Network based cyber defense uses sensors and filters on traffic paths rather than relying only on software installed on each endpoint.
The defining choice is where the control sits: on the wire, at a gateway, or on a segment boundary instead of only inside each laptop.
How it works
Path based controls can see traffic from devices that cannot run an agent, including printers, sensors, and guest machines.
They also keep working when an endpoint product is disabled, which is why teams place filters and detectors where packets already flow.
This approach is not the whole of protecting a network, because policy, identity, and host hardening still matter when the packet was allowed through.
It is specifically the family of controls whose vantage point is the traffic itself.
Concrete examples
- A factory gateway inspects traffic from machines that cannot install endpoint software and blocks unexpected outbound destinations.
- A sensor on a mirror port notices scanning among building controllers that have no local security agent.
- Guest wireless traffic is filtered at the controller so a visitor laptop never needs the company's endpoint suite.
Protective measures
- Place at least one traffic path control where devices that cannot run agents must pass.
- Do not uninstall host protection merely because a gateway exists, since traffic inside a host can stay invisible on the wire.
- Document which flows are encrypted in a way that hides content from the path control, and decide what the path can still see.
- Test that a failed path sensor does not silently remove your only view of a segment.
Related articles
The broader goal of keeping linked systems trustworthy, beyond path sensors alone, is explained in What is network security for systems that must stay connected?.
A traffic sensor whose job is to alert is described in What is a network intrusion detection system watching packets on the wire?.
Splitting paths into trust zones is covered in What is network segmentation across separate trust zones?.