Network monitoring

Even when you cannot read the contents, network traffic tells you a great deal: who talked to whom, how much, how often and when.

That metadata is frequently enough to spot an intrusion. A workstation connecting to systems it has never touched, a steady trickle to an unfamiliar address at three in the morning, a volume of outbound data that does not match anything the business does. Encryption has not blinded network monitoring; it has changed what it looks at.