German cybersecurity provider genua, part of the Bundesdruckerei Group, has introduced genudetect, a network detection and response (NDR) platform designed to identify cyber threats across converged IT and operational technology (OT) environments. Presented at it-sa Expo&Congress 2026 in Nuremberg, the system combines distributed network sensors with centralised security analytics and passive traffic inspection. Commercial availability is scheduled for the first quarter of 2027.
As industrial networks become increasingly interconnected with enterprise IT systems, security teams face growing challenges in monitoring network activity, identifying potentially malicious behaviour and maintaining visibility across heterogeneous infrastructures.
genua’s genudetect addresses these requirements through a distributed architecture comprising the central genudetect Nexus analysis platform and a network of dedicated sensors. The system collects and examines network traffic using intrusion detection system (IDS) signatures and indicators of compromise (IoCs), consolidating security-relevant findings for further investigation by security analysts.
The approach is intended to provide continuous network monitoring across traditional enterprise environments and industrial infrastructures without requiring active intervention in operational communications.
Deep Packet Inspection Across Industrial and Enterprise Networks
According to genua, genudetect can identify more than 4,800 IT and OT protocols, including proprietary industrial communication protocols. The system uses deep packet inspection (DPI) to examine network traffic at the application layer, enabling security teams to analyse communication patterns and identify indicators of potential compromise.
Protocol visibility is particularly relevant in industrial environments, where proprietary communication standards and legacy equipment can complicate conventional security monitoring.
Unlike solutions that operate directly in the communication path, genudetect employs passive, non-intrusive traffic analysis. This architecture is intended to reduce the risk of interference with ongoing network operations, an important consideration for industrial facilities and other environments with stringent availability requirements.
Detected events are aggregated and processed centrally, providing analysts with a consolidated view of potential security incidents.
Integration with Existing Security Operations
The platform is designed to complement established security operations rather than function as a standalone monitoring environment.
genua states that genudetect supports the forwarding of threat information to security information and event management (SIEM), extended detection and response (XDR), IT service management (ITSM) and security orchestration, automation and response (SOAR) platforms.
These integrations allow organisations to incorporate network-based detection findings into existing incident analysis, escalation and response workflows.
The distinction between threat detection and automated intervention remains important. While genudetect is classified as an NDR solution, the capabilities described by the manufacturer primarily concern passive monitoring, event analysis and the integration of threat information with other security platforms.
The company has not provided independent detection-performance benchmarks or detailed information about automated response capabilities in the product announcement.
Distributed Sensors for Different Network Requirements
genudetect is available with a choice of three hardware sensor configurations — S, M and L — alongside a virtualised variant.
The different configurations are intended to accommodate varying network sizes, traffic volumes and deployment requirements. Virtual sensors can also be incorporated into existing virtualised network architectures, including P-A-P firewall structures.
This distributed deployment model enables network traffic to be monitored at multiple locations while maintaining centralised analysis through genudetect Nexus.
For organisations operating both conventional enterprise networks and industrial control environments, the architecture offers a means of consolidating threat detection without necessarily introducing inline security components into sensitive operational communication paths.
Regulatory and Critical Infrastructure Considerations
The introduction of genudetect comes as European organisations face increasing requirements to strengthen cybersecurity risk management, network visibility and incident handling.
In Germany and across the European Union, the implementation of the NIS2 Directive is contributing to greater attention on the security of essential and important entities, including organisations operating critical infrastructure.
Network detection technologies can support relevant cybersecurity risk management measures by improving the identification and analysis of suspicious activity. However, deploying an NDR platform does not, in itself, establish compliance with NIS2 or other regulatory obligations.
For operators of critical infrastructure, the ability to monitor industrial communication without disrupting production or essential services is an important deployment consideration. The effectiveness of such systems nevertheless depends on appropriate sensor placement, network coverage, detection configuration and integration with established security operations.
Availability
genua expects genudetect to become commercially available in the first quarter of 2027. The company is presenting the platform at it-sa Expo&Congress 2026, taking place from 27 to 29 October in Nuremberg, Germany, in Hall 9, Stand 424.
The product adds a network-focused detection capability to genua’s cybersecurity portfolio, targeting organisations that require visibility across interconnected IT and OT infrastructures.
Its practical value will depend on the extent to which protocol coverage, threat detection performance and integration capabilities can be demonstrated under operational conditions, particularly in industrial networks where availability and security requirements must be balanced.
