How to Evaluate Network Detection and Response for 400G and 800G Data Centres

From High-Speed Traffic to Useful Network Intelligence

Processing traffic at 400G is only useful if the platform can turn that traffic into intelligence that security teams can actually work with. IntSOC enriches network activity with additional context, helping analysts understand not just that communication has taken place, but more about the systems, applications and infrastructure involved.

The IntSOC 400 Network Overview brings that intelligence together in a single view, providing visibility across applications, network protocols, hosts, geographic activity and Autonomous Systems. This gives analysts a broader picture of what is happening across the network and provides context that can then support behavioural detection and investigation.

IntSOC 400 Network Overview showing application, protocol, host, geographic and Autonomous System activity.

Application Visibility:  See which applications are driving traffic across the network.

Host Activity: Identify the hosts generating the highest levels of network activity.

Network Infrastructure Context: Understand which Autonomous Systems and external networks are associated with observed traffic.

From this broader network view, analysts can drill into the relationships behind the activity they are seeing. The IntSOC Graph Visualiser maps connections between network entities, helping analysts explore who is communicating with whom, identify relationships around suspicious activity and build context around an investigation.

That context goes beyond IP addresses and traffic volumes. IntSOC can enrich network activity using encrypted-traffic fingerprinting, SSH fingerprinting, first-packet payload hashing, behavioural traffic analysis and IP-to-Autonomous System correlation. Together, these techniques provide additional characteristics and context that can be used by analysts and detection models to distinguish expected network behaviour from activity that warrants further investigation.

IntSOC can add further intelligence through techniques including encrypted-traffic fingerprinting, SSH fingerprinting, first-packet payload hashing, behavioural traffic analysis and IP-to-Autonomous System correlation.

Detecting Behaviour as Well as Known Threats

Known indicators of compromise, signatures and threat intelligence remain valuable, but they cannot provide the complete picture. Attackers can use legitimate credentials, trusted applications and encrypted communications, while new threats may not have an established signature when suspicious activity first appears. Behavioural detection provides another perspective by examining how systems communicate and identifying activity that differs from expected patterns.

IntSOC includes pre-loaded machine-learning capabilities for Anomaly Detection, Beaconing Detection, Long Flow Detection, Outlier Detection, DGA Detection, Typosquatting Detection, Capacity Planning, Network Health, Predictive Traffic Analysis and Microburst Detection.

You can find the full platform specifications and AI/ML capabilities in the IntSOC 400 datasheet.

IntSOC 400 datasheet

What Happens After Something Is Detected?

Detection is only useful if an analyst can understand what sits behind it. When evaluating an NDR platform, it is worth looking beyond the initial dashboard and following a detection through the investigation process. An analyst should be able to understand which systems were involved, what changed, whether related activity exists elsewhere and what evidence caused the activity to be flagged.

Our AI-Powered Network Observability and NDR for Data Centres use case gives a practical example of how this investigation can work. A previously compromised application server begins communicating with database and management systems it has never previously accessed. IntSOC establishes the server’s normal communication community, identifies the change in behaviour and correlates the new connections with unusual traffic volumes, long-lived sessions and suspicious external communication. Instead of presenting a collection of isolated alerts, the result is a contextualised security event for the SOC and data-centre teams to investigate.

For MSSPs and SOC providers, the same approach can also turn an investigation into reusable detection knowledge. Our AI-Powered NDR for MSSP and SOC Providers use case shows an endpoint alert followed by IntSOC identifying communication with previously unseen internal systems alongside periodic outbound connections. The provider can investigate that behaviour, develop a detection model from what it has learned, deploy the model within IntSOC and use it as a reusable detection for similar behaviour in future.

Built From the Network Up

At 400G and 800G, NDR is not purely a software problem. Before machine learning, behavioural analytics or AI-assisted investigation can add value, network traffic first has to be observed, processed and transformed into useful information at extremely high speed. The engineering underneath the platform is therefore part of the security architecture.

For Telesoft, that chain runs from high-speed network processing into enriched network intelligence, behavioural and machine-learning detection and then AI-assisted investigation. Because Telesoft’s research, development, engineering and manufacturing are carried out in-house, the organisation has direct involvement across more of that technology stack rather than treating the network layer and the AI layer as unrelated components.

The 400G architecture provides a practical example of the relationship: FPGA-based wire-speed processing feeds enriched, unsampled network intelligence; fingerprinting and topology context add further detail; machine-learning models identify behaviours that warrant attention; and the resulting evidence can then support investigation and AI-assisted workflows.

Where Does AI Fit Into NDR?

Agentic AI extends the role of AI beyond analysing an individual event. Within IntSOC, AI agents can continuously evaluate, prioritise and investigate alerts, consolidate evidence, gather threat intelligence, support hypothesis-based threat hunting and execute expert playbooks.

The important point is that Agentic AI does not begin with the agent. It begins with the network intelligence the agent receives. The quality of the investigation depends on the visibility, context and behavioural intelligence available underneath it. If that underlying intelligence is incomplete or lacks context, there is a limit to what an autonomous investigation can reliably determine.

IntSOC is designed to selectively escalate high-confidence, actionable threats that require human intervention. For CISOs, that makes the boundary between autonomous investigation and human decision-making an important part of the evaluation. The question is not simply what an AI agent can do, but what it is permitted to do autonomously, when an analyst is brought into the process, and what evidence is available to support that decision.

This is particularly important when evaluating Agentic AI as part of an NDR platform. Autonomous investigation should not be considered separately from the network visibility, enrichment, behavioural detection and evidence that feed it. The agent sits at the top of that intelligence chain, not at the beginning of it.

Find out more about how Agentic AI works in NDR and threat investigation.

Your Network. Your AI. Your Rules.

Different security problems may benefit from different analytical approaches. Organisations may also have their own models, privacy requirements, data sovereignty considerations or policies governing where sensitive network information can be processed. Model flexibility therefore becomes part of the NDR evaluation.

IntSOC provides a developer kit with building blocks for deploying custom AI/ML models using PyTorch, TensorFlow and Scikit-Learn alongside Telesoft’s pre-loaded capabilities. This gives organisations the flexibility to deploy their own models rather than being restricted to a closed model set.

The use cases vary by environment. Critical infrastructure operators can deploy models developed around their own OT threat requirements; government and defence environments may have requirements around classified models and data residency; and enterprises may need to meet their own data-sovereignty and compliance policies. IntSOC can also support an on-appliance data lake, allowing network data to be processed locally without requiring backhaul to external services in the configuration described, alongside multi-tenant separation of customer data, alerts and dashboards.

For MSSPs, this model flexibility can form part of a repeatable workflow: observe behaviour during an incident, investigate it, develop a detection model from what has been learned, deploy that model in IntSOC and turn the incident into reusable detection capability.

What Does Agentic AI Add to NDR?

Agentic AI extends the role of AI beyond analysing individual events. Within IntSOC, AI agents can continuously evaluate, prioritise and investigate alerts, helping to reduce noise and selectively escalate high-confidence, actionable threats that require human attention. Agentic capabilities can support autonomous incident triage, alert consolidation and evidence correlation, threat-intelligence gathering, hypothesis-based threat hunting and the execution of expert playbooks.

But the effectiveness of Agentic AI depends on the intelligence available to it. An agent working with incomplete network information has less context for investigation, correlation and decision-making. This is why Agentic AI does not begin with the agent. It begins with the network intelligence the agent receives.

For CISOs, that makes control and evidence just as important as automation. When evaluating Agentic AI within an NDR platform, the questions should include what network intelligence the agent can access, what it can investigate autonomously, when an analyst is brought into the process and what evidence is available to support the resulting escalation or decision.

How Does IntSOC Fit Into the Wider Data-Centre Environment?

NDR also needs to fit into the wider operational environment. IntSOC can integrate with Datadog to bring network intelligence together with infrastructure and application monitoring, giving security and operations teams a broader view of what is happening across the data centre.

Network-observability metrics can include throughput and utilisation, packet rates, latency, packet loss, jitter, congestion, microbursts, interface health and capacity indicators. IntSOC can add security context through detections including network anomalies, beaconing and command-and-control activity, lateral movement, unusual communication patterns, suspicious domain activity and long-lived flows.

Our IntSOC Integration with Datadog use case provides a practical example. Application latency is seen alongside increased network utilisation and microbursts, while IntSOC identifies unusual network behaviour. Bringing those signals together helps teams correlate application, infrastructure and network activity in one place, providing more context for investigation rather than requiring each signal to be analysed separately.

Read the IntSOC Integration with Datadog use case to see the integration in more detail.

IntSOC telemetry presented through Datadog.

Is the Platform Ready for How Data Centre Networks Are Changing?

The evaluation needs to look beyond today’s traffic volumes. As data-centre networks become faster and machine-to-machine communication increases, behavioural context, network relationships and the ability to investigate large volumes of activity become increasingly important. An NDR investment made today therefore needs to make sense for an environment in which both network speeds and the nature of the traffic continue to change.

This is also why 800G should be treated as an engineering question rather than a marketing suffix. Buyers should ask what has actually been tested, what telemetry is produced at that rate, whether the architecture changes, what happens under sustained load and whether the investigation experience remains consistent. As data-centre networks move beyond 400G, the same standard of evidence should apply. Equivalent 800G performance should be supported by equivalent engineering evidence rather than inferred from 400G results.

NDR at Scale: What Should You Ask Your Vendor?

Evaluating NDR at 400G and 800G requires more than comparing feature lists or headline throughput figures. A platform may support a particular interface speed, but that does not necessarily tell you what happens to the security intelligence when the network is operating at scale.

The evaluation should start with visibility. Is every session being analysed, or is traffic sampled? What happens under sustained and peak load? Can the platform maintain the flow volumes required by the environment, and what level of network intelligence is retained for investigation?

From there, the questions should move up the stack. What enrichment and behavioural context is created from the traffic? How is that intelligence used by machine-learning models? Can your own models be deployed alongside those supplied with the platform? And when Agentic AI is introduced, what evidence is available to the agents, what can they investigate autonomously, and where does the analyst remain in control?

For CISOs, these questions ultimately come back to one thing: Can this platform maintain useful security intelligence at the speed and scale of the network we need to protect?

The CISO’s 400G/800G NDR Evaluation Checklist brings these questions together into a practical framework you can use when evaluating NDR vendors.

Evaluating Network Detection and Response at Scale

The strongest NDR evaluation starts with evidence. Can the platform maintain useful visibility at the required speed? What network intelligence is produced? How is that intelligence used by behavioural models and analysts? Can the organisation deploy its own models? What does Agentic AI actually do, and where does human control remain?

For 400G environments, IntSOC provides specific, measurable figures for throughput, flow processing and concurrent active flows, giving security teams a concrete basis for evaluation. As networks move towards 800G, the same principle should apply: performance claims should be supported by equivalent engineering evidence rather than assumed from 400G results.

For CISOs, the decision is ultimately about whether the NDR platform can continue to provide useful security intelligence as the network evolves. That means evaluating the complete chain — from packet capture and high-speed processing through enrichment, behavioural detection, investigation and response.

Start with the network. Then evaluate everything built on top of it.