Network detection (NDR)

Autonomous network traffic analysis+11

Arista Networks is an industry leader in data-driven, client to cloud networking for large data center/AI, campus and routing environments. Arista's award-winning platforms deliver availability, agility, automation, analytics and security through an advanced network operating stack.

AT&T Business

Security Operations

Security operations center management+11

AT&T Business offers **Security Operations Center (SOC)** services that combine managed monitoring, correlation, alerting, and incident response for enterprise networks and applications. In this category, it is positioned as a telecom-scale managed security provider that operationalizes security processes around AT&T network visibility and service management. The offering is best suited to organizations that want outsourced 24x7 security operations, alarm validation, and response support without building a full internal SOC. AT&T also sells adjacent cybersecurity products, but the core Security Operations scope here is its managed SOC/MDR services.

Cisco

Zero Trust / SASE / SSE

14 products

Cisco Umbrella is a cloud-delivered Security Service Edge (SSE) solution that enforces zero trust by continuously verifying identity, device posture, and context before granting access to applications. It converges multiple security functions, secure web gateway, firewall-as-a-service, cloud access security broker, and zero trust network access, into a unified cloud platform. Cisco Umbrella serves enterprises requiring distributed security across remote workers, branch offices, and on-premises infrastructure without complete network architecture overhauls.

CASBCisco SD-WAN integration+16

Cognyte

Threat Intelligence

External threat intelligence collection+10

We are a market leader in investigative analytics software that empowers a variety of government and other organizations with Actionable Intelligence for a Safer World™.

Corelight

Open network visibility across environmentsNetwork detection and response analyticsMachine learning-assisted threat detection+4

3 products

We put evidence at the heart of security.

CybrHawk

Agentic SOC & Investigations

6 products

CybrHawk is a leading provider of cybersecurity solutions. Our offerings help organizations to get their cyber-defences attuned to stall, manage, mitigate and prevent breaches. Our solutions help detect real time suspicious activities and respond quickly to prevent breaches besides predicting possible threats. Our solutions are designed to get better off the problems.

Natural-language SOC investigationAI-assisted alert triage+7

Cynet 360 AutoXDR with MDR

Managed Detection & Response (MDR)

10 products

At Cynet, we imagine a world where any company can have full cybersecurity protections. At Cynet, we are making enterprise-grade cybersecurity accessible, simple and affordable to organizations that don't have the same resources as the Fortune 1000.

24/7 threat monitoring and response+9

Darktrace

Continuously monitors network trafficDetects anomalous network behavior+10

Darktrace is a network detection and response vendor centered on self-learning behavioral analytics for north-south and east-west traffic. Its NDR product baselines normal activity for users, devices, and segments, then flags anomalous connections, command-and-control behavior, data transfer outliers, and other suspicious network patterns in on-premises, cloud, and hybrid environments. The platform is aimed at teams that need visibility beyond endpoint telemetry and want automated investigation and containment for network-level threats, including encrypted traffic and novel attack paths. Darktrace also sells adjacent security products, but this profile is limited to NDR capabilities.

DataSunrise Data and AI Security

Data Security Posture Management (DSPM)

Protect databases across cloud and on-premises+11

DataSunrise provides a unified platform for database security, auditing, and vulnerability management across heterogeneous database environments. The solution includes a database firewall, dynamic data masking, and continuous activity monitoring (DAM) to defend against SQL injection and unauthorized access. It integrates DSPM capabilities to provide visibility into where sensitive PII/PHI resides across RDS, Redshift, Snowflake, and on-prem SQL servers.

DigiCert

Identity & Access Management (IAM)

10 products

Trust built for the AI age

Device certificate authentication policiesAuthentication method controlCertificate issuance protocol support+5

DYNANIC

Deep packet inspection acceleration+9

2 products

DYNANIC is not identifiable from the provided sources as a distinct NDR vendor or product, so there is no reliable evidence to describe a specific Network Detection & Response offering. Based on the NDR category definition, an evaluator would expect east-west and north-south traffic analysis, packet or flow inspection, behavioral anomaly detection, and encrypted traffic analysis, but none of those capabilities are explicitly attributable to DYNANIC in the available results. Market position, target customer, pricing, and company stage could not be verified from the evidence provided.

Enea

Next-generation deep packet inspection+5

Enea (via its Qosmos division) provides the underlying Deep Packet Inspection (DPI) technology and Threat Detection SDKs used by many of the world's leading cybersecurity vendors. The platform offers Granular Traffic Analysis and Protocol Classification capabilities, which are essential for identifying anomalous behavior in encrypted and complex network environments. It is a foundational component for OEMs and service providers building modern NDR, XDR, and Firewall solutions.

enQase

Encryption & Key Management

Post-quantum cryptographic key management+10

enQase provides a quantum-safe security platform designed to transition organizations from classical to post-quantum cryptography (PQC). The platform unifies quantum resource orchestration, hardware-based entropy generation, and a software integration layer to ensure crypto-agility across the enterprise. It complements existing PKI infrastructures by adding quantum-resistant layers to protect long-lived sensitive data against harvest-now-decrypt-later attacks.

Exabeam

Cloud-native security log managementHigh-speed log ingestion and searchBehavioral analytics for anomaly detection+7

Exabeam is the leader in behavior intelligence for the agentic enterprise.

ExtraHop

Packet-level network visibilityOut-of-band traffic decryption+8

ExtraHop is an NDR vendor focused on inspecting east-west and north-south network traffic to detect suspicious activity, encrypted threats, and lateral movement. Its RevealX platform uses packet-level visibility, protocol decoding, and behavioral analytics to help SOC teams investigate incidents down to individual transactions without agents on endpoints. ExtraHop is well suited for enterprises that need forensic depth across hybrid and multi-cloud networks, especially where packet evidence and decrypted traffic are important for breach analysis and threat hunting. The vendor also offers adjacent network performance and IDS capabilities, but its NDR product is the core security use case.

Extreme Networks ExtremeControl

Network Access Control (NAC)

3 products

Extreme Networks ExtremeControl is a centralized Network Access Control (NAC) solution that enforces role-based access policies for wired, wireless LAN, and VPN users across multi-vendor switches and access points. It integrates authentication via 802.1X, Web-based, Kerberos, and RADIUS; vulnerability assessment for security posture checks; and location services to authorize endpoints. ExtremeControl engines detect devices by MAC/IP addresses, assign VLANs or policy roles on Extreme switches, support RFC 3580 quarantine, IPv6, Microsoft NAP, and TNC interoperability. Best for enterprises with Extreme Networks infrastructure seeking BYOD, IoT, and granular post-connect enforcement with assisted remediation.

Pre-connect and post-connect access control+11

Fortra

Email Security

Deep Content Inspection for threat detection+11

Clearswift Secure Email Gateway is an enterprise email security gateway that inspects inbound and outbound mail for spam, malware, phishing, and data leakage before messages reach users or leave the organization. It is positioned as a deployment-flexible SEG for organizations that need on-premises, virtual appliance, or cloud delivery, and it is used by mid-market and enterprise buyers, including regulated sectors such as financial services, public sector, and defense. Its email scope is centered on threat prevention, content control, and outbound data protection rather than broader security platform functions.

Forward Networks

Verified network behavior modelingEast-west traffic analysis+9

Transforming networks to be more reliable, agile, and secure

Gigamon

Delivers full-fidelity network telemetry+11

The Gigamon AI-powered Deep Observability Pipeline efficiently delivers network-derived telemetry to cloud, security, and observability tools. Enriched with AI-driven insights, this telemetry helps organizations uncover previously hidden threats, identify and resolve performance issues, and close compliance gaps by validating ongoing adherence.

HAProxy Technologies

Threat detection engine+10

We are the company behind HAProxy One, the world's fastest application delivery and security platform, and HAProxy, the most widely used software load balancer.

Hillstone Networks

Multi-stage network threat detection+10

Hillstone Networks offers Network Detection and Response under its Breach Detection System (BDS) line for monitoring enterprise network traffic and identifying post-breach activity. In scope, it analyzes raw traffic, flow records, and packet data to detect anomalous east-west and north-south behavior using machine learning, rule matching, and threat-intelligence inputs. It is best suited for SOC teams that want network-centric detection with forensics and response tied to network infrastructure. Hillstone also sells adjacent XDR and firewall products, but those are separate from the NDR use case.

IronNet

Monitor east-west and north-south traffic+7

IronNet sells IronDefense, a network detection and response platform focused on detecting suspicious behavior in east-west and north-south traffic across cloud, virtual, and on-premises environments. Its published materials emphasize behavioral analytics, machine learning, packet and metadata analysis, and encrypted-traffic anomaly detection to find threats missed by signature-based tools. The vendor is positioned for security teams that want network-centric detection, threat hunting, and incident investigation rather than endpoint telemetry. IronNet also references its Collective Defense intelligence-sharing model, but its NDR scope remains centered on network visibility and response.

knocknoc.io

Just-in-time network access control+9

Knocknoc is a just-in-time network access control platform that reduces exposed attack surface by dynamically adding and removing IP addresses from allowlists after authentication. In the narrow NDR sense, it is not a packet-capture or anomaly-detection engine; instead, it sits adjacent to network defense by controlling north-south exposure through firewall and cloud security-group rule changes. It is best for organizations that want temporary, identity-linked access to internal services, administrative interfaces, or web applications without leaving services permanently reachable.

Lumu Technologies

Continuously monitors network traffic+9

Lumu is a continuous compromise assessment platform that uses network traffic analysis as the primary indicator of security health. By ingestion of metadata from DNS, NetFlow, Proxies, and Firewall logs, Lumu identifies confirmed instances of compromise that often bypass perimeter defenses. It automates the correlation of internal network patterns with global threat intelligence to provide high-fidelity alerts and trigger automated responses.

Netscout Arbor

Firewall / NGFW

Inline perimeter DDoS protection+10

NETSCOUT Arbor is a DDoS protection platform with 25+ years of market presence, not a traditional firewall/NGFW. The Arbor Edge Defense (AED) appliance deploys inline between internet router and firewall to provide stateless, always-on DDoS mitigation. Arbor monitors 800Tbps of traffic across 550+ customers representing ~50% of global internet traffic. Best suited for enterprises requiring carrier-class DDoS defense with integrated threat intelligence and outbound compromise detection.

NetWitness

Enriched log data analysis+10

7 products

NetWitness is a comprehensive threat detection and response platform that integrates SIEM, network forensics, endpoint data, and user entity behavior analytics (UEBA). It provides security analysts with deep visibility across the entire attack lifecycle by capturing and analyzing packet-level data alongside logs and endpoint telemetry. The platform is designed for high-scale enterprise environments, replacing fragmented point solutions with a unified workbench for incident investigation and response orchestration.

NordLayer

Zero Trust / SASE / SSE

Zero Trust Network Access with context-based authorization

NordLayer is a cloud-native SASE platform consolidating SD-WAN, firewall-as-a-service (FWaaS), secure web gateway (SWG), cloud access security broker (CASB), and zero trust network access (ZTNA) into a unified service. The vendor targets enterprises transitioning from point-solution security architectures to integrated cloud-delivered frameworks. NordLayer serves organizations requiring secure remote access, hybrid IT environments, and zero trust implementation without hardware-dependent infrastructure.

OpenVPN

VPN protocol fingerprint detection+9

3 products

Secure your network. Connect your team. OpenVPN is a global leader in cybersecurity that enables organizations to truly safeguard their assets through secure network connections.

OPSWAT

Vulnerability Management

9 products

OPSWAT prevents known, unknown, and AI-generated threats from reaching the systems the world depends on. The MetaDefender Platform, OPSWAT's AI-powered cybersecurity solution, secures every file, device, and data transfer across IT, OT, and cross-domain environments.

Detect and report installed software vulnerabilities

Port0

Identity & Access Management (IAM)

Identity and network context analysis+8

Port0 is a network security platform with an integrations hub and connector framework, but the available public material does not show a dedicated Identity & Access Management (IAM) product. For an IAM buyer, it appears best fit only where identity data, access signals, or directory-related context need to be connected into a broader security graph. Its published content emphasizes integrations, live querying, and data fusion rather than core IAM functions such as SSO, provisioning, or MFA.

Redborder

Managed Detection & Response (MDR)

4 products

We provide Cybersecurity tools to a wide range of companies, institutions, telecomunication providers, etc..We make life easier for CISO and system administrators.

Correlate email, network, remote login, and endpoint signals

Sangfor Technologies

Firewall / NGFW

6 products

Sangfor Technologies’ Network Secure is its firewall/NGFW product, positioned around application-layer control, malware inspection, and integrated web application protection. In this category it combines traditional NGFW functions with malware detection, intrusion prevention, application control, and NG-WAF capabilities in a single appliance. It is best suited for enterprises that want perimeter enforcement plus web application and ransomware-focused controls without adding separate firewall and WAF stacks. Sangfor also pairs the firewall with its own endpoint and network security products for correlated response, but those adjacent capabilities are secondary in this profile.

AI-based malware detection+10

SenseOn

Monitor east-west and north-south traffic+10

2 products

SenseOn unifies security telemetry, analysts, and AI agents into one governed investigation plane for faster, evidence-led response.

SonicWall

Syslog-based network traffic collection and parsing

SonicWall is a partner-first unified cybersecurity portfolio that helps SMBs, MSPs, and IT teams, consolidate network, endpoint, cloud, and threat response across hybrid environments.

Splunk

Collect and normalize security data+11

Our purpose is simple and unwavering: to build a safer and more resilient digital world. Every day, we help SecOps, ITOps, and engineering teams secure their systems, resolve issues quickly, and keep their organizations running without interruption.

Stellar Cyber

Deep packet inspection collects L2–L7 metadata and files for over 4,000 network applications from raw packets to enable behavioral anomaly detection and threat identification.

12 products

Build the platform that makes it easy for everyone to see what's coming – and act fast with confidence.

Trellix Helix

Next-generation SIEM with advanced search+11

Trellix Helix is a SaaS security operations platform that unifies SIEM, SOAR, and threat intelligence, integrating over 600 Trellix and third-party tools for multi-vector threat detection and response. It augments existing SIEMs with analytics, behavioral analysis, and workflow automation, enabling correlated investigations across endpoints, networks, and cloud environments. Best suited for enterprises seeking XDR capabilities without replacing legacy SIEMs, it leverages Trellix's global threat intelligence for contextual IOCs and TTP-based rules, streamlining alert triage and containment.

Trend Micro

Data Loss Prevention (DLP)

11 products

Trend Micro offers integrated Data Loss Prevention (DLP) functionality embedded within its broader endpoint security and email security platforms. The iDLP module provides lightweight agent-based monitoring across endpoints, email, USB devices, and web channels without requiring dedicated hardware. Trend Micro positions DLP as a cost-effective alternative to standalone enterprise solutions, leveraging pre-built regional and industry-specific policy templates. Best suited for organizations already invested in Trend Micro's endpoint protection or email security infrastructure seeking consolidated data protection without additional management overhead.

Monitor data movements on user devices+11

Trinity Cyber

Full content inspection+7

4 products

Trinity Cyber is a network security vendor centered on Full Content Inspection (FCI), which inspects full internet sessions in both directions and neutralizes malicious content in transit. In the NDR scope, its value is highest where teams need deep north-south traffic inspection, visibility into encrypted sessions, and inline response at the network edge. Trinity Cyber is best suited for mid-market and enterprise buyers that want active network threat prevention rather than alert-only detection. The company also offers managed services and adjacent controls, but its core differentiator is inline session-level traffic analysis and modification.

Vectra AI

Attack Signal Intelligence for NDR+11

7 products

Vectra AI is a dedicated **Network Detection & Response (NDR)** vendor that analyzes east-west and north-south traffic to detect attacker behavior across on-premises, cloud, identity, and IoT/OT environments. Its NDR offering is positioned around behavioral analytics, attack-path correlation, and high-fidelity alert reduction rather than signature-only detection. It is best suited for security teams that need continuous network visibility, encrypted-traffic-aware detection, and faster triage of in-progress attacks. Vectra AI also sells adjacent identity and cloud detection capabilities, but its NDR scope remains centered on network telemetry and response.

VIAVI Solutions