Network Detection and Response

The 2026 Magic Quadrant for Network Detection and Response, published May 18, 2026, adds a detection surface the market has never had: the traffic of AI agents themselves. The edition's trend list includes vendors embedding MCP servers to identify dangerous MCP traffic, and the inclusion marks the market's newest premise: the network's threat model now includes the software that acts on the network's behalf.

The new detection surface

Network detection and response was built for the classic threat model: the attacker moving through the network, and the platform that watches the traffic, finds the anomalous behavior, and triggers the response.

The agentic era changed the model from inside. The AI agents now move through the network continuously, calling tools, reaching services, and moving data through MCP connections, and the attacker's newest path is to ride the agent's own traffic, or to be the agent. The 2026 edition's MCP traffic analysis is the market's first formal acknowledgment: the agent's traffic is the network's newest attack surface, and the NDR platform is being extended to watch it.

The May 2026 Magic Quadrant for Network Detection and Response, and its three-Leader rung

The edition published May 18, 2026, authored by Thomas Lintemuth, Charanpal Bhogal, and Nahim Fazal.

Three Leaders hold the rung, all for the second consecutive year. Vectra AI, positioned highest on Ability to Execute, applying AI and machine learning to attacker behavior across hybrid networks, on-premises, multi-cloud, SaaS, identity, edge, and IoT and OT environments, with its attack signal intelligence. Darktrace, the second consecutive Leader, the only vendor holding both the 2025 and 2026 MQ Leader placements and the 2025 Peer Insights Customers' Choice, with its Self-Learning AI and its newest model, DIGEST, which predicts which incidents are most likely to escalate. And ExtraHop, the second consecutive Leader, holding the second-highest revenue in the market in 2025, first to market with native TLS decryption and 100 gigabit ingestion appliances.

The Visionaries are Corelight, the open NDR built on Zeek, and NetWitness, the full-packet capture specialist. The Niche Players include Stellar Cyber, Fortinet, Gatewatcher, Jizô AI, LinkShadow, Arista, and Trellix.

The AI that predicts escalation

Darktrace's DIGEST model is the edition's most instructive capability: a machine learning model that predicts which incidents are most likely to escalate.

The capability answers the market's oldest operational problem: the alert queue. The NDR platform finds the anomalies, and the security team drowns in the ones that do not matter. The escalation prediction re-orders the queue by consequence, the incident that becomes a breach versus the one that stays noise, and it is the market's first direct attempt to automate triage at the level of outcomes.

Escalation prediction is the market's next detection frontier, and the Leader that shipped it first is collecting the citation.

The sensor arms race

The edition's hardware thread is the sensor: probe entry points grown to 40 gigabits, top vendors offering 100 gigabit appliances, and roadmaps pointing to 400.

The race is the market's physics problem. The detection platform is only as good as the traffic it can actually see, and the network's traffic is growing faster than the sensors that watch it. The vendors' ingestion capacity is now a placement variable, and the buyer's bandwidth reality decides which sensor tier is even relevant.

The sensor race is the market's hardware arms race, and the 400 gigabit roadmap is the next front.

The integration geography

The edition's integration trend maps the market's expansion: third-party integrations extending from EDR first, then identity providers, secure email logs, IaaS, and SSE, plus the managed NDR offerings for the teams too small to run the platform themselves.

The sequence is the market's maturity path. The NDR platform that started as a network-only sensor is becoming the aggregation point for the whole detection estate, and the integration depth with the EDR vendors, the identity layer, the cloud telemetry, is where the placements are increasingly decided. ExtraHop's printed caution carries the counterpoint: CrowdStrike is the only EDR vendor with out-of-the-box bidirectional integration, a single-EDR limitation on an otherwise full integration story.

The cautions that matter

The edition's cautions are unusually legible, and two deserve the emphasis. ExtraHop's leadership turnover, continuing into 2025 with a CEO transition, a stability question on a security vendor. Fortinet's caution about marketing two distinct NDR products that dilute focus, a strategy question wearing a placement.

A caution about two products diluting focus is a strategy question wearing a placement, and the leadership caution is a trust question on a trust product. The buyer's diligence in this market should read the cautions before the placements, because the detection platform's continuity is part of its capability.

Four questions for the security buyer

What does the platform watch beyond the network? The integration geography is the market's expansion. Ask which telemetry, EDR, identity, email, cloud, the platform ingests natively, and which requires the buyer's own integration work.

Can it see the agent traffic? The MCP traffic analysis is the edition's newest surface. Ask how the platform detects dangerous MCP traffic today, in production, because the agent's traffic is the next attack path.

Does the triage predict consequences? The escalation prediction is the market's frontier. Ask for the triage ordering demonstrated on the buyer's own alert history, with the escalation outcomes shown.

What is the sensor story for your bandwidth? The arms race is the buyer's physics. Ask which appliance tier matches the actual traffic volume, and what the upgrade path costs at the next doubling.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

The companion piece on this site is Observability Pipelines. No standalone scorecard exists for this layer yet; it lives inside the broader observability platforms quadrant as a cost-control feature, because every gigabyte of unfiltered telemetry is a recurring invoice, and the pipeline is what negotiates it down.

The neighboring coverage here is Extended Detection And Response Platforms. The evaluated field shrank from fourteen vendors to seven in two editions, and Microsoft's newest move, merging its XDR and SIEM products into one analyst experience, is treated as a scored reality rather than a roadmap promise.