BRIGHTCYTE vs. NDR
Last reviewed: · Reviewed by the BRIGHTCYTE technical team
Network Detection and Response (NDR) is a category of security tooling that monitors network traffic to identify anomalies, malicious flows, and signs of compromise. It analyzes packets and metadata across monitored segments, applies behavioral analytics, and helps teams spot lateral movement, command and control, and data movement across the network.
What NDR Does Well
NDR offers broad visibility into flows that endpoint tools may miss, including traffic between devices and to external destinations. It is effective at surfacing unusual volumes, rare protocols, and suspicious destinations across the environment.
Where Attribution Ends
NDR can see that traffic exists, but explaining where it truly comes from is harder. Traffic that originates below the operating system has no process, user, or file behind it, so the usual attribution logic breaks down. A covert channel can also mimic legitimate traffic or use timing patterns that blend in. See our covert communication page for detail.
Side by Side
| Aspect | NDR | BRIGHTCYTE |
|---|---|---|
| Primary vantage point | Network traffic on the wire | Communication behavior, assuming a source below the OS |
| Can see packets | Yes, across monitored segments | Focuses on behavior and hardware-level context |
| Attribution to a source | Limited when traffic bypasses the OS network stack | Designed to reason about sources hiding below the OS |
| Strength | Broad visibility into flows and anomalies | An additional signal where source attribution breaks down |
When to Combine Them
Use NDR for broad network visibility and add BRIGHTCYTE to help reason about sources that may hide below the operating system. The two layers address different questions: what is on the wire, and where it may truly originate.
What BRIGHTCYTE Can and Cannot Conclude
BRIGHTCYTE detects suspicious communication behavior and provides an additional signal that may indicate a compromise below the operating system. It does not replace NDR, does not by itself always identify the precise compromised component, and detection is not guaranteed.
Frequently Asked Questions
- Does BRIGHTCYTE replace NDR?
- No. BRIGHTCYTE is complementary to NDR. NDR observes traffic on the wire, while BRIGHTCYTE focuses on communication behavior and the possibility that a source is hiding below the operating system.
- If NDR sees the packets, why is attribution hard?
- NDR can observe flows, but attributing them to a specific source is difficult when traffic does not map cleanly to a known process or when it bypasses the operating system network stack. BRIGHTCYTE is designed to reason about that below-the-OS possibility.
- Can we run both together?
- Yes. NDR provides broad network visibility and BRIGHTCYTE adds a signal for suspicious communication that may originate below the OS. Neither guarantees complete coverage, and BRIGHTCYTE does not by itself always identify the precise compromised component.
Sources and Further Reading
MITRE ATT&CK
MITRE ATT&CK: Pre-OS Boot (T1542)Explains firmware-level techniques whose network activity may be hard to attribute to a source.
NIST · 2018
NIST SP 800-193: Platform Firmware Resiliency GuidelinesFrames firmware integrity as a layer distinct from network monitoring.
ENISA
ENISA Threat LandscapeDocuments evolving covert channel and supply chain threats relevant to network defenders.