Gartner Magic Quadrant for NDR 2026: NDR Solutions in the Softprom Portfolio

Network Detection and Response (NDR) is a class of cybersecurity solutions that detects abnormal network behavior by applying behavioral analytics to network traffic (east-west and north-south) and complements EDR, SIEM, and the SOC with automated response. On 18 May 2026, Gartner published the Magic Quadrant for Network Detection and Response (ID G00836320), evaluating leading NDR providers. Three of the evaluated vendors — Corelight, NetWitness, and Stellar Cyber — are available through Softprom, the official distributor of all three. Softprom is a value-added IT distributor specializing in cybersecurity, on the market since 1999 and operating across Central and Eastern Europe, the Caucasus, and Central Asia: 90+ cybersecurity vendors, 30+ certified engineers, solutions across 33 countries.

Gartner placed two of these vendors in the Visionaries quadrant (Corelight, NetWitness) and one in Niche Players (Stellar Cyber). Below is a brief overview of each solution and the scenarios it fits.

What NDR Is and Why the SOC Needs It

NDR continuously analyzes raw network packets or traffic metadata inside the network and at its perimeter, builds heuristic models of normal behavior, and detects deviations. Unlike tools that trigger only on signatures and rules, NDR is designed to detect and contain post-breach activity: ransomware, insider threats, and an attacker's lateral movement. SOC teams use NDR as a complementary detection-and-response technology alongside EDR and SIEM.

NDR Solutions in the Softprom Portfolio

Corelight Visionary

Best for: public sector and finance, transparent pricing. Open NDR is built on the open-source project Zeek with proprietary extensions. Transparent pricing by traffic volume with no hidden caps, and a free dedicated technical account manager for every customer. Expanding CPS/IoT threat detection for energy and healthcare.

NetWitness Visionary

Best for: large organizations that require packet capture. The NetWitness NDS platform serves large global organizations with powerful packet capture. Flexible and customizable across environments, with no single vertical exceeding 16% of customers. Following the move to PartnerOne (2025), it has refreshed its leadership and product.

Stellar Cyber Niche Player

Best for: midsize businesses and MSSPs, multitenancy. NDR delivered as a licensing option of a unified SecOps platform. Focused on human-augmented analyst workflows rather than fully autonomous response. True multitenancy and fast support, with an average case resolution time of about 1.5 days.

NDR Market Trends in 2026

According to Gartner, the NDR market is expanding toward broader threat detection. Key directions of development:

• Third-party integrations: EDR first, then identity providers, secure-email logs, IaaS, and SSE.
• Managed NDR: co-managed detection and response on top of the product — useful for small but growing teams.
• CPS / OT: all vendors are expanding the OT protocols they can analyze; some have dedicated CPS/OT products.
• AI analysis: predicting whether an incident will escalate, plus local, relevant analysis powered by DSLM.
• Larger sensors: probe entry points have grown to 40 Gbps, with the strongest vendors offering 100 Gbps and roadmaps to 400 Gbps.
• MCP traffic analysis: vendors are embedding MCP servers to identify dangerous MCP traffic.

Frequently Asked Questions