AllTech
Your firewall knows what it let through.
It has no idea what happened next.
A firewall makes one decision, once, at the edge. Everything an attacker does afterward — the check-in to a control server, the sweep of your file shares, the slow copy of a folder out the door — happens on traffic the firewall already approved. AllTech puts sensors inside the network, learns what normal looks like for each machine, and acts on the traffic that stops matching.
From the first anomalous packet to the connection being blocked — with no one waiting on a human to approve it.
AllTech network monitoring, June 1 – July 1, 2026.
Attackers don't break through the firewall. They use the connection you already allow.
Port 443 has to be open. Your staff need HTTPS, your line-of-business apps need HTTPS, your backup agent needs HTTPS. So does malware. Once something is running on a machine inside your network, its first job is to phone home — and it does that over an encrypted outbound connection to a host that has no reputation problem yet, on the one port you cannot close.
Your firewall sees a permitted connection to a permitted port. It is not wrong. It is answering a different question than the one that matters.
The question that matters is behavioral: has this machine ever talked to that destination before? Does it check in every 47 seconds like clockwork, the way a human never does? Did a workstation that has never touched the file server suddenly enumerate all of it? Is a server that normally sends 40 megabytes a day sending 40 gigabytes tonight?
Answering that requires a baseline of every device on the network and a system watching for departures from it. That is what network detection and response is.
Sensors inside the network, not just at the edge
Full traffic visibility
Physical and virtual sensors sit on your core switching, capturing every conversation on the network — machine to internet, and machine to machine. East-west traffic is the half most tools never see, and it is where lateral movement lives.
Behavioral baselining
Darktrace builds a pattern of life for every device and credential on the network — where it talks, how often, how much, at what hours. Detection is based on departure from that baseline, not on a list of known-bad addresses. New attacker infrastructure has no reputation to check.
Automated investigation
Every alert gets investigated automatically before a human ever sees it: related events pulled together, timeline assembled, verdict rendered. Last month that process ran 657 times and concluded 620 of them were nothing. Your team never saw those.
Autonomous response
When the platform is confident, it acts — blocking the specific connection or holding the device to its normal behavior, without waiting for someone to answer a page. Last month the average time from first anomalous packet to action was 47 seconds.
Monthly reporting
A plain-language report every month: what was seen, what was investigated, what was acted on, what turned out to be nothing. No portal login required.
What a month of network monitoring actually looks like
Between June 1 and July 1, 2026, on one client network we monitor, the platform recorded roughly 908 million events — about 350 every second, all month, without a break. Here is what happened to them.
Every connection, every DNS lookup, every file transfer, every login. Nobody looks at this layer. It exists so that when something does happen, the history is already there.
Behavior that departed from the baseline enough to be worth a second look. One alert for every 4.1 million events.
Alerts that survived automated investigation and correlation — grouped into coherent stories rather than delivered as disconnected pings.
About one per week. These are the ones a person worked.
Sixteen of the twenty-three incidents — and three of the four critical ones — were command and control: a machine inside the network talking to something outside it in a way it never had before. That is not an edge problem. There is no edge left to catch it at.
Half of what we caught was something already inside, checking in
The ten models that fired most often last month were not exotic. Ranked by volume:
| What fired | Alerts | Devices |
|---|---|---|
| Internal data transfer on a device that had never done it before | 19 | 19 |
| Agent beacon — long interval | 18 | 5 |
| Agent beacon — medium interval | 15 | 4 |
| Repeating connections over four days | 12 | 5 |
| Connection to a suspicious domain | 11 | 7 |
| New admin credentials used on a workstation | 10 | 9 |
| Server making a rare external connection | 10 | 4 |
| Algorithmically generated domain beacon | 9 | 1 |
| Agent beacon — short interval | 6 | 1 |
| New admin credentials used on a server | 5 | 5 |
Sixty of those alerts — more than half the top ten — describe the same behavior at different speeds: something on the network establishing and maintaining a connection to a host outside it on a schedule. Some of that is legitimate software doing exactly what it was designed to do. Remote management agents beacon. Backup clients beacon. Telemetry beacons.
That is precisely the point. The beacon is not what tells you it is malicious. The baseline is: which machine, to where, since when, and does it match what that machine has always done. A tool that only knows “beaconing is suspicious” generates 60 tickets. A tool that knows what every device on that network normally does generates 23 incidents, and four of them matter.
Eight actions, five devices, no phone calls
Detection is the easy half. Last month the platform took 8 autonomous actions across 5 devices:
All eight were autonomous
Zero required a human to approve them first. Nobody had to be awake.
The average delay was 47 seconds
From the platform first observing the behavior to acting on it. The industry's own benchmark for a fast human SOC is measured in minutes, and the realistic number for most small businesses — where the “SOC” is whoever checks email in the morning — is measured in hours.
Zero were cleared
When an operator reviews an action and concludes the behavior was actually benign, they clear it and the block comes off. That happened zero times in thirty days. Eight actions, eight of them justified on review.
Every action was surgical — the specific connection or the specific device held to its own normal behavior. Nothing was quarantined off the network wholesale, and nobody lost a working day to a false positive.
Nothing was attacking. Here's what we learned anyway.
Alongside the 220 security alerts, the platform raised 182 policy and compliance alerts — things that aren't attacks but that a business would want to know are happening on its network. None of them triggered a response action. None became an incident. All of them are the kind of thing that never surfaces until someone is looking.
| What it found | Alerts | Devices |
|---|---|---|
| Remote management tool running on a server | 143 | 49 |
| DNS over HTTPS / TLS | 11 | 4 |
| Beaconing to a rare generative AI service | 11 | 2 |
| Connection to a tunnelling service | 8 | 3 |
| Anomalous upload to a generative AI service | 3 | 3 |
| Cleartext LDAP authentication | 2 | 1 |
| Unencrypted credential sent over HTTP | 2 | 2 |
| SSH to a rare external destination | 1 | 1 |
| Default credential in use | 1 | 1 |
Remote management software on 49 devices
Most of it is ours — the tools we use to administer the environment, doing exactly what they're supposed to. That's the point. The value isn't in flagging remote access; it's in having the complete list. Unauthorized remote management software is one of the most common ways an attacker keeps a foothold after the initial break-in, and it is invisible precisely because it looks like IT doing its job. You cannot notice the one that doesn't belong until you know all the ones that do.
DNS over HTTPS on four devices
DNS filtering works by seeing your DNS queries. Encrypted DNS routes them around it. Four devices were doing that — usually a browser default rather than anything deliberate, and always worth correcting, because it silently disables a control you're paying for.
Fourteen alerts about generative AI
Devices beaconing to and uploading data to AI services the network had rarely or never seen before. We have no opinion about whether your staff should use AI tools. We do think you should know which tools, from which machines, and how much is going up.
Credentials in the clear
Four alerts covering LDAP authentication and a credential sent over plain HTTP. Small numbers, unglamorous, and the sort of thing that turns a single compromised workstation into a domain-wide problem.
Not one of these was an attack. Every one of them is a decision someone should get to make deliberately rather than by default.
The network never sees the first move
The platform classifies each thing it finds by which phase of an attack it would correspond to. Last month, out of 37 events:
Zero initial infections. Not because none occurred — because network monitoring is structurally incapable of seeing that moment. The click on the link happens in a browser. The macro runs in Word. The credential gets typed into a convincing fake login page. None of that generates a network event that looks any different from the ten thousand ordinary ones around it.
Network detection picks the story up at step two, when whatever got in starts reaching out. That is genuinely valuable — most attacks are quiet for days or weeks between the foothold and the damage, and that gap is where they get caught. But it is a layer, not a solution. Email filtering is what addresses the click. Endpoint detection is what addresses the macro. If a vendor tells you their network product covers the whole chain, they are describing a product that does not exist.
Figures from AllTech network monitoring, June 1 – July 1, 2026. All figures are network-derived.
Where NDR earns its cost, and where it doesn't
It's a strong fit if you have
It's a weaker fit if
From install to baseline
Assessment
We look at your switching, your subnets, and where traffic actually flows. Most networks have at least one segment nobody has looked at in years.
Sensor placement
Physical or virtual sensors on your core switching, fed by SPAN or TAP. Passive — nothing is inline, nothing goes down if a sensor does.
Learning period
Roughly two weeks of watching before detection tightens. The system has to know what your Tuesday looks like before it can tell you this Tuesday is wrong.
Response tuning
We decide together what the platform is allowed to do on its own and what waits for a human. Our recommendation is autonomous for everything it’s confident about — the 47 seconds above only exists because nothing waits for approval.
Ongoing
Alerts are investigated, incidents are escalated to you with context, and you get a monthly report.
Common questions
Is this the same thing as a firewall?
No. A firewall enforces a policy at a boundary. NDR observes behavior everywhere, including traffic that never crosses a boundary. Machine-to-machine traffic inside your own network doesn’t touch the firewall at all, and that’s where lateral movement happens.
We already have endpoint protection. Isn’t this redundant?
They overlap by design and fail in different places. Endpoint agents can be disabled, and plenty of things on your network can’t run one — printers, cameras, PLCs, badge readers, the machine on the production floor running an operating system nobody supports anymore. The network sees those. The endpoint agent never will.
Can it see inside encrypted traffic?
Mostly not, and it doesn’t need to. Who is talking to whom, how often, in what volume, at what hour, on what schedule — all of that is visible without decrypting anything, and it’s what the detections are built on. A beacon is recognizable by its rhythm.
Will it slow down our network?
No. Sensors receive a copy of traffic from a mirror port. They aren’t in the path. If a sensor fails, you lose visibility, not connectivity.
What if it blocks something legitimate?
It can, and the honest answer is that the number last month was zero cleared actions out of eight — but zero is a month, not a guarantee. Actions are targeted at the specific connection rather than the whole device, and any of them can be cleared in seconds.
Do we need to buy hardware?
Usually one appliance and one or two virtual sensors, sized to your traffic. We’ll tell you which during the assessment.
Will it work with our OT or manufacturing equipment?
That’s one of the better reasons to have it. Passive monitoring is often the only form of security tooling that industrial equipment tolerates.
Network detection works best in layers
Endpoint Security & Managed EDR
The network sees the beacon. The endpoint sees what started it.
Learn moreEmail Security & Phishing Protection
Zero initial infections showed up on the network last month because that phase happens in the inbox.
Learn moreManaged SOC
Detection is only worth what the response is worth. 657 investigations last month, 620 closed without escalation.
Learn moreBackup & Disaster Recovery
Detection shortens the bad day. Tested backups are what make it survivable.
Learn moreFind out what's already talking on your network.
We'll map your network, place sensors, and show you what two weeks of your own traffic actually contains — every device, every destination, every schedule. Most businesses find at least one machine reaching somewhere nobody authorized. Plain findings, no pressure.
