devices without endpoint protection. Control: NDR on core network segments and cloud. Owner: security operations lead. Measure: share of internal traffic monitored.",[17,18,19,20],"NIS2 Art. 21(2)(b): incident handling","DORA Art. 10: detection of anomalous activities","CIS Control 13: network monitoring and defence","ISO\u002FIEC 27001:2022 A.8.16: monitoring activities",{"name":22,"slug":23},"Logging & Monitoring","logging-monitoring","2026-10-16T12:48:15.072121+00:00",[26,34,42],{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":30,"product_name":31,"url":32,"description":33},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":35,"vendor_name":36,"vendor_logo":37,"product_slug":38,"product_name":39,"url":40,"description":41},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":43,"vendor_name":44,"vendor_logo":45,"product_slug":46,"product_name":47,"url":48,"description":49},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"total":51,"last_days":52,"recent":53},503,155,[54,59,64,69,74,79,84,89],{"slug":55,"title":56,"published_at":57,"brief":58},"sckit-abuses-screenconnect-to-deploy-remote-access-and-target-technician-session-36ece2","SCKit abuses ScreenConnect to deploy remote access and target technician sessions","2026-11-13T21:31:44+00:00","SCKit malware abuses ScreenConnect to gain unauthorized remote access and target IT technicians.",{"slug":60,"title":61,"published_at":62,"brief":63},"artex-and-beyond-ai-enabled-penetration-testing-platforms-d59fa8","ARTEX and beyond: AI-enabled penetration testing platforms","2026-11-13T20:57:13+00:00","AI-enabled penetration testing frameworks like ARTEX are being misused by threat actors to accelerate intrusions.",{"slug":65,"title":66,"published_at":67,"brief":68},"silentair-hackers-intercept-calls-sms-from-inside-mobile-networks-76848e","SilentAir Hackers Intercept Calls, SMS From Inside Mobile Networks","2026-11-13T12:20:28+00:00","SilentAir hackers exploit mobile network nodes to intercept calls and SMS, targeting Taiwan.",{"slug":70,"title":71,"published_at":72,"brief":73},"hackers-use-deepseek-and-glm-ai-agents-to-breach-10-organizations-in-autonomous-1e7126","Hackers Use DeepSeek and GLM AI Agents to Breach 10 Organizations in Autonomous Cyberattacks","2026-11-13T11:56:24+00:00","Hackers used AI agents powered by DeepSeek and GLM to breach 10 organizations autonomously.",{"slug":75,"title":76,"published_at":77,"brief":78},"php2shell-exploited-in-destructive-check-point-gateway-attacks-7182a3","PHP2Shell Exploited in Destructive Check Point Gateway Attacks","2026-11-13T07:39:04+00:00","Attackers exploit PHP2Shell and CVE-2026-123039 to deploy wipers on Check Point gateways.",{"slug":80,"title":81,"published_at":82,"brief":83},"hackers-exploit-new-n-central-zero-day-hours-after-poc-publication-0a366d","Hackers Exploit New N-central Zero-Day Hours After PoC Publication","2026-11-13T07:20:50+00:00","Hackers exploit N-central zero-day vulnerability hours after PoC publication, deploying XMRig miner.",{"slug":85,"title":86,"published_at":87,"brief":88},"kazakhstan-linked-hackers-used-ai-agent-to-spy-on-central-asian-governments-d60106","Kazakhstan-linked hackers used AI agent to spy on Central Asian governments","2026-11-12T13:00:00+00:00","Kazakhstan-linked hackers used an AI agent to spy on Central Asian governments.",{"slug":90,"title":91,"published_at":92,"brief":93},"microsoft-warns-hackers-are-using-gsocket-backdoors-to-keep-linux-servers-compro-d79655","Microsoft Warns Hackers Are Using GSocket Backdoors to Keep Linux Servers Compromised After Patching","2026-11-12T09:44:00+00:00","Hackers use GSocket backdoor to maintain Linux server access post-patching.",[95,99,103,107,111,115],{"slug":96,"title":97,"published_at":98},"sckit-worm-hijacks-screenconnect-sessions-to-compromise-it-technician-workstations","SCKit Worm Hijacks ScreenConnect Sessions to Compromise IT Technician Workstations","2026-11-13T22:20:58.16+00:00",{"slug":100,"title":101,"published_at":102},"ai-powered-pen-testing-tools-lower-the-bar-for-attackers","AI-Powered Pen Testing Tools Lower the Bar for Attackers","2026-11-13T21:20:23.73+00:00",{"slug":104,"title":105,"published_at":106},"state-actors-exploit-telecom-protocols-to-intercept-calls-and-sms-at-network-level","State Actors Exploit Telecom Protocols to Intercept Calls and SMS at Network Level","2026-11-13T13:22:35.957+00:00",{"slug":108,"title":109,"published_at":110},"ai-powered-autonomous-attacks-breach-10-organizations-with-minimal-human-effort","AI-Powered Autonomous Attacks Breach 10 Organizations With Minimal Human Effort","2026-11-13T12:20:26.721+00:00",{"slug":112,"title":113,"published_at":114},"zero-day-in-n-central-exploited-within-hours-of-poc-release","Zero-Day in N-central Exploited Within Hours of PoC Release","2026-11-13T08:21:00.104+00:00",{"slug":116,"title":117,"published_at":118},"unpatched-check-point-gateways-weaponized-for-destructive-wiper-attacks","Unpatched Check Point Gateways Weaponized for Destructive Wiper Attacks","2026-11-13T08:20:43.007+00:00",[120,124,128,132,136,140,144],{"slug":121,"name":122,"problem":123},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":125,"name":126,"problem":127},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",{"slug":129,"name":130,"problem":131},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":133,"name":134,"problem":135},"soc-automation","SOC automation and AI analysts","Alerts arrive faster than the team can investigate them, so real attacks wait in the queue or are closed unread.",{"slug":137,"name":138,"problem":139},"managed-detection-response","Managed detection and response (MDR)","A team watches and responds around the clock when you cannot.",{"slug":141,"name":142,"problem":143},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",{"slug":145,"name":146,"problem":147},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"darktrace\u002Fdarktrace-network":149,"corelight\u002Fopen-ndr":161,"vectra-ai\u002Fvectra-ai-platform":171},{"hq_country":150,"also_provides":151,"reviews":152,"affected":159,"reported":160},"GB",[],[153,156],{"label":154,"url":155},"Gartner Peer Insights: Darktrace \u002F NETWORK user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fdarktrace-network",{"label":157,"url":158},"PeerSpot: Darktrace user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fdarktrace-reviews",0,2,{"hq_country":162,"also_provides":163,"reviews":164,"affected":159,"reported":160},"US",[],[165,168],{"label":166,"url":167},"Gartner Peer Insights: Corelight Open NDR Platform user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fcorelight-open-ndr-platform",{"label":169,"url":170},"PeerSpot: Corelight Open NDR user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fcorelight-open-ndr-reviews",{"hq_country":162,"also_provides":172,"reviews":176,"affected":159,"reported":159},[173],{"slug":174,"name":175},"identity-threat-detection","Identity threat detection and response (ITDR)",[177,180],{"label":178,"url":179},"Gartner Peer Insights: Vectra AI Platform user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fvectra-ai-platform",{"label":181,"url":182},"PeerSpot: Vectra AI user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fvectra-ai-reviews"]