BankInfoSecurity has published an interview with Vectra AI President and CEO Hitesh Sheth arguing that network telemetry remains the most useful common source of truth for making security operations more predictive.
Sheth’s argument is straightforward: endpoint, identity, cloud and SaaS tools all provide valuable signals, but network data records how systems actually communicate. That makes it useful for spotting behavior that does not fit an organization’s normal patterns, including lateral movement, command-and-control traffic, credential abuse and unexpected connections between cloud workloads.
For Windows-heavy enterprises, that matters because the evidence of an intrusion is rarely confined to a single Windows endpoint. An attacker may authenticate through Active Directory, use legitimate remote-management tools, pivot through servers and communicate with external infrastructure without immediately triggering a malware alert. Network-level visibility can help tie those events together when endpoint logs or identities alone lack context.
Vectra AI sells network detection and response technology, so the interview is also a statement of product strategy. The company says security teams need systems that reduce large volumes of raw telemetry into prioritized “attack signals” rather than another stream of alerts for an already overloaded SOC.
The distinction is important, even if vendors use different terminology. Traditional security monitoring often leaves analysts to correlate endpoint detections, authentication events, DNS lookups, firewall logs and cloud audit records manually. A predictive model is only useful if it can identify meaningful changes early enough to investigate or contain them.
Vectra’s case is that network data is harder for attackers to avoid entirely. Even when adversaries use valid credentials, living-off-the-land tools or encrypted traffic, they still have to move data and communicate with systems. The quality of that insight, however, depends heavily on where sensors are deployed, how encrypted traffic is handled and whether the platform has enough baseline data to distinguish routine activity from suspicious behavior.
Teams considering network detection and response should validate a few basics before buying into predictive-security claims:
For Windows and security operations teams, the immediate task is to make sure network evidence is collected, retained and correlated before relying on any tool to predict the next attack.
Sheth’s argument is straightforward: endpoint, identity, cloud and SaaS tools all provide valuable signals, but network data records how systems actually communicate. That makes it useful for spotting behavior that does not fit an organization’s normal patterns, including lateral movement, command-and-control traffic, credential abuse and unexpected connections between cloud workloads.
For Windows-heavy enterprises, that matters because the evidence of an intrusion is rarely confined to a single Windows endpoint. An attacker may authenticate through Active Directory, use legitimate remote-management tools, pivot through servers and communicate with external infrastructure without immediately triggering a malware alert. Network-level visibility can help tie those events together when endpoint logs or identities alone lack context.
The pitch: move from alerts to attack signals
Vectra AI sells network detection and response technology, so the interview is also a statement of product strategy. The company says security teams need systems that reduce large volumes of raw telemetry into prioritized “attack signals” rather than another stream of alerts for an already overloaded SOC.The distinction is important, even if vendors use different terminology. Traditional security monitoring often leaves analysts to correlate endpoint detections, authentication events, DNS lookups, firewall logs and cloud audit records manually. A predictive model is only useful if it can identify meaningful changes early enough to investigate or contain them.
Vectra’s case is that network data is harder for attackers to avoid entirely. Even when adversaries use valid credentials, living-off-the-land tools or encrypted traffic, they still have to move data and communicate with systems. The quality of that insight, however, depends heavily on where sensors are deployed, how encrypted traffic is handled and whether the platform has enough baseline data to distinguish routine activity from suspicious behavior.
What admins should take from it
The practical message is not that Windows administrators need another AI security platform. It is that network telemetry should be treated as a core detection data source, alongside Microsoft Defender, Active Directory logs, identity-provider events and cloud audit trails.Teams considering network detection and response should validate a few basics before buying into predictive-security claims:
- Ensure core server segments, remote-access paths, data-center east-west traffic and cloud network flows are visible.
- Confirm that detections can be correlated with Windows device, user and identity data.
- Test how the product handles encrypted traffic and whether it relies on decryption, metadata or both.
- Measure analyst workload: a “high-fidelity” signal that still needs extensive manual enrichment will not solve alert fatigue.
- Require integrations with the existing SIEM, XDR, ticketing and incident-response workflow.
For Windows and security operations teams, the immediate task is to make sure network evidence is collected, retained and correlated before relying on any tool to predict the next attack.
References
- Primary source: BankInfoSecurity
Published: 2026-07-13T19:00:14.738896
Vectra AI CEO: Network Data Drives Predictive Security
Vectra AI CEO Hitesh Sheth says comprehensive network observability provides the most reliable foundation for predictive cybersecurity because it spans cloud, SaaSwww.bankinfosecurity.com
