A firewall makes one decision, once, at the edge. After that, everything an attacker does happens on traffic the firewall already approved: the check-in to a control server, the sweep of your file shares, the slow copy of a folder out the door. AllTech puts sensors inside the network, learns what normal looks like for each machine, and acts on the traffic that stops matching.
From the first anomalous packet to the connection being blocked, without waiting for a person to approve it.
AllTech network monitoring, June 1 – July 1, 2026.
Port 443 has to be open. Your staff need HTTPS, your line-of-business apps need HTTPS, your backup agent needs HTTPS. So does malware. Once something is running on a machine inside your network, its first job is to phone home. It does that over an encrypted outbound connection to a host that has no reputation problem yet, on the one port you cannot close.
Your firewall sees a permitted connection to a permitted port, and it's right about that. It's just answering a different question from the one that matters.
The question that matters is behavioral: has this machine ever talked to that destination before? Does it check in every 47 seconds like clockwork, the way a human never does? Did a workstation that has never touched the file server suddenly enumerate all of it? Is a server that normally sends 40 megabytes a day sending 40 gigabytes tonight?
Answering it takes a baseline for every device on the network and a system that watches for departures from it. That's what network detection and response does.
Physical and virtual sensors sit on your core switching and capture every conversation on the network, both machine to internet and machine to machine. Most tools never see east-west traffic, the machine-to-machine half, and that's where lateral movement happens.
Darktrace builds a pattern of life for every device and credential on the network: where it talks, how often, how much, and at what hours. Detection looks for departures from that baseline. It doesn't rely on a list of known-bad addresses, because new attacker infrastructure has no reputation to check.
Every alert is investigated automatically before a person sees it. The platform pulls related events together, builds a timeline, and reaches a verdict. Last month it ran 657 investigations and concluded that 620 were nothing, so your team never saw those.
When the platform is confident, it acts on its own. It blocks the specific connection or holds the device to its normal behavior without waiting for someone to answer a page. Last month the average time from first anomalous packet to action was 47 seconds.
Each month you get a plain-language report covering what was seen, what was investigated, what was acted on, and what turned out to be nothing. You don't need a portal login to read it.
Between June 1 and July 1, 2026, on one client network we monitor, the platform recorded roughly 908 million events. That's about 350 every second, all month, without a break. Here is what happened to them.
events observed
Every connection, DNS lookup, file transfer, and login. Nobody reads this layer directly. It's kept so the history is already there when something does happen.
alerts
Behavior that departed from the baseline enough to be worth a second look. One alert for every 4.1 million events.
incidents
Alerts that survived automated investigation and correlation. Related alerts are grouped into one incident instead of arriving as separate pings.
critical incidents
About one per week. These are the ones a person worked.
Sixteen of the twenty-three incidents, including three of the four critical ones, were command and control: a machine inside the network talking to something outside it in a way it never had before. The machine is already inside, so there's no edge left to catch it at.
The ten models that fired most often last month were not exotic. Ranked by volume:
| What fired | Alerts | Devices |
|---|---|---|
| Internal data transfer on a device that had never done it before | 19 | 19 |
| Agent beacon — long interval | 18 | 5 |
| Agent beacon — medium interval | 15 | 4 |
| Repeating connections over four days | 12 | 5 |
| Connection to a suspicious domain | 11 | 7 |
| New admin credentials used on a workstation | 10 | 9 |
| Server making a rare external connection | 10 | 4 |
| Algorithmically generated domain beacon | 9 | 1 |
| Agent beacon — short interval | 6 | 1 |
| New admin credentials used on a server | 5 | 5 |
Sixty of those alerts, more than half the top ten, describe the same behavior at different speeds: something on the network establishing and maintaining a connection to a host outside it on a schedule. Some of that is legitimate software doing exactly what it was designed to do. Remote management agents beacon. Backup clients beacon. Telemetry beacons.
So the beacon alone doesn't tell you it's malicious. The baseline does: which machine, to where, since when, and whether it matches what that machine has always done. A tool that only knows “beaconing is suspicious” generates 60 tickets. A tool that knows what every device on that network normally does generates 23 incidents, and four of them matter.
Detection is the easy half. Last month the platform took 8 autonomous actions across 5 devices:
3 actions
2 actions
1 action
1 action
1 action
Zero needed a person to approve them first, so nobody had to be awake.
That's the time from the platform first observing the behavior to acting on it. The industry benchmark for a fast human SOC is measured in minutes. For most small businesses, where the “SOC” is whoever checks email in the morning, the realistic number is measured in hours.
When an operator reviews an action and concludes the behavior was benign, they clear it and the block comes off. That happened zero times in thirty days. All eight actions held up on review.
Every action was surgical. It blocked the specific connection or held the specific device to its own normal behavior. Nothing was quarantined off the network wholesale, and nobody lost a working day to a false positive.
Alongside the 220 security alerts, the platform raised 182 policy and compliance alerts. These aren't attacks, but a business would want to know they're happening on its network. None of them triggered a response action or became an incident. This kind of thing never surfaces until someone is looking.
| What it found | Alerts | Devices |
|---|---|---|
| Remote management tool running on a server | 143 | 49 |
| DNS over HTTPS / TLS | 11 | 4 |
| Beaconing to a rare generative AI service | 11 | 2 |
| Connection to a tunnelling service | 8 | 3 |
| Anomalous upload to a generative AI service | 3 | 3 |
| Cleartext LDAP authentication | 2 | 1 |
| Unencrypted credential sent over HTTP | 2 | 2 |
| SSH to a rare external destination | 1 | 1 |
| Default credential in use | 1 | 1 |
Most of it is ours: the tools we use to administer the environment, doing what they're supposed to. What's useful is having the complete list. Unauthorized remote management software is one of the most common ways an attacker keeps a foothold after the initial break-in, and it goes unnoticed because it looks like IT doing its job. You can't spot the one that doesn't belong until you know all the ones that do.
DNS filtering works by seeing your DNS queries. Encrypted DNS routes them around it. Four devices were doing that. It's usually a browser default, not anything deliberate, but it's always worth correcting because it silently disables a control you're paying for.
Devices beaconing to and uploading data to AI services the network had rarely or never seen before. We have no opinion about whether your staff should use AI tools. We do think you should know which tools, from which machines, and how much is going up.
Four alerts covering LDAP authentication and a credential sent over plain HTTP. The numbers are small, but this is the sort of thing that turns a single compromised workstation into a domain-wide problem.
None of these were attacks. Each one is still a decision someone should get to make on purpose instead of by default.
The platform classifies each thing it finds by which phase of an attack it would correspond to. Last month, out of 37 events:
19 · 51%
14 · 38%
2 · 5%
2 · 5%
0 · —
0 · —
The platform classified zero events as initial infection. That doesn't mean none occurred. Network monitoring can't see that moment at all. The click on the link happens in a browser. The macro runs in Word. The credential gets typed into a convincing fake login page. None of that generates a network event that looks any different from the ten thousand ordinary ones around it.
Network detection picks the story up at step two, when whatever got in starts reaching out. That matters, because most attacks stay quiet for days or weeks between the foothold and the damage, and that gap is where they get caught. It's still one layer of several. Email filtering addresses the click. Endpoint detection addresses the macro. If a vendor tells you their network product covers the whole chain, they are describing a product that does not exist.
Figures from AllTech network monitoring, June 1 – July 1, 2026. All figures are network-derived.
It's a strong fit if you have
It's a strong fit if you have
It's a strong fit if you have
It's a strong fit if you have
It's a strong fit if you have
It's a weaker fit if
It's a weaker fit if
We look at your switching, your subnets, and where traffic actually flows. Most networks have at least one segment nobody has looked at in years.
We put physical or virtual sensors on your core switching, fed by SPAN or TAP. They're passive. Nothing is inline, so nothing goes down if a sensor does.
Roughly two weeks of watching before detection tightens. The system has to know what your Tuesday looks like before it can tell you this Tuesday is wrong.
We decide together what the platform is allowed to do on its own and what waits for a human. We recommend letting it act on its own for everything it’s confident about. The 47 seconds above is only possible because nothing waits for approval.
Alerts are investigated, incidents are escalated to you with context, and you get a monthly report.
No. A firewall enforces a policy at a boundary. NDR observes behavior everywhere, including traffic that never crosses a boundary. Machine-to-machine traffic inside your own network doesn’t touch the firewall at all, and that’s where lateral movement happens.
They overlap by design and fail in different places. Endpoint agents can be disabled, and plenty of things on your network can’t run one — printers, cameras, PLCs, badge readers, the machine on the production floor running an operating system nobody supports anymore. The network sees those. The endpoint agent never will.
Mostly not, and it doesn’t need to. Who is talking to whom, how often, in what volume, at what hour, on what schedule — all of that is visible without decrypting anything, and it’s what the detections are built on. A beacon is recognizable by its rhythm.
No. Sensors receive a copy of traffic from a mirror port. They aren’t in the path. If a sensor fails, you lose visibility, not connectivity.
It can, and the honest answer is that the number last month was zero cleared actions out of eight — but zero is a month, not a guarantee. Actions are targeted at the specific connection rather than the whole device, and any of them can be cleared in seconds.
Usually one appliance and one or two virtual sensors, sized to your traffic. We’ll tell you which during the assessment.
That’s one of the better reasons to have it. Passive monitoring is often the only form of security tooling that industrial equipment tolerates.
The network sees the beacon. The endpoint sees what started it.
Zero initial infections showed up on the network last month because that phase happens in the inbox.
Detection is only worth what the response is worth. 657 investigations last month, 620 closed without escalation.
Detection shortens the bad day. Tested backups are what make it survivable.
We'll map your network, place sensors, and show you what two weeks of your own traffic contains: every device, destination, and schedule. Most businesses find at least one machine reaching somewhere nobody authorized. You get plain findings and no pressure.
Trusted by dozens of businesses
AllTech