Should you build or buy Network Detection & Response (NDR)?
Network detection and response software inspects network traffic for attacker behavior, malware and lateral movement, then alerts or automatically responds through integration with firewalls and endpoint tools. Security operations teams at mid-size and large enterprises buy it to catch threats that endpoint agents and log-based tools miss on the wire.
Buy the platform unless you already employ Zeek operators. The open-source core is real and runs at Berkeley Lab and CERN, but the three-year cost of a self-built stack is mostly the engineer who tends it, and vendor case studies record teams giving that up for managed sensors and curated detections. If you have detection engineers, feed Zeek into your SIEM; if not, license.
Build it, buy it, or bridge?
When building makes sense
Zeek was developed starting in 1995 and has been in continuous production at Lawrence Berkeley National Laboratory since 1996, and CERN operates it as the core of its own security operations stack, so open-source network monitoring clearly scales to a serious environment. Security Onion packages Zeek and Suricata together for teams that want a deployable open distribution rather than assembling one from source. What this buys you is raw visibility and the ability to write detections tuned to your environment, real value if you already have detection engineers who know what to look for. What it does not buy is fleet management across many sensors, curated detection content from a vendor's threat research team, or the investigation workflow that turns an alert into a response action. Vendor case studies record organizations abandoning self-managed Zeek for exactly those reasons once sensor count outgrew a small team. Build here only if detection engineering is a function you are staffing regardless of the tooling decision.
When buying makes sense
Buy an NDR platform unless you already run Zeek in production with dedicated operators. Corelight, Darktrace, ExtraHop, Vectra AI and Cisco Secure Network Analytics sell exactly what a self-built stack struggles to reproduce economically: fleet management across many sensors, detections curated and updated by a research team, behavioral analytics tuned across many customers' traffic, and an investigation workflow analysts can actually use under time pressure. The honest cost comparison is not software versus software, it is a commercial subscription against the fully loaded cost of the security engineer who would otherwise run and tune an open-source stack, and that engineer's salary alone usually exceeds a mid-sized deployment's licensing. If your team has no detection engineers today, buying gets you working coverage in days rather than a multi-month internal build. If you do have that capability already, the case for still buying weakens considerably.
The desk read
Build-versus-buy analysis for Network Detection & Response (NDR) is being written. In the meantime, the framework that drives every B4 call is on the B4 Index page.
Frequently asked
Is Zeek actually production-ready or just a research tool?
It is production-ready and has been for decades. Vern Paxson developed Zeek at Lawrence Berkeley National Laboratory starting in 1995, and LBNL has run it in production since 1996; CERN operates it as part of its own security operations stack alongside a MISP threat-intelligence feed. The gap versus a commercial platform is fleet management and curated content, not core reliability.
What does a commercial NDR platform actually add over open-source Zeek?
Sensor-fleet management at scale, detection content a vendor's research team keeps current, behavioral analytics trained across many customers' traffic instead of just your own, and an investigation console built for analysts. Vendor case studies show organizations moving away from self-managed Zeek specifically to get these, not the raw packet visibility itself.
How much does network detection and response typically cost?
Pricing is largely quote-based and scales with network throughput and sensor count, so a specific number depends heavily on your environment's bandwidth. The more useful comparison is against the fully loaded cost of a security engineer, which for most mid-sized deployments exceeds a commercial platform's subscription on its own.
Can we run Zeek ourselves and still buy a vendor's analytics on top?
Yes, and some teams do exactly this: feed Zeek's traffic logs into a SIEM or a vendor's analytics layer rather than buying an all-in-one NDR platform. It works well when you already have engineers who can operate Zeek reliably and just need better detection logic on top of the data it produces.