Patented Plug & Play NDR for IT, OT, IoT and medical networks: east-west traffic visibility, asset inventory and response that can be enabled segment by segment.
≈245,000 protected hosts · 24 countries · 98% renewal rate
Today a successful attack rarely breaks through the firewall: it gets in with valid credentials, a vulnerable device or a remote access, then moves inside the network. That is where the risk opens up.
Firewalls and EDR protect the perimeter and the hosts. Internal traffic, where an attacker moves after initial access, often goes unchecked. LECS makes it visible, with no agents and no operational downtime.
Analyses east-west traffic passively and in stealth mode: lateral movement, anomalous communications, out-of-profile OT commands.
No initial tuning: Tires-IA builds the network baseline on its own. 24/7 monitoring, automatic notifications and reports.
From servers to industrial machinery and medical devices: agentless protection, End of Life systems included.
It doesn’t replace firewalls, EDR or SIEM: it completes them, sending already-correlated events to your SOC via Syslog and API.
East-west internal traffic visibility
Limited to the perimeter and filtered segments
Only the traffic of the host running the agent
Yes, on monitored segments
Yes, on monitored segments, with DPI on headers and payload
Agentless devices (OT, IoT, IoMT, EOL)
Only through access rules
Not covered
Often through separate OT modules or products
Included: ANTLIA analyses OT, IoT and medical protocols on the same appliance and dashboard
Asset inventory
No
Only hosts with an agent
Varies: basic or via integrations
ORION: passive inventory, CVE/CVSS, IEC 62443 Zones & Conduits
Deployment
Inline, rule and policy design
Agent on every host
Sensors to be sized, initial tuning usually required
Out-of-band appliance or VM, up and running in about 10 minutes
Tuning and management
Policies to maintain
Per-host policies and exclusions
Often requires dedicated analysts
Automatic baseline in 2–5 weeks, automatic or manual fine tuning
Response
Perimeter blocking
Host isolation
Often through integration with firewall, NAC or SOAR
Raises: containment on the traffic, by segment (Probe Mode by default)
SOC integration
Security logs
Endpoint telemetry
Yes
Syslog CEF, LEEF 2.0, JSON and API
Where data resides
Depends on the vendor
Depends on the vendor
Depends on the vendor
Cloud on servers in Italy or On-Premises on the Aggregator
Comparison by product category, based on typical features: actual capabilities vary from vendor to vendor.
≈245,000 protected hosts, 230 partners and resellers, 24 countries across 3 continents, 98% renewal rate.
From a single site to multi-site critical infrastructure: same technology, same dashboard, analysis capacity sized to your traffic.
Agile protection for small facilities and branch offices: detection & response with a Cloud dashboard, on compact hardware or as a virtual version.
For manufacturing companies and multi-site organisations: more analysis capacity for dense networks and centralised monitoring of every site.
For large networks, critical infrastructure and public bodies: the highest traffic volumes, On-Premises installation with data and logs inside the corporate perimeter.
Appliance, virtual, embedded or integrated into your SOC: LECS adapts to the architecture you already have, across IT, OT and IoT.
Through the Cyber Evolution partner network: distributors, resellers, MSPs and system integrators, who also handle installation and support.
Cloud is the standard version, with the dashboard on servers in Italy. On-Premises keeps logs and data on the Aggregator inside your perimeter: the typical choice for critical infrastructure and public bodies.
About 10 minutes for installation, first evidence within a few hours, full behavioural baseline in 2–5 weeks.
A SPAN/mirror port or a TAP on the switch to be monitored and a management port. Sniffing ports require no IP address.
No. It is complementary: it adds visibility into internal traffic and integrates with existing SIEM and SOC via Syslog and API.
