The Bastion product research group has developed a proprietary methodology for load testing NDR (Network Detection and Response) systems. The team aims to provide a reproducible approach for evaluating performance, as there are currently no open standards for testing this class of security tools.
Unlike NGFW or IPS solutions, which rely on established standards like RFC 9411 and RFC 2544, NDR products lack standardized testing protocols. The new methodology focuses on identifying real-world stability under load rather than relying on marketing-driven throughput metrics.
The proposed approach covers the setup of testing environments, the selection of relevant metrics from the NDR side, and the analysis of data beyond simple traffic generator statistics. It also includes criteria for defining test success and distinguishing between product limitations and infrastructure bottlenecks.
