Skip to content

How NetProtector Works

NetProtector detects attackers while they are still scouting targets – using a global sensor network and AI – and filters their traffic before it reaches your firewall.

An Early Warning System for the Internet

Imagine a worldwide radar for digital threats. NetProtector connects thousands of sensors around the globe, analyzes their data with artificial intelligence and thus learns around the clock to recognize attacks – fully automatically.

As soon as an attacker anywhere in the world even begins to scout potential targets, the system detects the threat at that very moment and classifies it. The information is rolled out to all NetProtector appliances. From then on, the attacker no longer stands a chance: neither to attack nor to scout further protected networks.

Global early warning system
1Somewhere in the world, an attacker starts scouting for targets.
2Sensors register the suspicious behaviour and report it to the AI platform.
3The AI classifies the source as a threat and rolls out protection to every appliance.
4The attacker is blocked everywhere – before the attack can even begin.

Every attack attempt the system sees anywhere makes the protection stronger for all customers – like a vaccination: what has been detected in one place protects everyone else.

Example 1: Detection via the Sensor Network

The foundation is a globally distributed network of sensors at various points of the internet:

  • Edge appliances directly in corporate networks – these are the NetProtector devices at our customers' sites,
  • Cloud sensors at major internet exchange points (peering points and IXPs),
  • Honeypots that lure attackers as bait and make their methods visible,
  • Partner sensors at internet service providers and hosting providers.
The sensor network
Analysed data
Deep packet inspection (layers 2–7)NetFlow / IPFIXDNS queries & responsesTLS/SSH handshake metadataSyslog & event logs

The analysis covers traffic data and metadata – such as connection patterns, DNS queries or the metadata of TLS and SSH handshakes. Encrypted content is not decrypted for this purpose. Learn more on the Technology page.

Example 2: Detecting Anomalies in Traffic

Conventional security solutions look for known attack patterns, so-called signatures. This means they only trigger once an attack is actually underway – and by then the attacker often already knows how to reach the target.

NetProtector works differently: the AI knows the "normal state" of the traffic. Anyone preparing an attack on a target generates traffic that deviates from it – scans, unusual connection attempts, conspicuous sequences. These anomalies are like foreign bodies in the data stream. The decisive factor is the view across the entire sensor network: if the same pattern appears at multiple sensors worldwide, it is clear that a source is deliberately searching for targets – and it is blocked before the actual attack begins.

Traffic anomalies – patterns across the sensor network
Normal traffic Anomaly in the traffic Pattern identified across sensors

Not every anomaly is an attack. That is why the AI evaluates multiple signals together and learns from every piece of feedback from security analysts – continuously reducing the number of false positives.

When is an attack detected?
1
Reconnaissance
Scans, scouting for targets
2
Preparation
Tools and access
3
Attack
Exploiting a vulnerability
4
Spread
Lateral movement in the network
5
Impact
Data theft, encryption
Traditional
pattern-based, reactive
NetProtector
anomaly-based, proactive
Traditional: Detection only once a known attack pattern appears – by then the attacker already knows the target.
NetProtector: Detection from the anomalies of reconnaissance – the source is blocked before the attack begins.

Example 3: Integration in Minutes

The NetProtector appliance is placed between the router and the firewall, where it operates as a bridge directly in the data stream. Unplug the cable between router and firewall, insert NetProtector in between, switch it on – done. Protection is active from the very first second.

Installed as a bridge
Traditional setup
Internet
Router
Firewall
Company network
With NetProtector
Internet
Router
NetProtector
Firewall
Company network
Works as a bridge directly in the traffic flow between router and firewall.
Filters unwanted traffic before it reaches the firewall – including its VPN gateways.
Installed in minutes, protecting from the moment it goes live.

Because NetProtector filters all inbound traffic before it reaches the firewall, the firewall's VPN access points and the applications behind it are protected as well – even if a vulnerability there has not yet been patched. Details on installation, response and connection to your existing systems can be found under Integration & Operation.

What This Means for You

For decision-makers

  • Greater cyber resilience through worldwide early warning
  • Less downtime and lower follow-up costs thanks to early detection
  • Relief for internal teams, as the AI prioritizes automatically
  • Measurable security via dashboards and management reports
  • Protection even against new, previously unknown attacks

For technical teams

  • Signature-based and signatureless methods in one system
  • Detection of new, unknown attack patterns
  • Fewer false positives through continuous learning
  • Detailed alerts with contextual information
  • Integration with SIEM, SOAR, EDR, NDR and firewall systems

Would you like to see NetProtector in your network? Request a demo.