Why EDR and NDR Tools Are Not Zero Trust Security Solutions & What to Use Instead

May 1

Lock the doors inside your home, hand out keys sparingly, then turn on an alarm in every room. Your house will get a lot more secure. However, it will also become unlivable.

Tight security policies, access conditions, and subnetting configurations can take away risk but even mature Zero Trust Architecture (ZTA) environments must balance cybersecurity with usability. A core part of this network security balance involves deploying smart security solutions that detect and respond to threats without compromising user experience.

Implementing a Zero Trust strategy means using dynamic controls that adjust based on context, behaviour, and risk. It also means decrypting, inspecting, and re-encrypting traffic without introducing latency or compromising security.

What Zero Trust Security Solutions Need To Do

A ZTA environment breaks the traditional flat, perimeter-based network into a series of subnets (separated by firewalls), which, theoretically, do not have a perimeter with the outside web. Security relies on access control and least privilege access management.

This environment forces security solutions to:

Match context-based security criteria (i.e., where a user is located, what kind of device they use, the time of day, etc.) with identity and behaviour.
Function within the micro-segmented network environment that ZTA creates – an environment where visibility is severely compromised.

ZTA tools need to establish at a granular level which apps and users are connecting to a resource and whether their behaviour, along with the posture of their device, aligns with permissions or indicates a cyberattack. This means going beyond the traditional tool stacks of endpoint detection and response (EDR), network detection and response (NDR), user entity and behaviour analytics (UEBA), etc., and combining security events and analysis into a single data flow.

Specifically, a ZTA security solution needs to be able to:

Stop unauthorised lateral movement within a network.
Protect cloud workloads as well as physical servers from malware.
Consider contextual risk factors, such as device security posture, when authenticating application access.
Work with on-premises data centres and remote users and function across hybrid and multi-cloud environments.
Integrate with security information and event management (SIEM) and Identity and Access Management (IAM) solutions.
Provide granular insight into network and endpoint telemetry within a segmented network.
Link network traffic to user identity.
Scale with an organisation as it progresses on its Zero Trust journey.
Provide security teams and IT teams real-time context into user and device behaviour without bombarding them with false alerts.
Stay out of the way of end users by enabling secure access without compromising device performance.

Learn more: What Zero Trust Vendors Need to Tell You.

EDR & NDR Limitations In Zero Trust

A Zero Trust approach means taking the data flows that enable threat detection and response away from silos and into a combined format. Here’s what happens when you try to meet this challenge with traditional EDR and NDR solutions in a ZTA environment.

Endpoint Detection and Response (EDR)

EDR solutions focus on detecting, investigating, and responding to suspicious activities on endpoints or devices. They log endpoint activity and analyse it based on a “normal” activity baseline.

EDR limitations as a Zero Trust solution:

Limited to endpoint visibility.
Monitors endpoint activity rather than user behaviour.
Focuses on detecting threats on endpoints rather than assessing the security posture of devices.
Heavy management burden and false alerts.
Requires continuous configuration and optimisation.

In comparison, SenseOn hyper automates threat detection and response at endpoints by capturing real-time user, process, and network interaction.

Network Detection and Response (NDR)

NDR solutions monitor network traffic to detect and respond to anomalies. They provide visibility into east-west traffic (communication within the network). NDR solutions collect network telemetry data like packet captures and activity logs and then analyse them for indicators of compromise (usually with machine learning).

Micro-segmentation creates smaller network segments, making it difficult for NDR solutions to monitor east-west traffic properly.

As a result, an NDR solution might only see a fraction of the traffic within a ZTA environment and miss insider threat behaviour or smaller scope data breaches. They are also not linked to endpoint activity, resulting in siloed security data.

NDR limitations as a Zero Trust Solution:

Not designed to handle decentralised data or microsegment environments.
Can be blind to encrypted traffic without decryption capabilities.
Create a significant false alert burden.

SenseOn’s Universal Sensor overcomes these challenges by collecting and analysing telemetry data directly from all devices and applications, ensuring continuous visibility even in a network where Zero Trust principles and access policies have been applied.

SenseOn and Zero Trust

Cloud-native and available as a stand-alone security operations centre (SOC) tool or a managed service, SenseOn’s machine learning capabilities understand the context of user and device behaviour and automate routine threat investigation, making it a robust solution within a ZTA environment.

The result is that SenseOn overcomes the visibility limitations faced by traditional EDR and NDR solutions.

Used by organisations ranging from government agencies, service businesses and manufacturers to implement Zero Trust, SenseOn provides real-time insights into user, process, and network interactions within the context of your Zero Trust policies.

Laura Martisiute