Network telemetry remains critical for agentic SOC detection and response

At a glance

What this is: This is an argument that NDR remains foundational because network telemetry exposes agentless assets, lateral movement, exfiltration, and response opportunities that EDR and other tools can miss.

Why it matters: It matters because IAM and SOC teams increasingly need network evidence to validate risky behaviour, enrich autonomous workflows, and govern agentic SOC decisions across human, workload, and device identity surfaces.

By the numbers:

• The average industrial enterprise still cannot identify 30% of the devices connected to its primary production network, according to McKinsey & Company research cited by Stellar Cyber.
• IDC's 2026 Worldwide Semiannual IoT Spending Guide projects that global spending on IoT/OT will cross the $1.1 trillion mark by the end of 2026.

Context

Network detection and response is a control layer that inspects network traffic patterns, protocol behaviour, and data movement rather than relying only on endpoint agents. In environments with routers, appliances, IoT, and OT devices, that matters because many assets cannot run an EDR agent and still generate risk at the wire level.

The article’s central claim is that this visibility remains relevant even as security operations shift toward autonomous and agentic workflows. Network telemetry becomes a governance input for decisions about detection confidence, lateral movement, exfiltration, and response automation, especially when autonomous systems must correlate alerts with what is actually happening on the network.

Key questions

Q: How should security teams use network telemetry in an agentic SOC?

A: Use it as a validation layer, not just a detection feed. Network telemetry can confirm whether an endpoint alert aligns with real communication patterns, reveal lateral movement that logs miss, and give autonomous workflows a stronger basis for containment. Without that layer, machine-driven response risks acting on incomplete evidence.

Q: Why do encrypted connections not eliminate network detection value?

A: Encryption hides payloads, but it does not remove flow, timing, destination, volume, and protocol evidence. Those behavioural signals are often enough to spot unusual transfers, tunnelling, or movement that differs from the normal baseline. NDR shifts inspection from contents to patterns, which is still operationally valuable.

Q: What breaks when an environment relies on endpoint tools alone?

A: Coverage breaks wherever assets cannot host agents or where attackers disable them. In those cases, routers, appliances, and OT devices may continue communicating while the main control plane loses visibility into movement, exfiltration, and protocol abuse. The result is a blind spot that adversaries can use for persistence and expansion.

Q: How should organisations decide between NDR and EDR coverage?

A: They should not treat them as substitutes. EDR is strongest at endpoint behaviour, while NDR is stronger where the asset is agentless, the traffic is the signal, or the attacker is moving laterally and hiding in network behaviour. Mature programmes use both so one control can validate the other.

Technical breakdown

Why encrypted traffic does not make network telemetry obsolete

Encrypted traffic hides content, not always structure and behaviour. NDR works by analysing metadata, flows, protocol use, volume anomalies, timing, and destination patterns, which can still reveal malicious movement even when payloads are unreadable. That is why encrypted traffic analysis remains useful when attackers blend into normal operations or tunnel activity through expected services. The key point is that visibility shifts from content inspection to behavioural inspection, not from signal to silence.

Practical implication: Treat encryption as a reason to change detection methods, not a reason to assume network visibility is gone.

How NDR surfaces lateral movement and exfiltration pathways

Lateral movement often appears as a sequence of abnormal internal connections, unusual protocol relationships, or traffic that does not fit the baseline for a host or segment. Exfiltration can look like sustained transfer volume, repeated small bursts, or DNS-abuse patterns that disguise payload fragments inside benign-looking requests. NDR is useful because it correlates these behaviours across time and across assets, which helps expose low-and-slow campaigns that single-point tools can miss. In practice, this makes the network a detection source for both post-compromise movement and outbound theft.

Practical implication: Use NDR baselines to detect movement patterns that would not trigger a host-centric alert.

Why agentic SOCs need network telemetry as a control input

Agentic SOC designs depend on higher-quality evidence, not just more automation. If an autonomous workflow is asked to decide whether an endpoint is compromised, network telemetry can confirm or dispute the alert by showing whether the host actually communicated with suspicious destinations, used unusual protocols, or moved laterally. That makes NDR a validation layer for AI-assisted operations, reducing the chance that agents act on incomplete or misleading logs. It also improves model training because the network reveals device classes, communication relationships, and traffic norms that logs alone may not capture. See the Shadow AI and AI Agent Discovery Guide.

Practical implication: Feed network telemetry into autonomous triage and response workflows before allowing machine-driven containment actions.

Threat narrative

Attacker objective: The attacker aims to move quietly across the environment, avoid endpoint-based detection, and extract data or enable broader compromise without being obvious on the wire.

1. Entry occurs through an asset that may not have an EDR agent, such as an OT controller, appliance, or IoT device, leaving the network as the primary visibility source.
2. Escalation and lateral movement show up as anomalous internal traffic, unusual protocol use, or low-and-slow behaviour that helps the attacker reach additional systems.
3. Impact occurs when the adversary exfiltrates data, hides activity inside encrypted or DNS-based channels, or uses network pathways to support ransomware or disruption.

NHI Mgmt Group analysis

NDR is not a legacy comfort control, it is a governance control for environments with blind spots. The article is right to reject the idea that EDR alone can cover routers, appliances, and OT devices. When an asset cannot host an agent, the network becomes the only shared evidence layer for identity, behaviour, and movement. That makes NDR part of control design, not just detection tooling, and it is especially relevant where shadow AI and AI agent discovery is not the only discovery problem. Practitioners should treat network telemetry as a mandatory governance input wherever coverage gaps exist.

Agentic SOC models are only as trustworthy as the telemetry they ingest. Autonomous workflows can validate alerts, enrich incidents, and trigger containment, but they inherit the weaknesses of the data sources beneath them. If network signals are absent, mis-baselined, or ignored, the agent will over-trust logs and under-detect lateral movement or exfiltration. That creates a false sense of automation maturity. Practitioners should require telemetry diversity before delegating response decisions to machine-driven workflows.

Encrypted traffic created a visibility myth, not a visibility collapse. The article’s strongest point is that encryption changes the inspection problem rather than removing it. Behavioural signals, destination patterns, and protocol anomalies still expose useful evidence even when payloads are unreadable. This is why NDR belongs in modern security architecture alongside endpoint and identity telemetry. Practitioners should build detection around observable behaviour, not assume payload access is the only path to insight.

Visibility gap: industrial and distributed environments now create a gap between what exists and what security can actually observe. The article’s IoT and OT examples show why that gap is becoming operationally material, not theoretical. Discovery, baselining, and response all degrade when connected devices are unknown or unmanaged. Practitioners should measure how much of the network estate is truly observable before they trust any AI-assisted SOC decision.

What this signals

Network telemetry is becoming the trust anchor for autonomous response. As SOCs delegate more triage and containment to agents, the quality of the network layer will determine whether those decisions are grounded or guesswork. Practitioners should expect network evidence to move from supporting data to decision-grade input for containment.

Agentless visibility will become a board-level resilience issue. Distributed OT, IoT, and appliance-heavy environments create blind spots that are no longer niche. Security leaders should treat coverage gaps as operational exposure because any automation stack built on partial observation will inherit partial trust.

For practitioners

• Define NDR as a required telemetry layer for blind-spot environments Make network telemetry mandatory for segments that include OT, IoT, appliances, and other agentless assets, rather than treating EDR as sufficient coverage.
• Baseline normal traffic by segment and protocol Create traffic baselines for internal movement, external destinations, and protocol use so low-and-slow lateral movement stands out against expected behaviour.
• Use network evidence to validate autonomous triage Require AI-assisted SOC workflows to cross-check endpoint alerts against actual traffic before they isolate hosts, alter firewall rules, or escalate incidents.
• Integrate discovery signals from network, cloud, and identity sources Correlate network telemetry with identity logs and cloud signals to reduce blind spots in environments where not every device or workload is directly manageable.

Key takeaways

• Network detection and response remains relevant because it sees classes of devices and attack behaviour that endpoint-centric tooling can miss.
• The article ties network telemetry to lateral movement, DNS-based exfiltration, and autonomous SOC validation, which makes visibility a control issue rather than a tooling preference.
• Practitioners should treat network data as a prerequisite for trustworthy agentic response in environments with OT, IoT, and other agentless assets.

Related NHI Mgmt Group resources: Shadow AI and AI Agent Discovery Guide · AI Agent Observability, Audit and Incident Response Guide · AI Agent Authorisation Guide · Agentic AI Identity Guide

Key terms

• Network Detection and Response (NDR): Network Detection and Response (NDR) is a security capability that analyses network traffic and metadata to detect suspicious activity and support investigation or response. It can expose lateral movement, command-and-control and data exfiltration that endpoint tools miss. Defenders should tune detections, preserve network telemetry and investigate anomalies quickly.
• Agentless Asset: An agentless asset is a device or system that cannot practically run an endpoint security agent, such as many routers, appliances, IoT devices, and OT controllers. These assets still generate network activity, so visibility and detection must come from network telemetry rather than host instrumentation.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Encrypted Traffic Analysis: Encrypted Traffic Analysis is the assessment of metadata from encrypted network flows to infer behaviour without decrypting payloads. Analysts use packet sizes, timing, endpoints and certificates to spot malware, tunnelling or policy violations. Defenders should combine it with DNS, proxy and endpoint telemetry, while recognising it does not expose decrypted content.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.