A firewall makes one decision, once, at the edge. Everything an attacker does afterward — the check-in to a control server, the sweep of your file shares, the slow copy of a folder out the door — happens on traffic the firewall already approved. AllTech puts sensors inside the network, learns what normal looks like for each machine, and acts on the traffic that stops matching.
From the first anomalous packet to the connection being blocked — with no one waiting on a human to approve it.
AllTech network monitoring, June 1 – July 1, 2026.
Port 443 has to be open. Your staff need HTTPS, your line-of-business apps need HTTPS, your backup agent needs HTTPS. So does malware. Once something is running on a machine inside your network, its first job is to phone home — and it does that over an encrypted outbound connection to a host that has no reputation problem yet, on the one port you cannot close.
Your firewall sees a permitted connection to a permitted port. It is not wrong. It is answering a different question than the one that matters.
The question that matters is behavioral: has this machine ever talked to that destination before? Does it check in every 47 seconds like clockwork, the way a human never does? Did a workstation that has never touched the file server suddenly enumerate all of it? Is a server that normally sends 40 megabytes a day sending 40 gigabytes tonight?
Answering that requires a baseline of every device on the network and a system watching for departures from it. That is what network detection and response is.
Physical and virtual sensors sit on your core switching, capturing every conversation on the network — machine to internet, and machine to machine. East-west traffic is the half most tools never see, and it is where lateral movement lives.
Darktrace builds a pattern of life for every device and credential on the network — where it talks, how often, how much, at what hours. Detection is based on departure from that baseline, not on a list of known-bad addresses. New attacker infrastructure has no reputation to check.
Every alert gets investigated automatically before a human ever sees it: related events pulled together, timeline assembled, verdict rendered. Last month that process ran 657 times and concluded 620 of them were nothing. Your team never saw those.
When the platform is confident, it acts — blocking the specific connection or holding the device to its normal behavior, without waiting for someone to answer a page. Last month the average time from first anomalous packet to action was 47 seconds.
A plain-language report every month: what was seen, what was investigated, what was acted on, what turned out to be nothing. No portal login required.
Between June 1 and July 1, 2026, on one client network we monitor, the platform recorded roughly 908 million events — about 350 every second, all month, without a break. Here is what happened to them.
events observed
Every connection, every DNS lookup, every file transfer, every login. Nobody looks at this layer. It exists so that when something does happen, the history is already there.
alerts
Behavior that departed from the baseline enough to be worth a second look. One alert for every 4.1 million events.
incidents
Alerts that survived automated investigation and correlation — grouped into coherent stories rather than delivered as disconnected pings.
critical incidents
About one per week. These are the ones a person worked.
Sixteen of the twenty-three incidents — and three of the four critical ones — were command and control: a machine inside the network talking to something outside it in a way it never had before. That is not an edge problem. There is no edge left to catch it at.
The ten models that fired most often last month were not exotic. Ranked by volume:
| What fired | Alerts | Devices |
|---|---|---|
| Internal data transfer on a device that had never done it before | 19 | 19 |
| Agent beacon — long interval | 18 | 5 |
| Agent beacon — medium interval | 15 | 4 |
| Repeating connections over four days | 12 | 5 |
| Connection to a suspicious domain | 11 | 7 |
| New admin credentials used on a workstation | 10 | 9 |
| Server making a rare external connection | 10 | 4 |
| Algorithmically generated domain beacon | 9 | 1 |
| Agent beacon — short interval | 6 | 1 |
| New admin credentials used on a server | 5 | 5 |
Sixty of those alerts — more than half the top ten — describe the same behavior at different speeds: something on the network establishing and maintaining a connection to a host outside it on a schedule. Some of that is legitimate software doing exactly what it was designed to do. Remote management agents beacon. Backup clients beacon. Telemetry beacons.
That is precisely the point. The beacon is not what tells you it is malicious. The baseline is: which machine, to where, since when, and does it match what that machine has always done. A tool that only knows “beaconing is suspicious” generates 60 tickets. A tool that knows what every device on that network normally does generates 23 incidents, and four of them matter.
Detection is the easy half. Last month the platform took 8 autonomous actions across 5 devices:
3 actions
2 actions
1 action
1 action
1 action
Zero required a human to approve them first. Nobody had to be awake.
From the platform first observing the behavior to acting on it. The industry's own benchmark for a fast human SOC is measured in minutes, and the realistic number for most small businesses — where the “SOC” is whoever checks email in the morning — is measured in hours.
When an operator reviews an action and concludes the behavior was actually benign, they clear it and the block comes off. That happened zero times in thirty days. Eight actions, eight of them justified on review.
Every action was surgical — the specific connection or the specific device held to its own normal behavior. Nothing was quarantined off the network wholesale, and nobody lost a working day to a false positive.
Alongside the 220 security alerts, the platform raised 182 policy and compliance alerts — things that aren't attacks but that a business would want to know are happening on its network. None of them triggered a response action. None became an incident. All of them are the kind of thing that never surfaces until someone is looking.
| What it found | Alerts | Devices |
|---|---|---|
| Remote management tool running on a server | 143 | 49 |
| DNS over HTTPS / TLS | 11 | 4 |
| Beaconing to a rare generative AI service | 11 | 2 |
| Connection to a tunnelling service | 8 | 3 |
| Anomalous upload to a generative AI service | 3 | 3 |
| Cleartext LDAP authentication | 2 | 1 |
| Unencrypted credential sent over HTTP | 2 | 2 |
| SSH to a rare external destination | 1 | 1 |
| Default credential in use | 1 | 1 |
Most of it is ours — the tools we use to administer the environment, doing exactly what they're supposed to. That's the point. The value isn't in flagging remote access; it's in having the complete list. Unauthorized remote management software is one of the most common ways an attacker keeps a foothold after the initial break-in, and it is invisible precisely because it looks like IT doing its job. You cannot notice the one that doesn't belong until you know all the ones that do.
DNS filtering works by seeing your DNS queries. Encrypted DNS routes them around it. Four devices were doing that — usually a browser default rather than anything deliberate, and always worth correcting, because it silently disables a control you're paying for.
Devices beaconing to and uploading data to AI services the network had rarely or never seen before. We have no opinion about whether your staff should use AI tools. We do think you should know which tools, from which machines, and how much is going up.
Four alerts covering LDAP authentication and a credential sent over plain HTTP. Small numbers, unglamorous, and the sort of thing that turns a single compromised workstation into a domain-wide problem.
Not one of these was an attack. Every one of them is a decision someone should get to make deliberately rather than by default.
The platform classifies each thing it finds by which phase of an attack it would correspond to. Last month, out of 37 events:
19 · 51%
14 · 38%
2 · 5%
2 · 5%
0 · —
0 · —
Zero initial infections. Not because none occurred — because network monitoring is structurally incapable of seeing that moment. The click on the link happens in a browser. The macro runs in Word. The credential gets typed into a convincing fake login page. None of that generates a network event that looks any different from the ten thousand ordinary ones around it.
Network detection picks the story up at step two, when whatever got in starts reaching out. That is genuinely valuable — most attacks are quiet for days or weeks between the foothold and the damage, and that gap is where they get caught. But it is a layer, not a solution. Email filtering is what addresses the click. Endpoint detection is what addresses the macro. If a vendor tells you their network product covers the whole chain, they are describing a product that does not exist.
Figures from AllTech network monitoring, June 1 – July 1, 2026. All figures are network-derived.
It's a strong fit if you have
It's a strong fit if you have
It's a strong fit if you have
It's a strong fit if you have
It's a strong fit if you have
It's a weaker fit if
It's a weaker fit if
We look at your switching, your subnets, and where traffic actually flows. Most networks have at least one segment nobody has looked at in years.
Physical or virtual sensors on your core switching, fed by SPAN or TAP. Passive — nothing is inline, nothing goes down if a sensor does.
Roughly two weeks of watching before detection tightens. The system has to know what your Tuesday looks like before it can tell you this Tuesday is wrong.
We decide together what the platform is allowed to do on its own and what waits for a human. Our recommendation is autonomous for everything it’s confident about — the 47 seconds above only exists because nothing waits for approval.
Alerts are investigated, incidents are escalated to you with context, and you get a monthly report.
No. A firewall enforces a policy at a boundary. NDR observes behavior everywhere, including traffic that never crosses a boundary. Machine-to-machine traffic inside your own network doesn’t touch the firewall at all, and that’s where lateral movement happens.
They overlap by design and fail in different places. Endpoint agents can be disabled, and plenty of things on your network can’t run one — printers, cameras, PLCs, badge readers, the machine on the production floor running an operating system nobody supports anymore. The network sees those. The endpoint agent never will.
Mostly not, and it doesn’t need to. Who is talking to whom, how often, in what volume, at what hour, on what schedule — all of that is visible without decrypting anything, and it’s what the detections are built on. A beacon is recognizable by its rhythm.
No. Sensors receive a copy of traffic from a mirror port. They aren’t in the path. If a sensor fails, you lose visibility, not connectivity.
It can, and the honest answer is that the number last month was zero cleared actions out of eight — but zero is a month, not a guarantee. Actions are targeted at the specific connection rather than the whole device, and any of them can be cleared in seconds.
Usually one appliance and one or two virtual sensors, sized to your traffic. We’ll tell you which during the assessment.
That’s one of the better reasons to have it. Passive monitoring is often the only form of security tooling that industrial equipment tolerates.
The network sees the beacon. The endpoint sees what started it.
Zero initial infections showed up on the network last month because that phase happens in the inbox.
Detection is only worth what the response is worth. 657 investigations last month, 620 closed without escalation.
Detection shortens the bad day. Tested backups are what make it survivable.
We'll map your network, place sensors, and show you what two weeks of your own traffic actually contains — every device, every destination, every schedule. Most businesses find at least one machine reaching somewhere nobody authorized. Plain findings, no pressure.
Trusted by dozens of businesses
AllTech