What Your EDR Can't See: The Case for Network Security Monitoring in 2027
October 2026 | TAAUS Secure Technologies
In May, Palo Alto Networks disclosed that suspected state-sponsored attackers had been exploiting a critical PAN-OS firewall zero-day, CVE-2026-0300, for nearly a month. That was not an outlier. Since then, CISA has added actively exploited flaws in SonicWall SMA, Cisco ASA and Firepower, and Citrix NetScaler to its Known Exploited Vulnerabilities catalog. Every one of those devices sits at the network edge, and none of them run your EDR agent.
Meanwhile, on the endpoints that do run EDR, ransomware crews are shipping tooling built to switch it off. ESET's June reporting on the Gentlemen ransomware operation described a maintained, versioned "EDR killer" suite handed to affiliates as a product.
The common thread: attackers are deliberately operating where endpoint telemetry doesn't exist or can be blinded. The network still sees them. That is the case for network security monitoring (NSM), and why it belongs back in the stack of firms that let it drift after buying EDR.
Three places your EDR is blind
1. The edge appliances themselves. Firewalls, VPN concentrators, SSL-VPN gateways and remote access portals are purpose-built Linux boxes with locked-down shells. You can't install an agent on them, and their native logging rarely captures what an attacker does after landing. A compromised firewall becomes a trusted launch point: it already sits on every internal VLAN, and its traffic is expected. CISA considered the risk serious enough to issue Binding Operational Directive 26-02 in February, ordering federal agencies to remove edge devices that no longer receive vendor updates.
2. Everything without an agent. Printers, door controllers, conference room systems, NAS units, building management, hypervisor hosts, and the contractor laptop on guest Wi-Fi. In a 40-person firm, unmanaged IP devices commonly outnumber managed endpoints. An attacker who pivots through one of them generates no endpoint alert at all.
3. Endpoints after the EDR is killed. Bring-your-own-vulnerable-driver (BYOVD) attacks load a legitimately signed but flawed kernel driver, then use it to terminate security processes. The Gentlemen's GentleKiller suite targets hundreds of EDR processes across dozens of vendors, and the group reportedly folds newly published driver exploits into operations within days. Once the agent is down, your endpoint telemetry ends exactly when it matters most. The host still has to talk on the network to move laterally, stage data and exfiltrate.
What NSM actually means
NSM is not "we have a firewall." It is the collection and analysis of network evidence that lets you detect and investigate an intrusion independently of the hosts involved. It comes in four layers, each trading cost for depth:
Layer | What it records | What it answers | Practical cost |
Flow (NetFlow, IPFIX, firewall session logs) | Who talked to whom, when, on which port, how many bytes | Lateral movement, beaconing, large outbound transfers | Low: most firewalls already emit it |
Protocol metadata (Zeek or similar) | DNS queries, TLS SNI and certificates, HTTP hosts, SMB and Kerberos activity, JA3/JA4 fingerprints | What a connection was doing, not just that it happened | Moderate: a sensor plus storage |
Network IDS (Suricata or similar) | Signature and anomaly alerts on known exploit and C2 traffic | Known-bad patterns, including exploit attempts against your own edge | Moderate: tuning time is the real cost |
Full packet capture | Every byte, on a rolling window | Exactly what was sent, for forensics and scoping | High: storage, and mostly useless on encrypted traffic |
For most small and mid-sized firms, flow plus protocol metadata delivers the majority of the value. Encryption has made full packet capture far less useful than it was a decade ago. But metadata such as DNS, SNI, certificate details and connection timing still survives TLS, and that is where most modern detections live.
A practical NSM design for a small regulated firm
You don't need a security operations center's budget. You need the right sources flowing to a place where someone looks at them.
Send full firewall traffic logs to your SIEM, not just threat logs. Most firms forward IPS and AV events and drop the allowed-session logs, which are exactly what shows a compromised host talking to the wrong place. Enable logging on internal and allowed policies too, and forward via syslog to Sentinel, Huntress Managed SIEM or equivalent.
Own your DNS. Route all resolution through a filtering resolver such as Cisco Umbrella or your SASE platform, log every query, and block outbound DNS-over-HTTPS to unapproved resolvers so malware can't route around you.
Put one sensor at the core. A SPAN port or network TAP on the link between your core switch and the firewall's inside interface sees all north-south traffic. A second tap on the server VLAN catches east-west movement toward file servers and domain controllers. Run Zeek and Suricata, open-source or as part of a commercial sensor, and ship the metadata to the SIEM.
Cover the cloud networks too. In Azure, enable VNet flow logs with Traffic Analytics. NSG flow logs are being retired, so new deployments should start on VNet flow logs.
Watch the edge device's own behavior. Alert on administrative logins from anywhere outside your management network, on configuration changes outside a change window, and above all on outbound connections the firewall itself initiates to the internet. A firewall that suddenly opens sessions to an unfamiliar VPS is the clearest sign of appliance compromise you'll get.
Keep enough history. Edge exploits are often discovered weeks after the fact; PAN-OS CVE-2026-0300 was exploited for nearly a month before disclosure. Retain flow and DNS data for at least 90 days so you can answer "were we hit before the advisory?"
Make sure someone is watching at 2 a.m. NSM data nobody reviews is just storage cost. It needs to feed the same 24/7 detection and response coverage as your endpoint alerts.
Open source or commercial: what to run on the sensor
Some of the best NSM tooling available is free, and much of the commercial market is built on it. A small firm can get serious network visibility without a license line item, provided it budgets honestly for running it.
The open-source building blocks
Security Onion is the obvious starting point: a free Linux distribution that packages Suricata, Zeek, full packet capture, file analysis, and a search and case-management interface into one installable platform. It runs as a single box for a small office or as a distributed grid for larger networks. Version 3.x is current. The 2.4 line reached end of life on October 1, 2026, so any existing 2.4 sensors should be upgraded now.
Zeek turns raw traffic into structured logs for connections, DNS, TLS, HTTP, SMB, Kerberos and dozens of other protocols. It is the metadata layer described above, and the format most network analytics tools expect.
Suricata is the high-performance IDS engine, with signature detection, protocol logging and optional packet capture. Free rule sets such as ET Open cover a large share of known exploit and command-and-control traffic.
Arkime provides indexed full packet capture with a web interface for pulling sessions when an investigation needs the actual bytes.
RITA from Active Countermeasures analyzes Zeek logs specifically for beaconing, long connections and DNS tunneling, which is hunt 2 below, automated.
Malcolm, maintained with CISA's backing, bundles Zeek, Suricata and Arkime with dashboards, and is well suited to OT and manufacturing environments.
What "free" actually costs
The software is free to download. Running it is not free. A Security Onion sensor needs real hardware, typically with substantial RAM and fast disk for packet capture, plus a span port or TAP to feed it. Rule sets need tuning, or the alert queue fills with noise within a week. The platform needs patching like any other server, which is a pointed requirement given that this article opens with unpatched appliances. Most importantly, someone has to look at what it finds.
The pattern that works for small firms is to use open source sensors for collection and forward the high-value output to the SIEM where the rest of your detections already live. That means Suricata alerts, Zeek connection, DNS and TLS logs, and RITA findings, sent to Sentinel, Huntress Managed SIEM or equivalent. You get the depth of a purpose-built NSM platform without a second console nobody opens.
Commercial options such as Corelight (commercial Zeek), ExtraHop, Darktrace and Vectra trade license cost for managed sensors, vendor-maintained detections and support. They make sense when internal capacity to run the open source stack is the real constraint. Either path works. The wrong choice is the third one: no network visibility at all.
Five network hunts worth running
Once the data is flowing, these hunts target the behaviors attackers can't avoid, whether or not the endpoint agent is alive.
Sessions initiated by the firewall itself. Any outbound connection sourced from the appliance's own interfaces to something other than vendor update, NTP and DNS servers deserves an immediate look.
Beaconing. Repeated connections from one internal host to one external destination at near-constant intervals, often small and over 443, are the signature of command-and-control check-ins. Low variance in the time between connections is the tell.
Internal fan-out. A workstation that suddenly opens SMB (445), RDP (3389), WinRM (5985/5986) or RPC sessions to dozens of internal hosts is scanning or moving laterally. Workstations rarely need to talk to each other.
Large transfers to new destinations. Ransomware crews stage and exfiltrate before they encrypt. Look for hosts sending gigabytes outbound to destinations they've never contacted, especially file-sharing and cloud storage services your firm doesn't use.
Suspicious DNS. Queries to newly registered domains, long high-entropy subdomains (a hint of DNS tunneling), and any DNS traffic that bypasses your sanctioned resolver.
The bottom line
EDR remains essential, but heading into 2027 it is not sufficient on its own. This year, attackers learned to land on devices that can't run an agent and to blind the agents that do. The network is the one vantage point they still have to cross. Firewall traffic logs, DNS, a single well-placed sensor and someone watching the results close most of that gap at a cost proportionate to a small firm.
TAAUS deploys and monitors network telemetry alongside endpoint and identity coverage for firms in financial services, legal, healthcare and manufacturing. If you'd like to know what your network can and can't see today, get in touch.
