Page 45 - Cyber Defense eMagazine RSAC Special Edition 2025

of the puzzle, TDIR pulls in telemetry from across the network, endpoints, cloud services, and
applications.

It uses advanced analytics (including AI/ML techniques and behavioral analysis) and continuously
updated threat intelligence feeds to recognize both known malware and novel attacker behaviors.

For instance, Crystal Eye can detect subtle signs of an attack such as a normally quiet server suddenly
communicating with a command-and-control server or unusual patterns that suggest a threat. With over
70,000 IDS/IPS threat detection rules updated daily feeding into the system, the platform stays current
with the latest indicators of compromise.

This means even stealthy tactics like fileless malware or living-off-the-land (where attackers use
legitimate admin tools maliciously) can be uncovered, as the platform looks for anomalies in usage
patterns rather than just known virus signatures.

Network Detection & Response (NDR): Deep Network-Level Visibility and Defense

A standout feature of Red Piranha’s unified solution is its strong focus on Network Detection and
Response (NDR): An area often overlooked by companies that rely solely on endpoint security.

Crystal Eye NDR acts as the eyes and ears of the network, continuously monitoring traffic flowing in and
out, as well as laterally within the environment. It uses a combination of machine learning, advanced
analytics, and rule-based matching to flag anomalous or suspicious activities on the network.

This means it can catch threats that don’t necessarily install malware on a device. For example, an
attacker probing your network, an IoT device behaving oddly, or a hacker exfiltrating data through an
encrypted channel. Network-wide visibility is crucial because sophisticated attackers often try to hide their
tracks using encryption or by leveraging legitimate network protocols.

Crystal Eye’s NDR is capable of analyzing over 3,200 network protocols (including specialized
industrial/SCADA protocols) out-of-the-box and even inspects encrypted traffic for deviations from normal
patterns. By doing so, it secures organizations against zero-day threats and APTs that might not trigger
any signature on an endpoint but do create anomalies in network behavior.

Crystal Eye WireGuard + Microsoft Entra ID SSO: Secure Remote Access, Simplified

The shift to remote work has made VPNs a prime target for attackers. Red Piranha’s Crystal Eye
WireGuard is now integrated with Microsoft Entra ID Single Sign-On (SSO). Now, why this sets us apart
from other solutions?

As remote work becomes the norm, secure VPN access is more critical than ever. WireGuard VPN has
gained popularity due to its lightweight design, high-speed performance, and strong encryption. However,
by default, WireGuard relies on static cryptographic keys, which lack enterprise identity management
integration. To address this limitation, Crystal Eye has integrated WireGuard with Microsoft Entra ID

45