# Network security questions, answered plainly

> Plain answers to what IT teams, managers and MSPs ask about network security, NIS2 and incidents, including what a network sensor cannot do.

Source page: https://netsenx.com/en/faq

Questions people really ask about intrusions, ransomware, NIS2, encrypted traffic, AI and running security with a small team. Where a network sensor does not solve the problem, the answer says so and says what does.

## [Have I been hacked?](https://netsenx.com/en/faq/signs) ([Markdown](https://netsenx.com/en/faq/signs.md))

35 questions

- [How do I know if my business network has been compromised?](https://netsenx.com/en/faq/how-do-i-know-if-my-business-network-has-been-compromised)
- [Can an attacker stay inside a network for years without being noticed?](https://netsenx.com/en/faq/can-an-attacker-stay-inside-a-network-for-years-without-being-noticed)
- [What free checks can I run today?](https://netsenx.com/en/faq/what-free-checks-can-i-run-today)
- [Does NetSenX replace antivirus or EDR?](https://netsenx.com/en/faq/does-netsenx-replace-antivirus-or-edr)
- [Can my small business be hacked without me knowing?](https://netsenx.com/en/faq/can-my-small-business-be-hacked-without-me-knowing)
- [If one device on our network is hacked, are the others at risk?](https://netsenx.com/en/faq/if-one-device-is-hacked-are-the-others-at-risk)
- [Is slow internet a sign that we have been hacked?](https://netsenx.com/en/faq/is-slow-internet-a-sign-of-a-hack)
- [Our antivirus switched itself off. Is that a sign of compromise?](https://netsenx.com/en/faq/antivirus-turned-off-by-itself)
- [How can I see unknown devices on the company network?](https://netsenx.com/en/faq/how-to-see-unknown-devices-on-the-company-network)
- [Can you tell who is connected to the company Wi-Fi?](https://netsenx.com/en/faq/can-you-tell-who-is-connected-to-the-company-wi-fi)
- [Can someone get into our office network through a free wall socket?](https://netsenx.com/en/faq/can-someone-get-into-our-network-through-a-free-wall-socket)
- [How long do attackers stay in a network before they are found?](https://netsenx.com/en/faq/how-long-do-attackers-stay-in-a-network-before-they-are-found)
- [What are the signs that my computer is being monitored on the office network?](https://netsenx.com/en/faq/signs-a-computer-is-being-monitored-on-the-office-network)
- [Can you detect someone sniffing traffic on our network?](https://netsenx.com/en/faq/can-you-detect-someone-sniffing-traffic-on-the-network)
- [Can a hacker on our network steal data from all our computers and servers?](https://netsenx.com/en/faq/can-a-hacker-on-our-network-steal-data-from-every-computer)
- [How does an attacker get from our public IP address into our internal machines?](https://netsenx.com/en/faq/how-does-an-attacker-get-from-our-public-ip-to-internal-machines)
- [Are printers, cameras and other office devices a way in for attackers?](https://netsenx.com/en/faq/are-printers-and-cameras-a-way-in-for-attackers)
- [Is our smart TV or conference room system a security risk on the office network?](https://netsenx.com/en/faq/is-our-smart-tv-or-conference-system-a-security-risk)
- [A login from a new location: is it a breach or an employee on a new device?](https://netsenx.com/en/faq/login-from-a-new-location-breach-or-new-device)
- [Do attackers leave anything behind after we rebuild our machines?](https://netsenx.com/en/faq/do-attackers-leave-traces-after-a-rebuild)
- [Can we check our company network for botnet infections for free?](https://netsenx.com/en/faq/can-we-check-for-botnet-infections-for-free)
- [What is a compromise assessment, and do we need one?](https://netsenx.com/en/faq/what-is-a-compromise-assessment)
- [A company in our sector was hacked. How do we check whether we are next?](https://netsenx.com/en/faq/a-company-in-our-sector-was-hacked-are-we-next)
- [What should we look for on our network after a partner or peer company is breached?](https://netsenx.com/en/faq/what-to-look-for-after-a-partner-company-is-breached)
- [We had an incident last year. How do we make sure we would detect it if it happened again?](https://netsenx.com/en/faq/how-to-detect-a-repeat-of-last-years-incident)
- [Why do companies so often learn about a breach from outsiders?](https://netsenx.com/en/faq/why-companies-learn-about-breaches-from-outsiders)
- [How do we tell a network attack from a heavy update or backup?](https://netsenx.com/en/faq/how-to-tell-a-network-attack-from-an-update-or-backup)
- [How do we know what normal looks like on our network?](https://netsenx.com/en/faq/how-do-we-know-what-normal-looks-like-on-our-network)
- [What is an indicator of compromise (IOC)?](https://netsenx.com/en/faq/what-is-an-indicator-of-compromise)
- [Our antivirus shows everything green. Can we still be compromised?](https://netsenx.com/en/faq/antivirus-shows-green-can-we-still-be-compromised)
- [An administrator account appeared that nobody remembers creating. What now?](https://netsenx.com/en/faq/an-administrator-account-appeared-that-nobody-created)
- [A server sends data out at night. What should we check?](https://netsenx.com/en/faq/a-server-sends-data-out-at-night-what-to-check)
- [Our public IP address is on a blocklist. Does that mean we have been hacked?](https://netsenx.com/en/faq/our-ip-address-is-on-a-blocklist-are-we-hacked)
- [A colleague says the mouse moved by itself. Is someone controlling the computer?](https://netsenx.com/en/faq/the-mouse-moved-by-itself-is-someone-controlling-the-computer)
- [How do we check a suspicious computer without tipping off the attacker?](https://netsenx.com/en/faq/how-to-check-a-suspicious-computer-without-alerting-the-attacker)

## [Incident response](https://netsenx.com/en/faq/incident) ([Markdown](https://netsenx.com/en/faq/incident.md))

60 questions

- [What are the early warning signs of ransomware on a network?](https://netsenx.com/en/faq/what-are-the-early-warning-signs-of-ransomware-on-a-network)
- [Can network monitoring detect ransomware before encryption?](https://netsenx.com/en/faq/can-network-monitoring-detect-ransomware-before-encryption)
- [Does NetSenX stop ransomware?](https://netsenx.com/en/faq/does-netsenx-stop-ransomware)
- [What should we do first if we see these signs?](https://netsenx.com/en/faq/what-should-we-do-first-if-we-see-these-signs)
- [What should we do first if we are hit by ransomware?](https://netsenx.com/en/faq/first-steps-after-a-ransomware-attack)
- [What are the steps after a ransomware attack, in order?](https://netsenx.com/en/faq/steps-after-a-ransomware-attack-in-order)
- [Should we pay the ransom?](https://netsenx.com/en/faq/should-we-pay-the-ransom)
- [Should we pay a ransom if the attackers say they copied our data?](https://netsenx.com/en/faq/should-we-pay-if-attackers-say-they-copied-our-data)
- [What is a ransomware negotiator, and should we use one?](https://netsenx.com/en/faq/what-is-a-ransomware-negotiator)
- [How do we find out what data was stolen?](https://netsenx.com/en/faq/how-do-we-know-what-data-was-stolen)
- [How can we check whether ransomware attackers really stole our data?](https://netsenx.com/en/faq/how-to-check-whether-attackers-really-stole-our-data)
- [Our data is on a leak site. Can we find out when it was stolen?](https://netsenx.com/en/faq/our-data-is-on-a-leak-site-when-was-it-stolen)
- [Does NetSenX record which files were exfiltrated?](https://netsenx.com/en/faq/does-netsenx-record-which-files-were-exfiltrated)
- [Do attackers come back after we clean up?](https://netsenx.com/en/faq/do-attackers-come-back-after-cleanup)
- [What is incident response?](https://netsenx.com/en/faq/what-is-incident-response)
- [What are the phases of incident response?](https://netsenx.com/en/faq/what-are-the-phases-of-incident-response)
- [How do we prepare for a cyber incident before it happens?](https://netsenx.com/en/faq/how-to-prepare-for-a-cyber-incident)
- [What should an incident response plan contain?](https://netsenx.com/en/faq/what-should-an-incident-response-plan-contain)
- [Who should be on the incident team in a small company?](https://netsenx.com/en/faq/who-belongs-on-a-small-company-incident-team)
- [What is an incident response retainer, and do we need one?](https://netsenx.com/en/faq/what-is-an-incident-response-retainer)
- [What is a tabletop exercise, and how do we run one?](https://netsenx.com/en/faq/what-is-a-tabletop-exercise)
- [What is the difference between an event, an alert and an incident?](https://netsenx.com/en/faq/difference-between-an-event-an-alert-and-an-incident)
- [How do we tell a real incident from a false alarm?](https://netsenx.com/en/faq/how-to-tell-a-real-incident-from-a-false-alarm)
- [How do we decide how serious an incident is?](https://netsenx.com/en/faq/how-to-decide-how-serious-an-incident-is)
- [Who makes the decisions during a cyber incident?](https://netsenx.com/en/faq/who-makes-decisions-during-a-cyber-incident)
- [What does management have to decide in the first day of a cyber incident?](https://netsenx.com/en/faq/what-management-decides-in-the-first-day-of-an-incident)
- [How do we communicate during an incident if our e-mail may be compromised?](https://netsenx.com/en/faq/how-to-communicate-when-email-may-be-compromised)
- [Why should we keep a written log during an incident?](https://netsenx.com/en/faq/why-keep-a-written-log-during-an-incident)
- [How do we contain an incident without destroying the evidence?](https://netsenx.com/en/faq/how-to-contain-an-incident-without-destroying-evidence)
- [Should we unplug an infected computer or switch it off?](https://netsenx.com/en/faq/should-we-unplug-or-switch-off-an-infected-computer)
- [What should we avoid doing during a cyber incident?](https://netsenx.com/en/faq/what-not-to-do-during-a-cyber-incident)
- [How do we find patient zero, the first machine the attacker compromised?](https://netsenx.com/en/faq/how-to-find-patient-zero)
- [What is a forensic image, and when do we need one?](https://netsenx.com/en/faq/what-is-a-forensic-image)
- [What is chain of custody for digital evidence?](https://netsenx.com/en/faq/what-is-chain-of-custody-for-digital-evidence)
- [How do we preserve logs before they are overwritten?](https://netsenx.com/en/faq/how-to-preserve-logs-before-they-are-overwritten)
- [What does eradication mean in incident response?](https://netsenx.com/en/faq/what-does-eradication-mean-in-incident-response)
- [How do we reset passwords safely after a breach?](https://netsenx.com/en/faq/how-to-reset-passwords-safely-after-a-breach)
- [How do we know the attacker is really gone?](https://netsenx.com/en/faq/how-do-we-know-the-attacker-is-really-gone)
- [Can we keep using our computers after a ransomware attack?](https://netsenx.com/en/faq/can-we-keep-using-computers-after-ransomware)
- [How do we recover safely after a cyber incident?](https://netsenx.com/en/faq/how-to-recover-safely-after-a-cyber-incident)
- [Can we keep working during a cyber incident?](https://netsenx.com/en/faq/can-we-keep-working-during-a-cyber-incident)
- [How long should we watch the network closely after an incident?](https://netsenx.com/en/faq/how-long-to-watch-the-network-after-an-incident)
- [What is a lessons-learned review after an incident?](https://netsenx.com/en/faq/what-is-a-lessons-learned-review-after-an-incident)
- [What do we do with a security alert at night when nobody is on call?](https://netsenx.com/en/faq/a-security-alert-at-night-and-nobody-on-call)
- [Could we have seen a weekend ransomware attack coming?](https://netsenx.com/en/faq/could-we-have-seen-a-weekend-ransomware-attack-coming)
- [How much time passes between first access and encryption?](https://netsenx.com/en/faq/how-much-time-between-first-access-and-encryption)
- [How can ransomware spread through a USB stick or external drive?](https://netsenx.com/en/faq/how-can-ransomware-spread-through-a-usb-device)
- [What evidence should we keep for the insurer, the police and the regulator?](https://netsenx.com/en/faq/what-evidence-to-keep-for-insurer-police-and-regulator)
- [How long does NetSenX keep the network evidence of an incident?](https://netsenx.com/en/faq/how-long-does-netsenx-keep-incident-evidence)
- [Should we hire an incident-response firm or handle an incident ourselves?](https://netsenx.com/en/faq/should-we-hire-an-incident-response-firm-or-handle-it-ourselves)
- [How do we tell customers what data was affected in a breach?](https://netsenx.com/en/faq/how-to-tell-customers-what-data-was-affected)
- [Can network evidence show that a specific customer's data did not leave?](https://netsenx.com/en/faq/can-network-evidence-show-a-customers-data-did-not-leave)
- [Who can we call for free help after a cyberattack?](https://netsenx.com/en/faq/who-to-call-for-free-help-after-a-cyberattack)
- [Should we report a cyberattack to the police?](https://netsenx.com/en/faq/should-we-report-a-cyberattack-to-the-police)
- [Could an insider stealing money with malicious code have been spotted?](https://netsenx.com/en/faq/could-an-insider-stealing-with-malicious-code-be-spotted)
- [Was our website outage a cyber attack? How do we find out?](https://netsenx.com/en/faq/was-our-website-outage-a-cyber-attack)
- [Does network detection stop DDoS attacks, and how does it differ from DDoS protection?](https://netsenx.com/en/faq/does-network-detection-stop-ddos-attacks)
- [What does NetSenX give us during an incident?](https://netsenx.com/en/faq/what-does-netsenx-give-us-during-an-incident)
- [A supplier with access to our systems has been hacked. What do we do?](https://netsenx.com/en/faq/a-supplier-with-access-to-our-systems-was-hacked)
- [Is it a compromised account or a compromised device, and why does it matter?](https://netsenx.com/en/faq/compromised-account-or-compromised-device)

## [Attack techniques explained](https://netsenx.com/en/faq/attacks) ([Markdown](https://netsenx.com/en/faq/attacks.md))

69 questions

- [What is lateral movement in cybersecurity?](https://netsenx.com/en/faq/what-is-lateral-movement-in-cybersecurity)
- [How do you detect C2 beaconing?](https://netsenx.com/en/faq/how-do-you-detect-c2-beaconing)
- [Can you detect lateral movement in encrypted traffic?](https://netsenx.com/en/faq/can-you-detect-lateral-movement-in-encrypted-traffic)
- [Which MITRE ATT&CK techniques can network detection see?](https://netsenx.com/en/faq/which-mitre-att-ck-techniques-can-network-detection-see)
- [What is C2 beaconing?](https://netsenx.com/en/faq/what-is-c2-beaconing)
- [What is data exfiltration, and how is it detected?](https://netsenx.com/en/faq/what-is-data-exfiltration)
- [What does living off the land mean?](https://netsenx.com/en/faq/what-is-living-off-the-land)
- [Can a rogue device plugged into our network be detected?](https://netsenx.com/en/faq/can-a-rogue-device-on-our-network-be-detected)
- [What is MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-mitre-attack)
- [What is the difference between a tactic, a technique and a procedure (TTP)?](https://netsenx.com/en/faq/difference-between-a-tactic-a-technique-and-a-procedure)
- [What is reconnaissance in a cyberattack?](https://netsenx.com/en/faq/what-is-reconnaissance-in-a-cyberattack)
- [What is resource development in MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-resource-development-in-mitre-attack)
- [What is initial access in a cyberattack?](https://netsenx.com/en/faq/what-is-initial-access)
- [What does execution mean in MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-execution-in-mitre-attack)
- [What is persistence in a cyberattack?](https://netsenx.com/en/faq/what-is-persistence-in-a-cyberattack)
- [What is privilege escalation?](https://netsenx.com/en/faq/what-is-privilege-escalation)
- [What is the Stealth tactic in MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-the-stealth-tactic-in-mitre-attack)
- [What is Defense Impairment in MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-defense-impairment-in-mitre-attack)
- [What is credential access in a cyberattack?](https://netsenx.com/en/faq/what-is-credential-access)
- [What is discovery in MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-discovery-in-mitre-attack)
- [What is collection in MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-collection-in-mitre-attack)
- [What is command and control (C2) as an ATT&CK tactic?](https://netsenx.com/en/faq/what-is-command-and-control-in-mitre-attack)
- [What is the Impact tactic in MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-the-impact-tactic-in-mitre-attack)
- [What is the cyber kill chain, and how does it relate to MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-the-cyber-kill-chain)
- [How can a small team use MITRE ATT&CK to find gaps in its detection?](https://netsenx.com/en/faq/how-to-use-mitre-attack-to-find-gaps-in-detection)
- [What happens after an attacker gets into the network?](https://netsenx.com/en/faq/what-happens-after-an-attacker-gets-in)
- [Can antivirus or EDR alone catch lateral movement?](https://netsenx.com/en/faq/can-antivirus-or-edr-alone-catch-lateral-movement)
- [Why is a flat network dangerous?](https://netsenx.com/en/faq/why-is-a-flat-network-dangerous)
- [Why do update agents and monitoring tools look like beaconing?](https://netsenx.com/en/faq/why-do-update-agents-look-like-beaconing)
- [What is DNS tunnelling?](https://netsenx.com/en/faq/what-is-dns-tunnelling)
- [Can data be stolen through DNS without anyone noticing?](https://netsenx.com/en/faq/can-data-be-stolen-through-dns-without-anyone-noticing)
- [Can malware hide in DNS over HTTPS, and can we still see it?](https://netsenx.com/en/faq/can-malware-hide-in-dns-over-https)
- [What is low-and-slow data exfiltration, and how is it detected?](https://netsenx.com/en/faq/what-is-low-and-slow-data-exfiltration)
- [Why do simple bandwidth alarms miss data theft?](https://netsenx.com/en/faq/why-do-bandwidth-alarms-miss-data-theft)
- [What does Cobalt Strike activity look like on the network?](https://netsenx.com/en/faq/what-does-cobalt-strike-look-like-on-the-network)
- [Is internal port scanning a sign of an intruder?](https://netsenx.com/en/faq/is-internal-port-scanning-a-sign-of-an-intruder)
- [How do we know if someone is guessing passwords on our internal network?](https://netsenx.com/en/faq/how-to-know-if-someone-is-guessing-passwords-internally)
- [How do we detect large uploads to cloud storage from a server?](https://netsenx.com/en/faq/how-to-detect-large-uploads-to-cloud-storage-from-a-server)
- [What is PsExec or admin-share abuse, and why does antivirus not flag it?](https://netsenx.com/en/faq/what-is-psexec-and-admin-share-abuse)
- [Can attackers move through our network with stolen passwords and no malware?](https://netsenx.com/en/faq/can-attackers-move-with-stolen-passwords-and-no-malware)
- [Should we detect lateral movement from authentication logs or from network flows?](https://netsenx.com/en/faq/authentication-logs-or-network-flows-for-lateral-movement)
- [What is graph-based detection of lateral movement?](https://netsenx.com/en/faq/what-is-graph-based-lateral-movement-detection)
- [Do rule-based security tools miss new attack paths?](https://netsenx.com/en/faq/do-rule-based-tools-miss-new-attack-paths)
- [Why would a printer scan our network, and can printers be used to attack other computers?](https://netsenx.com/en/faq/why-would-a-printer-scan-our-network)
- [How do we stop an attacker who is already in our network?](https://netsenx.com/en/faq/how-to-stop-an-attacker-already-in-our-network)
- [How fast do attackers move once they are inside?](https://netsenx.com/en/faq/how-fast-do-attackers-move-once-inside)
- [How do we know if the PC we use for online banking is infected?](https://netsenx.com/en/faq/is-the-pc-we-use-for-online-banking-infected)
- [How would we know if our ERP database was copied out of the company?](https://netsenx.com/en/faq/how-would-we-know-if-our-erp-database-was-copied-out)
- [Can network monitoring tell a backup upload from data theft?](https://netsenx.com/en/faq/can-network-monitoring-tell-a-backup-from-data-theft)
- [Why would a normal workstation connect to the domain controller at night?](https://netsenx.com/en/faq/why-would-a-workstation-connect-to-the-domain-controller-at-night)
- [What is ARP spoofing, and how do we detect it on a small office network?](https://netsenx.com/en/faq/what-is-arp-spoofing-and-how-to-detect-it)
- [Can someone on our Wi-Fi read other users' traffic?](https://netsenx.com/en/faq/can-someone-on-our-wi-fi-read-other-users-traffic)
- [How much time do we have once ransomware starts touching file shares?](https://netsenx.com/en/faq/how-much-time-once-ransomware-touches-file-shares)
- [Can we see which program on a server made a large upload?](https://netsenx.com/en/faq/can-we-see-which-program-made-a-large-upload)
- [What is a supply chain attack?](https://netsenx.com/en/faq/what-is-a-supply-chain-attack)
- [What is a zero-day, and can anything detect it?](https://netsenx.com/en/faq/what-is-a-zero-day-and-can-it-be-detected)
- [What is the difference between brute force and password spraying?](https://netsenx.com/en/faq/difference-between-brute-force-and-password-spraying)
- [What is credential stuffing?](https://netsenx.com/en/faq/what-is-credential-stuffing)
- [What is Kerberoasting?](https://netsenx.com/en/faq/what-is-kerberoasting)
- [What is pass-the-hash?](https://netsenx.com/en/faq/what-is-pass-the-hash)
- [What is a drive-by download?](https://netsenx.com/en/faq/what-is-a-drive-by-download)
- [What is a botnet, and how would we know a device of ours is part of one?](https://netsenx.com/en/faq/what-is-a-botnet)
- [What is a remote-access trojan (RAT)?](https://netsenx.com/en/faq/what-is-a-remote-access-trojan)
- [What is an initial access broker?](https://netsenx.com/en/faq/what-is-an-initial-access-broker)
- [What is a web shell?](https://netsenx.com/en/faq/what-is-a-web-shell)
- [What is protocol tunnelling?](https://netsenx.com/en/faq/what-is-protocol-tunnelling)
- [Why do attackers use legitimate remote-access tools?](https://netsenx.com/en/faq/why-do-attackers-use-legitimate-remote-access-tools)
- [What is wiper malware?](https://netsenx.com/en/faq/what-is-wiper-malware)
- [What is cryptojacking, and can we see it on the network?](https://netsenx.com/en/faq/what-is-cryptojacking)

## [NDR, EDR, SIEM, XDR, MDR](https://netsenx.com/en/faq/tools) ([Markdown](https://netsenx.com/en/faq/tools.md))

40 questions

- [What is NDR (Network Detection and Response)?](https://netsenx.com/en/faq/what-is-ndr-network-detection-and-response)
- [What does NDR stand for?](https://netsenx.com/en/faq/what-does-ndr-stand-for)
- [How does network detection and response work?](https://netsenx.com/en/faq/how-does-network-detection-and-response-work)
- [What is the difference between NDR, EDR and SIEM?](https://netsenx.com/en/faq/what-is-the-difference-between-ndr-edr-and-siem)
- [What do EDR, NDR, XDR and MDR mean in plain words?](https://netsenx.com/en/faq/edr-ndr-xdr-mdr-explained-in-plain-words)
- [Does NetSenX replace my EDR or SIEM?](https://netsenx.com/en/faq/does-netsenx-replace-my-edr-or-siem)
- [Do I need NDR if I already have EDR?](https://netsenx.com/en/faq/do-i-need-ndr-if-i-already-have-edr)
- [EDR or NDR: which should a small company buy first?](https://netsenx.com/en/faq/edr-or-ndr-which-should-a-small-company-buy-first)
- [Is antivirus enough for a small business?](https://netsenx.com/en/faq/is-antivirus-enough-for-a-small-business)
- [What does network detection catch that antivirus misses?](https://netsenx.com/en/faq/what-does-network-detection-catch-that-antivirus-misses)
- [What gaps does EDR leave that only the network shows?](https://netsenx.com/en/faq/what-does-the-network-show-that-edr-misses)
- [What happens if attackers disable our EDR?](https://netsenx.com/en/faq/what-happens-if-attackers-disable-our-edr)
- [How do we notice when a server's endpoint protection goes silent?](https://netsenx.com/en/faq/how-to-notice-when-endpoint-protection-goes-silent)
- [What is XDR, and is it the same as NDR?](https://netsenx.com/en/faq/what-is-xdr-and-is-it-the-same-as-ndr)
- [What is MDR, and do we need it?](https://netsenx.com/en/faq/what-is-mdr-and-do-we-need-it)
- [What is the difference between MDR and EDR?](https://netsenx.com/en/faq/what-is-the-difference-between-mdr-and-edr)
- [How do I choose an MDR provider for a small company?](https://netsenx.com/en/faq/how-to-choose-an-mdr-provider-for-a-small-company)
- [Should we outsource the SOC or build one?](https://netsenx.com/en/faq/should-we-outsource-the-soc-or-build-one)
- [Do we need a SOC if we have only one IT administrator?](https://netsenx.com/en/faq/do-we-need-a-soc-with-only-one-it-administrator)
- [Can a small IT team run network detection without a SOC?](https://netsenx.com/en/faq/can-a-small-it-team-run-network-detection-without-a-soc)
- [Why do companies use a SIEM?](https://netsenx.com/en/faq/why-do-companies-use-a-siem)
- [Does a small business need a SIEM at all?](https://netsenx.com/en/faq/does-a-small-business-need-a-siem)
- [Do I need a SIEM if I have NDR?](https://netsenx.com/en/faq/do-i-need-a-siem-if-i-have-ndr)
- [Can network detection feed alerts into our existing SIEM?](https://netsenx.com/en/faq/can-network-detection-feed-alerts-into-our-siem)
- [How is NetSenX different from a signature-based IDS?](https://netsenx.com/en/faq/how-is-netsenx-different-from-a-signature-based-ids)
- [What is the difference between NDR and an IDS or IPS?](https://netsenx.com/en/faq/what-is-the-difference-between-ndr-and-an-ids-or-ips)
- [What is the difference between NDR and a firewall?](https://netsenx.com/en/faq/what-is-the-difference-between-ndr-and-a-firewall)
- [What is the difference between NDR, network traffic analysis and NetFlow monitoring?](https://netsenx.com/en/faq/ndr-vs-network-traffic-analysis-vs-netflow-monitoring)
- [Is AI-based detection better than signatures?](https://netsenx.com/en/faq/is-ai-based-detection-better-than-signatures)
- [Agent-based or SPAN/TAP-based network monitoring: which is better?](https://netsenx.com/en/faq/agent-based-or-span-tap-based-network-monitoring)
- [Does NDR work on encrypted traffic?](https://netsenx.com/en/faq/does-ndr-work-on-encrypted-traffic)
- [Can NDR see cloud and SaaS traffic?](https://netsenx.com/en/faq/can-ndr-see-cloud-and-saas-traffic)
- [Can NDR block attacks or only alert?](https://netsenx.com/en/faq/can-ndr-block-attacks-or-only-alert)
- [How do I build an asset inventory from network traffic?](https://netsenx.com/en/faq/how-to-build-an-asset-inventory-from-network-traffic)
- [Does a network map show devices that never send any traffic?](https://netsenx.com/en/faq/does-a-network-map-show-devices-that-never-send-traffic)
- [Is NDR worth it for a small or mid-sized company?](https://netsenx.com/en/faq/is-ndr-worth-it-for-a-small-or-mid-sized-company)
- [What should I ask when evaluating an NDR product?](https://netsenx.com/en/faq/what-to-ask-when-evaluating-an-ndr-product)
- [How do I test that our network detection actually works?](https://netsenx.com/en/faq/how-to-test-that-network-detection-actually-works)
- [What is breach and attack simulation, and does a mid-sized company need it?](https://netsenx.com/en/faq/what-is-breach-and-attack-simulation)
- [How often should we test our detection with simulated attacks?](https://netsenx.com/en/faq/how-often-should-we-test-detection-with-simulated-attacks)

## [Small business monitoring](https://netsenx.com/en/faq/smb) ([Markdown](https://netsenx.com/en/faq/smb.md))

40 questions

- [Does a small business need NDR?](https://netsenx.com/en/faq/does-a-small-business-need-ndr)
- [What is the minimum security a small business needs?](https://netsenx.com/en/faq/minimum-security-for-a-small-business)
- [What network security monitoring should a small business use?](https://netsenx.com/en/faq/what-network-security-monitoring-should-a-small-business-use)
- [Is network monitoring useful if everything we use is in the cloud?](https://netsenx.com/en/faq/is-network-monitoring-useful-if-everything-is-in-the-cloud)
- [How do I monitor a network on a budget?](https://netsenx.com/en/faq/how-to-monitor-a-network-on-a-budget)
- [How much does NDR cost for a small business?](https://netsenx.com/en/faq/how-much-does-ndr-cost-for-a-small-business)
- [How are devices counted?](https://netsenx.com/en/faq/how-are-devices-counted)
- [Is a free open-source security stack enough for a small company?](https://netsenx.com/en/faq/is-a-free-open-source-security-stack-enough-for-a-small-company)
- [How much effort does it take to run a self-hosted open-source monitoring stack?](https://netsenx.com/en/faq/how-much-effort-is-a-self-hosted-open-source-monitoring-stack)
- [Do we need both host-based and network-based intrusion detection?](https://netsenx.com/en/faq/do-we-need-both-host-and-network-intrusion-detection)
- [What is detection-as-code, and does a small company need it?](https://netsenx.com/en/faq/what-is-detection-as-code-and-does-a-small-company-need-it)
- [Can a team without security specialists run NDR?](https://netsenx.com/en/faq/can-a-team-without-security-specialists-run-ndr)
- [Can we run network monitoring without a security expert?](https://netsenx.com/en/faq/can-we-run-network-monitoring-without-a-security-expert)
- [What security monitoring can one IT administrator realistically run?](https://netsenx.com/en/faq/what-security-monitoring-can-one-it-administrator-realistically-run)
- [Do I need Linux skills to run network detection?](https://netsenx.com/en/faq/do-i-need-linux-skills-to-run-network-detection)
- [Should a small business hire an MSP for security?](https://netsenx.com/en/faq/should-a-small-business-hire-an-msp-for-security)
- [What is a SPAN port, and do I need special hardware?](https://netsenx.com/en/faq/what-is-a-span-port)
- [Do I need a TAP or SPAN port for network monitoring?](https://netsenx.com/en/faq/do-i-need-a-tap-or-span-port-for-network-monitoring)
- [How long does it take to install NetSenX?](https://netsenx.com/en/faq/how-long-does-it-take-to-install-netsenx)
- [Does network monitoring work if our computers run different operating systems?](https://netsenx.com/en/faq/does-network-monitoring-work-with-mixed-operating-systems)
- [Can network monitoring slow down our network or computers?](https://netsenx.com/en/faq/can-network-monitoring-slow-down-our-network)
- [What does a network sensor actually collect: content or metadata?](https://netsenx.com/en/faq/what-does-a-network-sensor-actually-collect)
- [Can we start by monitoring only our most critical systems?](https://netsenx.com/en/faq/can-we-start-by-monitoring-only-our-most-critical-systems)
- [What does baselining mean, and how long does it take?](https://netsenx.com/en/faq/what-does-baselining-mean-and-how-long-does-it-take)
- [What should a small company do when a security alert arrives?](https://netsenx.com/en/faq/what-should-a-small-company-do-when-a-security-alert-arrives)
- [Who watches the security alerts at night and at weekends?](https://netsenx.com/en/faq/who-watches-security-alerts-at-night-and-at-weekends)
- [Who watches our network when the IT administrator is on holiday?](https://netsenx.com/en/faq/who-watches-the-network-when-the-it-administrator-is-on-holiday)
- [Who gets the alert if something happens on the network over Christmas?](https://netsenx.com/en/faq/who-gets-the-alert-if-something-happens-over-christmas)
- [Why do cyber attacks often happen during holidays?](https://netsenx.com/en/faq/why-do-cyber-attacks-often-happen-during-holidays)
- [How do we protect the year-end close from a cyber attack?](https://netsenx.com/en/faq/how-to-protect-the-year-end-close-from-a-cyber-attack)
- [How do we monitor a second office or site without a second security team?](https://netsenx.com/en/faq/how-to-monitor-a-second-office-without-a-second-security-team)
- [How many NetSenX devices do we need for two sites?](https://netsenx.com/en/faq/how-many-netsenx-devices-do-we-need-for-two-sites)
- [Can an attacker move from a branch office to the head office over the VPN?](https://netsenx.com/en/faq/can-an-attacker-move-from-a-branch-office-to-head-office-over-the-vpn)
- [Should card terminals be on a separate network from office PCs?](https://netsenx.com/en/faq/should-card-terminals-be-on-a-separate-network-from-office-pcs)
- [How can we check that office computers cannot reach our tills?](https://netsenx.com/en/faq/how-to-check-that-office-computers-cannot-reach-the-tills)
- [What happens if an office PC infected with malware can reach the shop tills?](https://netsenx.com/en/faq/what-happens-if-an-infected-office-pc-can-reach-the-tills)
- [Is a consumer router a security risk for a small office?](https://netsenx.com/en/faq/is-a-consumer-router-a-security-risk-for-a-small-office)
- [What should we do with old devices nobody uses any more?](https://netsenx.com/en/faq/what-to-do-with-old-devices-nobody-uses)
- [What security questions will big customers ask a small supplier?](https://netsenx.com/en/faq/what-security-questions-will-big-customers-ask-a-small-supplier)
- [How should a small company keep security records?](https://netsenx.com/en/faq/how-to-keep-security-records-in-a-small-company)

## [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) ([Markdown](https://netsenx.com/en/faq/encryption.md))

40 questions

- [Can NetSenX detect threats in encrypted traffic?](https://netsenx.com/en/faq/can-netsenx-detect-threats-in-encrypted-traffic)
- [Can NDR detect threats in encrypted traffic without decrypting it?](https://netsenx.com/en/faq/can-ndr-detect-threats-in-encrypted-traffic-without-decrypting-it)
- [What does NetSenX read from an encrypted connection?](https://netsenx.com/en/faq/what-does-netsenx-read-from-an-encrypted-connection)
- [Do I need TLS decryption to detect threats?](https://netsenx.com/en/faq/do-i-need-tls-decryption-to-detect-threats)
- [Why not decrypt TLS traffic for inspection?](https://netsenx.com/en/faq/why-not-decrypt-tls-traffic-for-inspection)
- [What does TLS inspection on a firewall break?](https://netsenx.com/en/faq/what-does-tls-inspection-on-a-firewall-break)
- [Can deep packet inspection work on encrypted traffic?](https://netsenx.com/en/faq/can-deep-packet-inspection-work-on-encrypted-traffic)
- [Can malware be detected from flow statistics alone?](https://netsenx.com/en/faq/can-malware-be-detected-from-flow-statistics)
- [Can encrypted traffic reveal what is inside it?](https://netsenx.com/en/faq/can-encrypted-traffic-reveal-what-is-inside)
- [Is network metadata personal data under GDPR?](https://netsenx.com/en/faq/is-network-metadata-personal-data-under-gdpr)
- [Can you get malware from an HTTPS website?](https://netsenx.com/en/faq/can-you-get-malware-from-an-https-website)
- [Can HTTPS traffic be intercepted by a man in the middle?](https://netsenx.com/en/faq/can-https-traffic-be-intercepted)
- [What is JA4 TLS fingerprinting?](https://netsenx.com/en/faq/what-is-ja4-tls-fingerprinting)
- [What is the difference between JA3 and JA4?](https://netsenx.com/en/faq/what-is-the-difference-between-ja3-and-ja4)
- [What is SNI, and why does it matter for monitoring?](https://netsenx.com/en/faq/what-is-sni-and-why-does-it-matter-for-monitoring)
- [What is Encrypted Client Hello (ECH)?](https://netsenx.com/en/faq/what-is-encrypted-client-hello)
- [Does Encrypted Client Hello blind network monitoring?](https://netsenx.com/en/faq/does-encrypted-client-hello-blind-network-monitoring)
- [Do QUIC and HTTP/3 blind firewalls?](https://netsenx.com/en/faq/do-quic-and-http3-blind-firewalls)
- [Can DNS over HTTPS hide traffic from security monitoring?](https://netsenx.com/en/faq/can-dns-over-https-hide-traffic-from-security-monitoring)
- [How do I decrypt TLS traffic for troubleshooting?](https://netsenx.com/en/faq/how-to-decrypt-tls-for-troubleshooting)
- [How does a TLS handshake work?](https://netsenx.com/en/faq/how-does-a-tls-handshake-work)
- [What changed between TLS 1.2 and TLS 1.3?](https://netsenx.com/en/faq/what-changed-between-tls-1-2-and-tls-1-3)
- [Should we disable TLS 1.0 and 1.1?](https://netsenx.com/en/faq/should-we-disable-tls-1-0-and-1-1)
- [Which TLS ciphers should we turn off?](https://netsenx.com/en/faq/which-tls-ciphers-should-we-turn-off)
- [What is forward secrecy?](https://netsenx.com/en/faq/what-is-forward-secrecy)
- [What is encryption, in plain terms?](https://netsenx.com/en/faq/what-is-encryption-in-plain-terms)
- [What is the difference between symmetric and asymmetric encryption?](https://netsenx.com/en/faq/what-is-the-difference-between-symmetric-and-asymmetric-encryption)
- [How long should an encryption key be?](https://netsenx.com/en/faq/how-long-should-an-encryption-key-be)
- [What is a hash function?](https://netsenx.com/en/faq/what-is-a-hash-function)
- [Is hashing the same as encryption for passwords?](https://netsenx.com/en/faq/is-hashing-the-same-as-encryption-for-passwords)
- [What is a digital signature?](https://netsenx.com/en/faq/what-is-a-digital-signature)
- [What is a TLS certificate?](https://netsenx.com/en/faq/what-is-a-tls-certificate)
- [What happens when a TLS certificate expires?](https://netsenx.com/en/faq/what-happens-when-a-tls-certificate-expires)
- [Why are TLS certificate lifetimes getting shorter?](https://netsenx.com/en/faq/why-are-tls-certificate-lifetimes-getting-shorter)
- [Are self-signed certificates on internal servers a problem?](https://netsenx.com/en/faq/are-self-signed-certificates-on-internal-servers-a-problem)
- [What is mutual TLS (mTLS)?](https://netsenx.com/en/faq/what-is-mutual-tls)
- [Does a VPN encrypt everything we send?](https://netsenx.com/en/faq/does-a-vpn-encrypt-everything-we-send)
- [How do I find all SSH servers on our network, including forgotten ones?](https://netsenx.com/en/faq/how-to-find-all-ssh-servers-on-the-network)
- [How do I check which servers run an OpenSSH version affected by a new CVE?](https://netsenx.com/en/faq/how-to-check-openssh-versions-against-a-new-cve)
- [Does an SSH version banner prove a server is vulnerable?](https://netsenx.com/en/faq/does-an-ssh-version-banner-prove-a-server-is-vulnerable)

## [Post-quantum cryptography](https://netsenx.com/en/faq/pqc) ([Markdown](https://netsenx.com/en/faq/pqc.md))

33 questions

- [What is a quantum computer?](https://netsenx.com/en/faq/what-is-a-quantum-computer)
- [Why are quantum computers a threat to encryption?](https://netsenx.com/en/faq/why-are-quantum-computers-a-threat-to-encryption)
- [How does Shor's algorithm break RSA and ECC?](https://netsenx.com/en/faq/how-does-shors-algorithm-break-rsa-and-elliptic-curves)
- [What does Grover's algorithm mean for AES?](https://netsenx.com/en/faq/what-does-grovers-algorithm-mean-for-aes)
- [When will a quantum computer break RSA?](https://netsenx.com/en/faq/when-will-a-quantum-computer-break-encryption)
- [What is post-quantum cryptography?](https://netsenx.com/en/faq/what-is-post-quantum-cryptography)
- [What are FIPS 203, 204 and 205?](https://netsenx.com/en/faq/what-are-fips-203-204-and-205)
- [What is ML-KEM?](https://netsenx.com/en/faq/what-is-ml-kem)
- [What are ML-DSA and SLH-DSA?](https://netsenx.com/en/faq/what-are-ml-dsa-and-slh-dsa)
- [What are HQC and FN-DSA?](https://netsenx.com/en/faq/what-are-hqc-and-fn-dsa)
- [What is hybrid key exchange (X25519MLKEM768)?](https://netsenx.com/en/faq/what-is-hybrid-key-exchange-x25519mlkem768)
- [Is quantum key distribution an alternative to post-quantum cryptography?](https://netsenx.com/en/faq/is-quantum-key-distribution-an-alternative-to-pqc)
- [What does harvest now, decrypt later mean?](https://netsenx.com/en/faq/what-is-harvest-now-decrypt-later)
- [Which of our data is at risk from harvest now, decrypt later?](https://netsenx.com/en/faq/which-data-is-at-risk-from-harvest-now-decrypt-later)
- [How do I apply Mosca's inequality?](https://netsenx.com/en/faq/how-to-apply-moscas-inequality)
- [Is post-quantum cryptography hype?](https://netsenx.com/en/faq/is-post-quantum-cryptography-hype)
- [Is post-quantum cryptography a board-level topic?](https://netsenx.com/en/faq/is-post-quantum-cryptography-a-board-level-topic)
- [Does the EU require a post-quantum migration plan?](https://netsenx.com/en/faq/does-the-eu-require-a-post-quantum-migration)
- [What does the EU roadmap ask for by the end of 2026?](https://netsenx.com/en/faq/what-does-the-eu-pqc-roadmap-ask-for-by-2026)
- [Do NIS2 or the CRA require post-quantum cryptography?](https://netsenx.com/en/faq/do-nis2-or-the-cra-require-post-quantum-cryptography)
- [What should a small company do about post-quantum cryptography now?](https://netsenx.com/en/faq/what-should-a-small-company-do-about-pqc-now)
- [How long does a post-quantum migration take?](https://netsenx.com/en/faq/how-long-does-a-post-quantum-migration-take)
- [What do we gain by migrating to post-quantum cryptography?](https://netsenx.com/en/faq/what-do-we-gain-by-migrating-to-post-quantum-cryptography)
- [What can go wrong in a post-quantum migration?](https://netsenx.com/en/faq/what-can-go-wrong-in-a-post-quantum-migration)
- [What is crypto-agility?](https://netsenx.com/en/faq/what-is-crypto-agility)
- [Do SSH and VPNs support post-quantum key exchange?](https://netsenx.com/en/faq/do-ssh-and-vpns-support-post-quantum-key-exchange)
- [How can we find where we use quantum-vulnerable cryptography?](https://netsenx.com/en/faq/how-to-find-quantum-vulnerable-cryptography)
- [Can a network sensor build a cryptographic inventory?](https://netsenx.com/en/faq/can-a-network-sensor-build-a-cryptographic-inventory)
- [How do I find which connections already use hybrid key exchange?](https://netsenx.com/en/faq/which-connections-already-use-hybrid-key-exchange)
- [What should a cryptographic inventory include?](https://netsenx.com/en/faq/what-should-a-cryptographic-inventory-include)
- [Does NetSenX protect us against quantum computers?](https://netsenx.com/en/faq/does-netsenx-protect-us-against-quantum-computers)
- [How do we answer an RFP question about post-quantum readiness?](https://netsenx.com/en/faq/how-to-answer-an-rfp-question-on-post-quantum-readiness)
- [What should we ask vendors about post-quantum readiness?](https://netsenx.com/en/faq/what-to-ask-vendors-about-post-quantum-readiness)

## [AI use and AI security](https://netsenx.com/en/faq/ai) ([Markdown](https://netsenx.com/en/faq/ai.md))

45 questions

- [What is shadow AI?](https://netsenx.com/en/faq/what-is-shadow-ai)
- [Can NetSenX detect shadow AI on my network?](https://netsenx.com/en/faq/can-netsenx-detect-shadow-ai-on-my-network)
- [How can I detect shadow AI on my network?](https://netsenx.com/en/faq/how-can-i-detect-shadow-ai-on-my-network)
- [Which AI services does our company actually use?](https://netsenx.com/en/faq/which-ai-services-does-our-company-actually-use)
- [How much company data goes to AI services each month?](https://netsenx.com/en/faq/how-much-company-data-goes-to-ai-services)
- [Can DNS logs show shadow AI use?](https://netsenx.com/en/faq/can-dns-logs-show-shadow-ai-use)
- [Can network monitoring see AI use in desktop apps, IDEs and command-line tools?](https://netsenx.com/en/faq/can-network-monitoring-see-ai-in-desktop-apps-ides-and-clis)
- [Can network monitoring see what employees type into an AI chatbot?](https://netsenx.com/en/faq/can-network-monitoring-see-what-employees-type-into-an-ai-chatbot)
- [Why do companies have no visibility into what staff share with AI tools?](https://netsenx.com/en/faq/why-do-companies-have-no-visibility-into-what-staff-share-with-ai)
- [Is shadow AI detection included in every plan?](https://netsenx.com/en/faq/is-shadow-ai-detection-included-in-every-plan)
- [MSP tools now offer shadow AI visibility. What does it actually see?](https://netsenx.com/en/faq/what-does-shadow-ai-visibility-in-msp-tools-actually-see)
- [How secure is ChatGPT for our staff to use?](https://netsenx.com/en/faq/how-secure-is-chatgpt-for-staff-to-use)
- [How do we use AI chatbots securely as an organisation?](https://netsenx.com/en/faq/how-to-use-ai-chatbots-securely-as-a-company)
- [How do we stop employees pasting company data into ChatGPT?](https://netsenx.com/en/faq/stop-employees-pasting-company-data-into-chatgpt)
- [Should we block ChatGPT on the company network?](https://netsenx.com/en/faq/should-we-block-chatgpt-on-the-company-network)
- [What should we do when staff use AI tools without understanding the risks?](https://netsenx.com/en/faq/what-to-do-when-staff-use-ai-without-understanding-the-risks)
- [How do we check whether staff follow our AI policy?](https://netsenx.com/en/faq/how-to-check-whether-staff-follow-our-ai-policy)
- [Is it safe to upload financial spreadsheets to an AI tool?](https://netsenx.com/en/faq/is-it-safe-to-upload-financial-spreadsheets-to-an-ai-tool)
- [How do I know if employees paste customer data into AI tools?](https://netsenx.com/en/faq/how-do-i-know-if-staff-paste-customer-data-into-ai-tools)
- [Is pasting customer data into ChatGPT a GDPR breach?](https://netsenx.com/en/faq/is-pasting-customer-data-into-chatgpt-a-gdpr-breach)
- [Should employees caught using AI against the rules be fired?](https://netsenx.com/en/faq/should-employees-be-fired-for-using-ai-against-policy)
- [Employees bring their own AI tools to work. What is the risk?](https://netsenx.com/en/faq/what-is-the-risk-of-employees-bringing-their-own-ai)
- [Are AI browser extensions a security risk?](https://netsenx.com/en/faq/are-ai-browser-extensions-a-security-risk)
- [Does the EU AI Act require us to manage employees' AI use?](https://netsenx.com/en/faq/does-the-eu-ai-act-require-us-to-manage-employees-ai-use)
- [Does the AI Act apply to companies that only use AI tools?](https://netsenx.com/en/faq/does-the-ai-act-apply-if-we-only-use-ai-tools)
- [What does AI Act Article 4 (AI literacy) mean for HR?](https://netsenx.com/en/faq/what-does-ai-act-article-4-mean-for-hr)
- [Which AI tools should our AI literacy training cover?](https://netsenx.com/en/faq/which-ai-tools-should-our-ai-literacy-training-cover)
- [Can we use AI to monitor employees' emotions or mood?](https://netsenx.com/en/faq/can-we-use-ai-to-monitor-employees-emotions)
- [How do we answer a client asking whether we put their data into AI tools?](https://netsenx.com/en/faq/how-to-answer-a-client-asking-if-we-put-their-data-into-ai)
- [Should our AI use policy be part of customer contracts?](https://netsenx.com/en/faq/should-our-ai-policy-be-part-of-customer-contracts)
- [How do I find local AI model servers running on our network?](https://netsenx.com/en/faq/how-to-find-local-ai-model-servers-on-the-network)
- [Is a local AI model server on the office network a security risk?](https://netsenx.com/en/faq/is-a-local-ai-model-server-a-security-risk)
- [What is AI model supply-chain risk?](https://netsenx.com/en/faq/what-is-ai-model-supply-chain-risk)
- [Is AI-generated code a security risk?](https://netsenx.com/en/faq/is-ai-generated-code-a-security-risk)
- [What is prompt injection?](https://netsenx.com/en/faq/what-is-prompt-injection)
- [What is the OWASP Top 10 for LLM applications?](https://netsenx.com/en/faq/what-is-the-owasp-top-10-for-llm-applications)
- [How do we protect confidential data when using LLMs in production?](https://netsenx.com/en/faq/how-to-protect-confidential-data-when-using-llms-in-production)
- [What is the Model Context Protocol (MCP)?](https://netsenx.com/en/faq/what-is-the-model-context-protocol)
- [What is a shadow MCP server and why is it a risk?](https://netsenx.com/en/faq/what-is-a-shadow-mcp-server)
- [How do I discover AI agents running in our company?](https://netsenx.com/en/faq/how-to-discover-ai-agents-running-in-our-company)
- [Should AI agents be treated as privileged automated users?](https://netsenx.com/en/faq/should-ai-agents-be-treated-as-privileged-users)
- [Can an over-permissioned AI agent leak customer data?](https://netsenx.com/en/faq/can-an-over-permissioned-ai-agent-leak-customer-data)
- [Can network monitoring detect a misbehaving AI agent?](https://netsenx.com/en/faq/can-network-monitoring-detect-a-misbehaving-ai-agent)
- [How do attackers use AI against companies like ours?](https://netsenx.com/en/faq/how-do-attackers-use-ai-against-companies)
- [Can a deepfake call or video trick our finance team into paying?](https://netsenx.com/en/faq/can-a-deepfake-call-trick-our-finance-team)

## [OT and IoT](https://netsenx.com/en/faq/ot) ([Markdown](https://netsenx.com/en/faq/ot.md))

50 questions

- [Can NetSenX monitor OT and industrial networks?](https://netsenx.com/en/faq/can-netsenx-monitor-ot-and-industrial-networks)
- [Can you monitor an OT network without affecting PLCs?](https://netsenx.com/en/faq/can-you-monitor-an-ot-network-without-affecting-plcs)
- [Which industrial protocols does NetSenX read?](https://netsenx.com/en/faq/which-industrial-protocols-does-netsenx-read)
- [Do I need a hardware appliance on every site?](https://netsenx.com/en/faq/do-i-need-a-hardware-appliance-on-every-site)
- [Does NIS2 cover OT networks?](https://netsenx.com/en/faq/does-nis2-cover-ot-networks)
- [Can network monitoring break our PLCs?](https://netsenx.com/en/faq/can-network-monitoring-break-plcs)
- [Do IoT devices such as cameras and printers need monitoring?](https://netsenx.com/en/faq/do-iot-devices-need-monitoring)
- [Are cameras on their own VLAN still a risk?](https://netsenx.com/en/faq/are-cameras-on-their-own-vlan-still-a-risk)
- [How do I detect attacks on PLCs in a small factory?](https://netsenx.com/en/faq/how-to-detect-attacks-on-plcs-in-a-small-factory)
- [Why is Modbus considered insecure?](https://netsenx.com/en/faq/why-is-modbus-insecure)
- [How do I know if an unauthorised computer writes to our PLC?](https://netsenx.com/en/faq/how-to-know-if-an-unauthorised-computer-writes-to-a-plc)
- [Which OT alerts matter most for a small factory?](https://netsenx.com/en/faq/which-ot-alerts-matter-most-for-a-small-factory)
- [How do I detect a PLC program change outside working hours?](https://netsenx.com/en/faq/how-to-detect-a-plc-program-change-outside-working-hours)
- [Can network monitoring see an S7 PLC being stopped?](https://netsenx.com/en/faq/can-network-monitoring-see-an-s7-plc-being-stopped)
- [Can network monitoring show who changed a PLC setpoint?](https://netsenx.com/en/faq/can-network-monitoring-show-who-changed-a-plc-setpoint)
- [Does NetSenX record the values written to our controllers?](https://netsenx.com/en/faq/does-netsenx-record-the-values-written-to-controllers)
- [Can OT alerts help a quality or safety investigation?](https://netsenx.com/en/faq/can-ot-write-events-support-a-quality-or-safety-investigation)
- [Does NetSenX raise a separate anomaly alert for each industrial protocol?](https://netsenx.com/en/faq/does-netsenx-raise-a-separate-alert-for-each-industrial-protocol)
- [Can NetSenX block a dangerous command to a PLC?](https://netsenx.com/en/faq/can-netsenx-block-a-dangerous-command-to-a-plc)
- [Does NetSenX read PROFINET, OPC UA or IEC 60870-5-104?](https://netsenx.com/en/faq/does-netsenx-read-profinet-or-opc-ua)
- [Can a network sensor see serial fieldbus links such as Modbus RTU?](https://netsenx.com/en/faq/can-a-network-sensor-see-serial-fieldbus-links)
- [What does "never actively probed" mean for our controllers?](https://netsenx.com/en/faq/what-does-never-actively-probed-mean-for-our-controllers)
- [Do we need to change anything on our PLCs to monitor them?](https://netsenx.com/en/faq/do-we-need-to-change-anything-on-our-plcs-to-monitor-them)
- [What if our production switch has no SPAN port?](https://netsenx.com/en/faq/what-if-the-production-switch-has-no-span-port)
- [Can we monitor a machine without installing any software on it?](https://netsenx.com/en/faq/can-we-monitor-a-machine-without-installing-software-on-it)
- [Should the OT network be separated from the office network?](https://netsenx.com/en/faq/should-ot-be-separated-from-the-it-network)
- [What is the Purdue model, and why does cross-level traffic matter?](https://netsenx.com/en/faq/what-is-the-purdue-model)
- [How do I check that our office network cannot reach production controllers?](https://netsenx.com/en/faq/how-to-check-the-office-network-cannot-reach-production-controllers)
- [Can a ransomware attack on office IT stop a production line?](https://netsenx.com/en/faq/can-ransomware-on-office-it-stop-a-production-line)
- [How do we control maintenance laptops that connect to our production network?](https://netsenx.com/en/faq/how-to-control-maintenance-laptops-on-the-production-network)
- [Can we see which controllers a visiting technician's laptop talked to?](https://netsenx.com/en/faq/can-we-see-which-controllers-a-technicians-laptop-talked-to)
- [How should remote access to OT by vendors and integrators be secured?](https://netsenx.com/en/faq/how-should-vendor-remote-access-to-ot-be-secured)
- [Are vendor 4G routers in machine cabinets a security risk?](https://netsenx.com/en/faq/are-vendor-4g-routers-in-machine-cabinets-a-risk)
- [How do I find hidden remote-access routers in our production network?](https://netsenx.com/en/faq/how-to-find-hidden-remote-access-routers-in-production)
- [How do I protect an old production PC that cannot be patched?](https://netsenx.com/en/faq/how-to-protect-an-unpatchable-pc-in-production)
- [What is a compensating control for legacy OT systems?](https://netsenx.com/en/faq/what-is-a-compensating-control-for-legacy-ot-systems)
- [How do I build an OT asset inventory without active scanning?](https://netsenx.com/en/faq/how-to-build-an-ot-asset-inventory-without-active-scanning)
- [Which OT devices does passive monitoring miss?](https://netsenx.com/en/faq/which-ot-devices-does-passive-monitoring-miss)
- [How many sensors do we need to monitor three factories?](https://netsenx.com/en/faq/how-many-sensors-do-we-need-for-several-plants)
- [Can we monitor OT with open-source tools on a small budget?](https://netsenx.com/en/faq/can-i-monitor-ot-with-open-source-tools-on-a-budget)
- [What is IEC 62443, and do we need it?](https://netsenx.com/en/faq/what-is-iec-62443-and-do-we-need-it)
- [What evidence of attack detection in OT do auditors ask for?](https://netsenx.com/en/faq/what-evidence-of-attack-detection-in-ot-do-auditors-ask-for)
- [Are building management systems such as HVAC and BACnet a cyber risk?](https://netsenx.com/en/faq/are-building-management-systems-a-cyber-risk)
- [Can a hacked heating or access-control system be used to reach our office network?](https://netsenx.com/en/faq/can-a-hacked-heating-or-access-control-system-reach-the-office)
- [Is it normal for a CCTV recorder to connect to servers abroad?](https://netsenx.com/en/faq/is-it-normal-for-a-cctv-recorder-to-connect-to-servers-abroad)
- [Is a meeting-room TV that talks to unknown servers a risk?](https://netsenx.com/en/faq/is-a-meeting-room-tv-that-talks-to-unknown-servers-a-risk)
- [Why would our office printer connect to servers on the internet?](https://netsenx.com/en/faq/why-would-an-office-printer-connect-to-servers-on-the-internet)
- [How do we secure warehouse handhelds and label printers?](https://netsenx.com/en/faq/how-to-secure-warehouse-handhelds-and-label-printers)
- [Does every warehouse scanner count as a device in NetSenX pricing?](https://netsenx.com/en/faq/does-every-warehouse-scanner-count-as-a-netsenx-device)
- [How do we monitor medical or lab devices that cannot run security software?](https://netsenx.com/en/faq/how-to-monitor-medical-devices-that-cannot-run-security-software)

## [Remote work and exposed services](https://netsenx.com/en/faq/remote) ([Markdown](https://netsenx.com/en/faq/remote.md))

40 questions

- [Is remote desktop (RDP) exposed to the internet dangerous?](https://netsenx.com/en/faq/is-rdp-exposed-to-the-internet-dangerous)
- [How do we know if our VPN has been compromised?](https://netsenx.com/en/faq/how-do-i-know-if-our-vpn-is-compromised)
- [Can an infected home laptop spread malware into the office over the VPN?](https://netsenx.com/en/faq/can-an-infected-home-laptop-spread-malware-over-the-vpn)
- [Is it safe to expose SSH to the internet?](https://netsenx.com/en/faq/is-it-safe-to-expose-ssh-to-the-internet)
- [Which services should never be exposed to the internet?](https://netsenx.com/en/faq/which-services-should-never-be-exposed-to-the-internet)
- [How does remote working increase cyber-security risk?](https://netsenx.com/en/faq/how-does-remote-work-increase-cyber-risk)
- [How do I secure remote workers who access the company network?](https://netsenx.com/en/faq/how-to-secure-remote-workers-accessing-the-company-network)
- [Do we need a VPN for remote work?](https://netsenx.com/en/faq/do-we-need-a-vpn-for-remote-work)
- [Is a VPN protected only by a password enough?](https://netsenx.com/en/faq/is-a-vpn-without-multi-factor-authentication-enough)
- [Why are unpatched VPN gateways such a risk?](https://netsenx.com/en/faq/why-are-unpatched-vpn-gateways-a-risk)
- [What is split tunnelling on a VPN, and is it a risk?](https://netsenx.com/en/faq/what-is-split-tunnelling-and-is-it-a-risk)
- [Where should a sensor sit to see what VPN users do?](https://netsenx.com/en/faq/where-should-a-sensor-sit-to-see-vpn-users-traffic)
- [How do I detect a VPN account used from two countries at the same time?](https://netsenx.com/en/faq/how-to-detect-a-vpn-account-used-from-two-countries)
- [What is impossible travel, and which tool detects it?](https://netsenx.com/en/faq/what-is-impossible-travel-and-which-tool-detects-it)
- [Can network monitoring see where our VPN users connect from?](https://netsenx.com/en/faq/can-network-monitoring-see-where-vpn-users-connect-from)
- [Can NetSenX monitor a laptop that is outside the office?](https://netsenx.com/en/faq/can-netsenx-monitor-a-laptop-outside-the-office)
- [Do home-office laptops need the NetSenX agent installed?](https://netsenx.com/en/faq/do-home-office-laptops-need-the-netsenx-agent)
- [Should executive laptops get extra monitoring?](https://netsenx.com/en/faq/should-executive-laptops-get-extra-monitoring)
- [What does a network sensor see when a laptop comes back to the office after a trip?](https://netsenx.com/en/faq/what-does-a-sensor-see-when-a-laptop-returns-from-a-trip)
- [Is an employee's home router a risk to the company?](https://netsenx.com/en/faq/is-a-home-office-router-a-risk-to-the-company)
- [Is public Wi-Fi safe for a work laptop?](https://netsenx.com/en/faq/is-public-wifi-safe-for-a-work-laptop)
- [Should a work laptop be used for personal browsing at home?](https://netsenx.com/en/faq/should-a-work-laptop-be-used-for-personal-browsing)
- [Can staff use their personal devices for work?](https://netsenx.com/en/faq/can-staff-use-personal-devices-for-work)
- [What should we do when a work laptop is lost or stolen?](https://netsenx.com/en/faq/what-to-do-when-a-work-laptop-is-lost-or-stolen)
- [Can my employer see my traffic when I use the company VPN?](https://netsenx.com/en/faq/can-my-employer-see-my-traffic-on-the-company-vpn)
- [Is it safe to use a personal VPN app on a work computer?](https://netsenx.com/en/faq/is-it-safe-to-use-a-personal-vpn-on-a-work-computer)
- [Is a remote-desktop app that staff installed on an office PC a risk?](https://netsenx.com/en/faq/is-a-remote-desktop-app-on-an-office-pc-a-risk)
- [How do we find remote-desktop apps installed without permission?](https://netsenx.com/en/faq/how-to-find-remote-desktop-apps-installed-without-permission)
- [What is a bastion host or remote-desktop gateway, and do we need one?](https://netsenx.com/en/faq/what-is-a-bastion-host-or-remote-desktop-gateway)
- [Is leaving SSH open to the internet bad practice even with Fail2ban?](https://netsenx.com/en/faq/is-leaving-ssh-open-bad-practice-even-with-fail2ban)
- [Does moving SSH to a non-standard port help?](https://netsenx.com/en/faq/does-moving-ssh-to-a-non-standard-port-help)
- [How do I know if someone is brute-forcing our SSH servers right now?](https://netsenx.com/en/faq/how-to-know-if-someone-is-brute-forcing-our-ssh-servers)
- [Are we affected by OpenSSH flaws such as regreSSHion?](https://netsenx.com/en/faq/are-we-affected-by-openssh-flaws-like-regresshion)
- [Can malware travel back to my computer over an SSH session?](https://netsenx.com/en/faq/can-malware-travel-back-over-an-ssh-session)
- [How can SSH tunnels bypass a firewall?](https://netsenx.com/en/faq/how-can-ssh-tunnels-bypass-a-firewall)
- [Is it safe to use SSH over public Wi-Fi?](https://netsenx.com/en/faq/is-ssh-over-public-wifi-safe)
- [How dangerous is port forwarding to a server in the office?](https://netsenx.com/en/faq/how-dangerous-is-port-forwarding-for-an-office-server)
- [How do I check what our company exposes to the internet?](https://netsenx.com/en/faq/how-to-check-what-our-company-exposes-to-the-internet)
- [Is automatic port opening (UPnP) on the office router a risk?](https://netsenx.com/en/faq/is-upnp-on-the-office-router-a-risk)
- [Who notices a remote login at 3 a.m. on a Sunday?](https://netsenx.com/en/faq/who-notices-a-remote-login-at-3-am-on-a-sunday)

## [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) ([Markdown](https://netsenx.com/en/faq/zero-trust.md))

45 questions

- [Is zero trust realistic for a small business?](https://netsenx.com/en/faq/is-zero-trust-realistic-for-a-small-business)
- [How do we check that network segmentation actually works?](https://netsenx.com/en/faq/how-to-check-that-network-segmentation-works)
- [What does "assume breach" mean in practice?](https://netsenx.com/en/faq/what-does-assume-breach-mean)
- [Can network access control (NAC) replace network monitoring?](https://netsenx.com/en/faq/can-network-access-control-replace-monitoring)
- [Does a VPN contradict zero trust?](https://netsenx.com/en/faq/does-a-vpn-contradict-zero-trust)
- [What is zero-trust network access (ZTNA)?](https://netsenx.com/en/faq/what-is-zero-trust-network-access-ztna)
- [Is a firewall still needed if we have zero trust or SASE?](https://netsenx.com/en/faq/is-a-firewall-still-needed-with-zero-trust-or-sase)
- [How do segmentation and least privilege limit lateral movement?](https://netsenx.com/en/faq/how-does-segmentation-limit-lateral-movement)
- [Where do I start segmenting a flat office network?](https://netsenx.com/en/faq/where-to-start-segmenting-a-flat-office-network)
- [How do I segment IT and OT with VLANs and access lists?](https://netsenx.com/en/faq/how-to-segment-it-and-ot-with-vlans-and-acls)
- [What is microsegmentation, and do small companies need it?](https://netsenx.com/en/faq/what-is-microsegmentation)
- [Is a VLAN a security boundary?](https://netsenx.com/en/faq/is-a-vlan-a-security-boundary)
- [How do I check that guest Wi-Fi cannot reach our internal network?](https://netsenx.com/en/faq/how-to-check-guest-wifi-cannot-reach-the-internal-network)
- [Is a separate guest Wi-Fi enough for security?](https://netsenx.com/en/faq/is-a-separate-guest-wifi-enough)
- [Can someone plug a device into a free network socket in our office?](https://netsenx.com/en/faq/can-someone-plug-a-device-into-a-free-network-socket)
- [What is 802.1X, and does a small office need it?](https://netsenx.com/en/faq/what-is-802-1x-and-does-a-small-office-need-it)
- [Is multi-factor authentication enough to stop account takeover?](https://netsenx.com/en/faq/is-mfa-enough-to-stop-account-takeover)
- [Does a partial MFA rollout count for insurers and auditors?](https://netsenx.com/en/faq/does-a-partial-mfa-rollout-count)
- [Which MFA methods resist phishing?](https://netsenx.com/en/faq/which-mfa-methods-resist-phishing)
- [What is MFA fatigue, or push bombing?](https://netsenx.com/en/faq/what-is-mfa-fatigue-or-push-bombing)
- [Who holds admin rights in our company, and how do we check?](https://netsenx.com/en/faq/how-to-find-out-who-has-admin-rights)
- [What does least privilege mean in practice?](https://netsenx.com/en/faq/what-is-least-privilege-in-practice)
- [Do service accounts and API tokens need monitoring too?](https://netsenx.com/en/faq/do-service-accounts-and-api-tokens-need-monitoring)
- [Are shared admin accounts a problem, and what should we do instead?](https://netsenx.com/en/faq/how-to-handle-shared-admin-accounts)
- [Are password managers safe for a company to use?](https://netsenx.com/en/faq/are-password-managers-safe-for-a-company)
- [What makes a good company password policy?](https://netsenx.com/en/faq/what-makes-a-good-company-password-policy)
- [What is single sign-on, and does it improve security?](https://netsenx.com/en/faq/what-is-single-sign-on-and-does-it-improve-security)
- [How do we monitor an external accountant's remote access to our PCs?](https://netsenx.com/en/faq/how-to-monitor-an-external-accountants-remote-access)
- [What happens if our outsourced IT provider or bookkeeper is hacked?](https://netsenx.com/en/faq/what-happens-if-our-outsourced-it-or-bookkeeper-is-hacked)
- [How do I find old remote-access tools that suppliers left on our servers?](https://netsenx.com/en/faq/how-to-find-old-remote-access-tools-suppliers-left-on-servers)
- [How do we control and monitor third-party vendor access to our network?](https://netsenx.com/en/faq/how-to-monitor-third-party-vendor-access)
- [What does NIS2 supply-chain security mean in practice for a small company?](https://netsenx.com/en/faq/what-is-nis2-supply-chain-security-for-a-small-company)
- [How would we notice that a former employee's device is still connecting?](https://netsenx.com/en/faq/how-would-we-notice-an-ex-employees-device-still-connecting)
- [How can we tell if a stolen password is being used?](https://netsenx.com/en/faq/how-to-detect-a-stolen-password-being-used)
- [Should administrators use separate accounts for admin work?](https://netsenx.com/en/faq/should-admins-use-separate-accounts-for-admin-work)
- [What is privileged access management (PAM), and do we need it?](https://netsenx.com/en/faq/what-is-privileged-access-management)
- [Can network monitoring see attacks on accounts and the directory?](https://netsenx.com/en/faq/can-network-monitoring-see-identity-attacks)
- [Does NIS2 require zero trust?](https://netsenx.com/en/faq/does-nis2-require-zero-trust)
- [How do we limit what a compromised laptop can reach?](https://netsenx.com/en/faq/how-to-limit-what-a-compromised-laptop-can-reach)
- [Should our servers be allowed to connect to any address on the internet?](https://netsenx.com/en/faq/should-servers-be-allowed-to-browse-the-internet)
- [How do we write segmentation rules without breaking things?](https://netsenx.com/en/faq/how-to-build-allow-rules-from-real-traffic)
- [Is a DMZ still useful for a small company?](https://netsenx.com/en/faq/is-a-dmz-still-useful)
- [Can we segment a small office network without buying new hardware?](https://netsenx.com/en/faq/how-to-segment-a-small-office-without-new-hardware)
- [How do we protect our domain controller or directory server?](https://netsenx.com/en/faq/how-to-protect-the-domain-controller)
- [Does zero trust mean monitoring employees?](https://netsenx.com/en/faq/does-zero-trust-mean-monitoring-employees)

## [NIS2 scope and duties](https://netsenx.com/en/faq/nis2) ([Markdown](https://netsenx.com/en/faq/nis2.md))

40 questions

- [Do I need NDR for NIS2?](https://netsenx.com/en/faq/do-i-need-ndr-for-nis2)
- [Does NIS2 require network monitoring?](https://netsenx.com/en/faq/does-nis2-require-network-monitoring)
- [What are the NIS2 incident reporting deadlines?](https://netsenx.com/en/faq/what-are-the-nis2-incident-reporting-deadlines)
- [Does NIS2 apply to mid-sized companies?](https://netsenx.com/en/faq/does-nis2-apply-to-mid-sized-companies)
- [Does NetSenX submit the NIS2 report for us?](https://netsenx.com/en/faq/does-netsenx-submit-the-nis2-report-for-us)
- [What are the NIS2 fines?](https://netsenx.com/en/faq/what-are-the-nis2-fines)
- [Who is responsible for NIS2 in a company?](https://netsenx.com/en/faq/who-is-responsible-for-nis2-in-a-company)
- [Is NIS2 mandatory for a company with fewer than 50 staff?](https://netsenx.com/en/faq/is-nis2-mandatory-for-companies-with-fewer-than-50-staff)
- [Can a small subsidiary be in NIS2 scope because of its group?](https://netsenx.com/en/faq/can-a-small-subsidiary-be-in-nis2-scope-because-of-its-group)
- [Our customer is in NIS2 scope. Do we have to comply too?](https://netsenx.com/en/faq/our-customer-is-in-nis2-scope-do-we-have-to-comply)
- [What does NIS2 require from a mid-sized company in scope?](https://netsenx.com/en/faq/what-does-nis2-require-from-a-mid-sized-company)
- [What are the ten risk-management measures in NIS2 Article 21?](https://netsenx.com/en/faq/what-are-the-ten-nis2-article-21-measures)
- [What is the difference between essential and important entities under NIS2?](https://netsenx.com/en/faq/what-is-the-difference-between-essential-and-important-entities)
- [Which sectors does NIS2 cover?](https://netsenx.com/en/faq/which-sectors-does-nis2-cover)
- [Are managers personally liable under NIS2?](https://netsenx.com/en/faq/are-managers-personally-liable-under-nis2)
- [Is cyber security training mandatory for management under NIS2?](https://netsenx.com/en/faq/is-management-training-mandatory-under-nis2)
- [What do board members have to approve under NIS2 Article 20?](https://netsenx.com/en/faq/what-do-board-members-approve-under-nis2-article-20)
- [How can a managing director check that cyber measures actually work?](https://netsenx.com/en/faq/how-can-a-managing-director-check-cyber-measures-work)
- [Does NetSenX cover all NIS2 Article 21 measures?](https://netsenx.com/en/faq/does-netsenx-cover-all-nis2-article-21-measures)
- [Does buying a security tool make us NIS2 compliant or registered?](https://netsenx.com/en/faq/does-buying-a-security-tool-make-us-nis2-compliant)
- [Which NIS2 tasks can software help with, and which can it not?](https://netsenx.com/en/faq/which-nis2-tasks-can-software-help-with)
- [Does NIS2 require a specific security tool, such as intrusion detection?](https://netsenx.com/en/faq/does-nis2-require-a-specific-security-tool)
- [What happens if we grow or acquire a company and cross the NIS2 size threshold?](https://netsenx.com/en/faq/what-if-we-cross-the-nis2-size-threshold)
- [Who decides whether our company is in NIS2 scope?](https://netsenx.com/en/faq/who-decides-whether-we-are-in-nis2-scope)
- [Do we have to register under NIS2, and with whom?](https://netsenx.com/en/faq/do-we-have-to-register-under-nis2)
- [Why are our customers suddenly sending NIS2 supplier questionnaires?](https://netsenx.com/en/faq/why-are-customers-sending-nis2-supplier-questionnaires)
- [How do we answer “do you have intrusion detection?” on a customer questionnaire?](https://netsenx.com/en/faq/how-to-answer-do-you-have-intrusion-detection-on-a-questionnaire)
- [What should a company do first to prepare for NIS2?](https://netsenx.com/en/faq/what-should-a-company-do-first-to-prepare-for-nis2)
- [How does a small or mid-sized company do a cyber risk assessment for NIS2?](https://netsenx.com/en/faq/how-do-smes-do-a-cyber-risk-assessment-for-nis2)
- [Has my country transposed NIS2 into national law yet?](https://netsenx.com/en/faq/has-my-country-transposed-nis2)
- [Does NIS2 require multi-factor authentication?](https://netsenx.com/en/faq/does-nis2-require-multi-factor-authentication)
- [Does NIS2 require encryption?](https://netsenx.com/en/faq/does-nis2-require-encryption)
- [Does NIS2 require backups and a business continuity plan?](https://netsenx.com/en/faq/does-nis2-require-backups-and-business-continuity)
- [What does NIS2 say about supply chain security?](https://netsenx.com/en/faq/what-does-nis2-say-about-supply-chain-security)
- [Does NIS2 require an inventory of IT assets?](https://netsenx.com/en/faq/does-nis2-require-an-asset-inventory)
- [Who supervises NIS2 compliance, and what can the supervisor do?](https://netsenx.com/en/faq/who-supervises-nis2-and-what-can-they-do)
- [Does NIS2 apply to companies based outside the EU?](https://netsenx.com/en/faq/does-nis2-apply-to-companies-outside-the-eu)
- [What evidence will a NIS2 supervisor ask for?](https://netsenx.com/en/faq/what-evidence-will-a-nis2-supervisor-ask-for)
- [What is Implementing Regulation (EU) 2024/2690 under NIS2?](https://netsenx.com/en/faq/what-is-the-nis2-implementing-regulation-2024-2690)
- [How do national NIS2 laws differ between EU countries?](https://netsenx.com/en/faq/how-do-national-nis2-laws-differ)

## [Incident reporting deadlines](https://netsenx.com/en/faq/reporting) ([Markdown](https://netsenx.com/en/faq/reporting.md))

35 questions

- [When does the NIS2 24-hour clock start?](https://netsenx.com/en/faq/when-does-the-nis2-24-hour-clock-start)
- [What has to be in a NIS2 early warning?](https://netsenx.com/en/faq/what-has-to-be-in-a-nis2-early-warning)
- [Is the final report due one month after the incident?](https://netsenx.com/en/faq/is-the-final-report-due-one-month-after-the-incident)
- [Are the deadlines different for trust service providers?](https://netsenx.com/en/faq/are-the-deadlines-different-for-trust-service-providers)
- [How fast must a data breach be reported under the GDPR?](https://netsenx.com/en/faq/how-fast-must-a-gdpr-breach-be-reported)
- [What does the CRA require when a vulnerability is exploited?](https://netsenx.com/en/faq/what-does-the-cra-require-when-a-vulnerability-is-exploited)
- [Does DORA apply to us?](https://netsenx.com/en/faq/does-dora-apply-to-us)
- [What counts as a significant incident under NIS2?](https://netsenx.com/en/faq/what-counts-as-a-significant-incident-under-nis2)
- [Is a failed or blocked attack reportable under NIS2?](https://netsenx.com/en/faq/is-a-blocked-attack-reportable-under-nis2)
- [How can a small team meet the NIS2 24-hour early-warning deadline?](https://netsenx.com/en/faq/how-can-a-small-team-meet-the-nis2-24-hour-deadline)
- [What should we have ready before the NIS2 24-hour deadline arrives?](https://netsenx.com/en/faq/what-should-we-have-ready-before-the-nis2-24-hour-deadline)
- [Do we have to tell our own customers about a NIS2 incident?](https://netsenx.com/en/faq/do-we-have-to-tell-customers-about-a-nis2-incident)
- [Do we have to report a ransomware attack under the GDPR?](https://netsenx.com/en/faq/do-we-have-to-report-ransomware-under-the-gdpr)
- [If the stolen data was encrypted, must we still notify?](https://netsenx.com/en/faq/if-stolen-data-was-encrypted-must-we-still-notify)
- [We cannot complete the GDPR notification within 72 hours. Can we notify in phases or late?](https://netsenx.com/en/faq/we-cannot-meet-72-hours-can-we-notify-in-phases)
- [When does the GDPR 72-hour notification clock start?](https://netsenx.com/en/faq/when-does-the-gdpr-72-hour-clock-start)
- [One incident, several reports: how do NIS2, the GDPR and DORA fit together?](https://netsenx.com/en/faq/one-incident-several-reports-nis2-gdpr-dora)
- [What is a major ICT-related incident under DORA?](https://netsenx.com/en/faq/what-is-a-major-ict-incident-under-dora)
- [What are the DORA incident reporting deadlines?](https://netsenx.com/en/faq/what-are-the-dora-incident-reporting-deadlines)
- [Where are Cyber Resilience Act vulnerability reports submitted?](https://netsenx.com/en/faq/where-are-cra-vulnerability-reports-submitted)
- [Should we report a cyber incident to the police as well as the regulator?](https://netsenx.com/en/faq/should-we-report-a-cyber-incident-to-the-police)
- [What information should an incident report to the authorities contain?](https://netsenx.com/en/faq/what-should-an-incident-report-contain)
- [Do we still have to report an incident that is already resolved?](https://netsenx.com/en/faq/can-we-report-an-incident-that-is-already-resolved)
- [What reduces a GDPR fine after a data breach?](https://netsenx.com/en/faq/what-reduces-a-gdpr-fine-after-a-data-breach)
- [Can NetSenX prepare a GDPR Article 33 breach notification?](https://netsenx.com/en/faq/can-netsenx-prepare-a-gdpr-article-33-notification)
- [Does a security tool's audit log help with IT general controls?](https://netsenx.com/en/faq/does-a-security-tools-audit-log-help-with-it-general-controls)
- [How do we prove who changed a security setting, and when?](https://netsenx.com/en/faq/how-do-we-prove-who-changed-a-security-setting)
- [How do we show an auditor which parts of our network are monitored?](https://netsenx.com/en/faq/how-do-we-show-an-auditor-which-parts-of-the-network-are-monitored)
- [What does network detection miss if a segment is not mirrored?](https://netsenx.com/en/faq/what-does-network-detection-miss-if-a-segment-is-not-mirrored)
- [What should an incident log contain for a NIS2 audit?](https://netsenx.com/en/faq/what-should-an-incident-log-contain-for-a-nis2-audit)
- [How do we show an auditor what we decided on each security alert?](https://netsenx.com/en/faq/how-do-we-show-an-auditor-what-we-decided-on-each-alert)
- [How long must we keep security incident records?](https://netsenx.com/en/faq/how-long-must-we-keep-security-incident-records)
- [Can a network map be generated automatically from traffic for an auditor?](https://netsenx.com/en/faq/can-a-network-map-be-generated-automatically-for-an-auditor)
- [Must we document data breaches that we decide not to report?](https://netsenx.com/en/faq/must-we-document-data-breaches-we-do-not-report)
- [When must we tell the affected people about a data breach?](https://netsenx.com/en/faq/when-must-we-tell-affected-people-about-a-data-breach)

## [Germany: BSIG](https://netsenx.com/en/faq/germany) ([Markdown](https://netsenx.com/en/faq/germany.md))

15 questions

- [Where are NIS2 incidents reported in Germany?](https://netsenx.com/en/faq/where-are-nis2-incidents-reported-in-germany)
- [When must German companies register with the BSI?](https://netsenx.com/en/faq/when-must-german-companies-register-with-the-bsi)
- [Which German companies fall under the new BSIG?](https://netsenx.com/en/faq/which-german-companies-fall-under-the-bsig)
- [What is the difference between a particularly important and an important entity in Germany?](https://netsenx.com/en/faq/what-is-a-particularly-important-entity-in-germany)
- [Why does the BSI registration ask for our public IP address ranges?](https://netsenx.com/en/faq/why-does-bsi-registration-ask-for-public-ip-ranges)
- [What happens if we do not register with the BSI?](https://netsenx.com/en/faq/what-happens-if-we-do-not-register-with-the-bsi)
- [What is a system for attack detection (System zur Angriffserkennung) under the BSIG?](https://netsenx.com/en/faq/what-is-a-system-for-attack-detection-under-the-bsig)
- [Does the duty to use attack detection apply to SMEs in Germany?](https://netsenx.com/en/faq/does-the-attack-detection-duty-apply-to-smes-in-germany)
- [What does section 30 of the BSIG require from German companies in scope?](https://netsenx.com/en/faq/what-does-section-30-bsig-require)
- [What are the fines under the German BSIG?](https://netsenx.com/en/faq/what-are-the-fines-under-the-bsig)
- [Are managing directors personally liable under the German BSIG?](https://netsenx.com/en/faq/are-german-managing-directors-liable-under-the-bsig)
- [Must management in Germany attend cyber security training under the BSIG?](https://netsenx.com/en/faq/must-german-management-attend-cyber-security-training)
- [What does the BSI do after we submit an incident report?](https://netsenx.com/en/faq/what-does-the-bsi-do-after-we-submit-a-report)
- [Do banks and other DORA financial entities in Germany follow the BSIG duties?](https://netsenx.com/en/faq/do-dora-financial-entities-follow-the-bsig-duties)
- [Can the BSI audit our company?](https://netsenx.com/en/faq/can-the-bsi-audit-our-company)

## [Cyber insurance](https://netsenx.com/en/faq/insurance) ([Markdown](https://netsenx.com/en/faq/insurance.md))

20 questions

- [Will cyber insurance pay for a ransomware attack?](https://netsenx.com/en/faq/will-cyber-insurance-pay-for-ransomware)
- [Can network logs help a cyber insurance claim?](https://netsenx.com/en/faq/can-network-logs-help-a-cyber-insurance-claim)
- [We bought a security tool but nobody watched the alerts. Does that affect cover?](https://netsenx.com/en/faq/does-an-unwatched-security-tool-affect-insurance-cover)
- [Why do cyber insurance claims get denied?](https://netsenx.com/en/faq/why-do-cyber-insurance-claims-get-denied)
- [What evidence does a cyber insurer need to pay a claim?](https://netsenx.com/en/faq/what-evidence-does-a-cyber-insurer-need-to-pay-a-claim)
- [Does our cyber insurer choose the incident response firm?](https://netsenx.com/en/faq/does-the-insurer-choose-the-incident-response-firm)
- [What security controls do cyber insurers usually require?](https://netsenx.com/en/faq/what-security-controls-do-cyber-insurers-require)
- [Is multi-factor authentication mandatory for cyber insurance?](https://netsenx.com/en/faq/is-mfa-mandatory-for-cyber-insurance)
- [Do cyber insurers require endpoint detection and response on every device?](https://netsenx.com/en/faq/do-insurers-require-edr-on-every-endpoint)
- [What do cyber insurers ask about ransomware protection?](https://netsenx.com/en/faq/what-do-insurers-ask-about-ransomware)
- [Why was our cyber insurance renewal declined or made more expensive?](https://netsenx.com/en/faq/why-was-our-cyber-insurance-renewal-denied)
- [Do cyber insurers require round-the-clock security monitoring?](https://netsenx.com/en/faq/do-insurers-require-24-7-monitoring)
- [Does automated alerting count as 24/7 monitoring for an insurer?](https://netsenx.com/en/faq/does-automated-alerting-count-as-24-7-monitoring)
- [Can our managed service provider run NetSenX so we can answer yes on 24/7 monitoring?](https://netsenx.com/en/faq/can-an-msp-run-netsenx-so-we-can-answer-yes-to-24-7)
- [What should a monitoring contract say if our insurer asks about a SOC or response times?](https://netsenx.com/en/faq/do-insurers-ask-for-a-soc-contract-or-monitoring-sla)
- [What does an insurer mean when it asks whether we monitor our network?](https://netsenx.com/en/faq/what-does-an-insurer-mean-by-network-monitoring)
- [What proof of network monitoring can we show an insurer?](https://netsenx.com/en/faq/what-proof-of-network-monitoring-do-insurers-accept)
- [Can we use NetSenX reports as evidence for our cyber insurer?](https://netsenx.com/en/faq/can-we-use-netsenx-reports-as-evidence-for-our-insurer)
- [Can network detection lower our cyber insurance premium?](https://netsenx.com/en/faq/can-network-detection-lower-our-cyber-insurance-premium)
- [Does directors and officers insurance cover NIS2 fines or management liability?](https://netsenx.com/en/faq/do-nis2-fines-for-managers-fall-under-d-and-o-insurance)

## [Budget, staff and alert noise](https://netsenx.com/en/faq/budget) ([Markdown](https://netsenx.com/en/faq/budget.md))

25 questions

- [How much should a small business spend on cyber security?](https://netsenx.com/en/faq/how-much-should-a-small-business-spend-on-cyber-security)
- [What security spending should a small company never cut?](https://netsenx.com/en/faq/what-security-spending-should-a-small-company-never-cut)
- [How do I calculate the cost of one day of IT downtime?](https://netsenx.com/en/faq/how-to-calculate-the-cost-of-one-day-of-it-downtime)
- [How do I justify a security tool to management?](https://netsenx.com/en/faq/how-to-justify-a-security-tool-to-management)
- [How much does network detection and response cost for a 50-person company?](https://netsenx.com/en/faq/how-much-does-ndr-cost-for-a-50-person-company)
- [How much does NDR cost for a 200-person company?](https://netsenx.com/en/faq/how-much-does-ndr-cost-for-a-200-person-company)
- [Why don't security vendors publish prices?](https://netsenx.com/en/faq/why-dont-security-vendors-publish-prices)
- [Why does the price jump when we add sites, segments or modules?](https://netsenx.com/en/faq/why-does-the-price-jump-when-we-add-sites-or-modules)
- [What is the total cost of ownership of NDR?](https://netsenx.com/en/faq/what-is-the-total-cost-of-ownership-of-ndr)
- [How much does MDR cost?](https://netsenx.com/en/faq/how-much-does-mdr-cost)
- [Is network detection cheaper than hiring a security analyst?](https://netsenx.com/en/faq/is-network-detection-cheaper-than-hiring-a-security-analyst)
- [What can a security tool do that a part-time admin cannot, and the other way round?](https://netsenx.com/en/faq/what-can-a-security-tool-do-that-a-part-time-admin-cannot)
- [Is there a free plan?](https://netsenx.com/en/faq/is-there-a-free-plan)
- [Is there a free trial?](https://netsenx.com/en/faq/is-there-a-free-trial)
- [Is annual billing cheaper than monthly, and can we cancel?](https://netsenx.com/en/faq/is-annual-billing-cheaper-and-can-we-cancel)
- [Is there a non-profit or academic discount?](https://netsenx.com/en/faq/is-there-a-non-profit-or-academic-discount)
- [What payment methods do you accept?](https://netsenx.com/en/faq/what-payment-methods-do-you-accept)
- [Can I get an invoice instead of card billing?](https://netsenx.com/en/faq/can-i-get-an-invoice-instead-of-card-billing)
- [What is alert fatigue, and how do small teams deal with it?](https://netsenx.com/en/faq/what-is-alert-fatigue)
- [How many security alerts per day is normal?](https://netsenx.com/en/faq/how-many-security-alerts-per-day-is-normal)
- [What should every security alert include?](https://netsenx.com/en/faq/what-should-every-security-alert-include)
- [What is a realistic false-positive rate for NDR?](https://netsenx.com/en/faq/what-is-a-realistic-false-positive-rate)
- [We get too many false positives. How do we tune without missing real attacks?](https://netsenx.com/en/faq/how-to-tune-false-positives-without-missing-real-attacks)
- [How long until a new security tool stops being noisy?](https://netsenx.com/en/faq/how-long-until-a-new-security-tool-is-quiet)
- [How much time does a small team need to run NDR?](https://netsenx.com/en/faq/how-much-time-does-a-small-team-need-to-run-ndr)

## [MSPs and MSSPs](https://netsenx.com/en/faq/msp) ([Markdown](https://netsenx.com/en/faq/msp.md))

35 questions

- [What is the difference between an MSP and an MSSP?](https://netsenx.com/en/faq/what-is-the-difference-between-an-msp-and-an-mssp)
- [Can an MSP use NetSenX for several customers?](https://netsenx.com/en/faq/can-an-msp-use-netsenx-for-several-customers)
- [Can an MSP manage many client networks in one NetSenX account?](https://netsenx.com/en/faq/can-an-msp-manage-many-client-networks-in-one-netsenx-account)
- [How are MSP clients kept separate in a multi-tenant security tool?](https://netsenx.com/en/faq/how-are-msp-clients-kept-separate-in-a-multi-tenant-security-tool)
- [Does NetSenX have a partner programme for MSPs and resellers?](https://netsenx.com/en/faq/does-netsenx-have-a-partner-programme-for-msps)
- [Can an MSP white-label detection reports?](https://netsenx.com/en/faq/can-an-msp-white-label-detection-reports)
- [Can an MSP generate PDF security reports for each client?](https://netsenx.com/en/faq/can-an-msp-generate-pdf-security-reports-for-each-client)
- [Per-device or per-site pricing: which works better for an MSP with small clients?](https://netsenx.com/en/faq/per-device-or-per-site-pricing-for-an-msp)
- [How can an MSP monitor very small clients profitably?](https://netsenx.com/en/faq/how-can-an-msp-monitor-very-small-clients-profitably)
- [Can MSP clients start on the Free plan and upgrade later?](https://netsenx.com/en/faq/can-msp-clients-start-on-the-free-plan-and-upgrade-later)
- [Which security stack suits an MSP with many small clients?](https://netsenx.com/en/faq/which-security-stack-suits-an-msp-with-many-small-clients)
- [How can an MSP turn security monitoring into a recurring service?](https://netsenx.com/en/faq/how-can-an-msp-turn-security-monitoring-into-a-recurring-service)
- [How can an MSP discover all devices on a new client's network, and how quickly?](https://netsenx.com/en/faq/how-can-an-msp-discover-all-devices-on-a-new-clients-network)
- [What should an MSP check on a new client's network in the first week?](https://netsenx.com/en/faq/what-should-an-msp-check-on-a-new-clients-network-in-the-first-week)
- [How does an MSP get alerted when a client network shows signs of attack?](https://netsenx.com/en/faq/how-does-an-msp-get-alerted-when-a-client-network-shows-signs-of-attack)
- [Can an MSP receive client alerts in Slack or through a webhook?](https://netsenx.com/en/faq/can-an-msp-receive-client-alerts-in-slack-or-through-a-webhook)
- [What should an MSP tell a client after a security alert?](https://netsenx.com/en/faq/what-should-an-msp-tell-a-client-after-a-security-alert)
- [My MSP client got hacked. What do I do first?](https://netsenx.com/en/faq/my-msp-client-got-hacked-what-do-i-do-first)
- [Can an attacker pivot from a client network into the MSP's tools?](https://netsenx.com/en/faq/can-an-attacker-pivot-from-a-client-into-the-msps-tools)
- [How do we detect misuse of our RMM tool in client networks?](https://netsenx.com/en/faq/how-to-detect-misuse-of-an-rmm-tool-in-client-networks)
- [What should an MSP monitor to detect a compromise of its own tools?](https://netsenx.com/en/faq/what-should-an-msp-monitor-to-detect-a-compromise-of-its-own-tools)
- [How can an MSP add night and weekend coverage for clients without hiring?](https://netsenx.com/en/faq/how-can-an-msp-add-night-and-weekend-coverage-without-hiring)
- [What can an MSP promise clients about after-hours security monitoring?](https://netsenx.com/en/faq/what-can-an-msp-promise-about-after-hours-monitoring)
- [How should an MSP describe security monitoring in a contract without promising a SOC?](https://netsenx.com/en/faq/how-to-describe-security-monitoring-in-an-msp-contract)
- [Who is liable if a monitored client is breached?](https://netsenx.com/en/faq/who-is-liable-if-a-monitored-client-is-breached)
- [What should an MSP do if a client refuses to pay for security?](https://netsenx.com/en/faq/what-if-a-client-refuses-to-pay-for-security)
- [When my customer falls under NIS2, does the MSP fall under it too?](https://netsenx.com/en/faq/when-my-customer-falls-under-nis2-does-the-msp-too)
- [What is in a NIS2 supplier questionnaire, and how do I answer it?](https://netsenx.com/en/faq/what-is-in-a-nis2-supplier-questionnaire)
- [What NIS2 evidence can an MSP give its clients every quarter?](https://netsenx.com/en/faq/what-nis2-evidence-can-an-msp-give-clients-every-quarter)
- [How can an MSP give clients incident evidence quickly?](https://netsenx.com/en/faq/how-can-an-msp-give-clients-incident-evidence-quickly)
- [Does an EU MSP need an EU-hosted security vendor for its clients?](https://netsenx.com/en/faq/does-an-eu-msp-need-an-eu-hosted-security-vendor)
- [How can an MSP show clients which AI tools their staff use?](https://netsenx.com/en/faq/how-can-an-msp-show-clients-which-ai-tools-their-staff-use)
- [Can an MSP offer OT monitoring to small manufacturers?](https://netsenx.com/en/faq/can-an-msp-offer-ot-monitoring-to-small-manufacturers)
- [What does an MSP need to monitor a client's PLCs passively?](https://netsenx.com/en/faq/what-does-an-msp-need-to-monitor-a-clients-plcs-passively)
- [What happens to a client's security data when they change MSP, and can they export or delete it?](https://netsenx.com/en/faq/what-happens-to-a-clients-security-data-when-they-change-msp)

## [Data residency and trust](https://netsenx.com/en/faq/residency) ([Markdown](https://netsenx.com/en/faq/residency.md))

20 questions

- [How does NetSenX handle GDPR, and where is my data stored?](https://netsenx.com/en/faq/how-does-netsenx-handle-gdpr-and-where-is-my-data-stored)
- [Where is my data stored?](https://netsenx.com/en/faq/where-is-my-data-stored)
- [Can I bring my own encryption keys (BYOK)?](https://netsenx.com/en/faq/can-i-bring-my-own-encryption-keys-byok)
- [Where does NetSenX store customer data?](https://netsenx.com/en/faq/where-does-netsenx-store-customer-data)
- [Does any data leave the EU?](https://netsenx.com/en/faq/does-any-data-leave-the-eu)
- [Is EU data residency enough for GDPR?](https://netsenx.com/en/faq/is-eu-data-residency-enough-for-gdpr)
- [Can NetSenX run on-premises?](https://netsenx.com/en/faq/can-netsenx-run-on-premises)
- [Is an EU region of a US cloud provider enough for data residency?](https://netsenx.com/en/faq/is-an-eu-region-of-a-us-cloud-enough-for-data-residency)
- [Does a network sensor send packet contents to the cloud?](https://netsenx.com/en/faq/does-a-network-sensor-send-packet-contents-to-the-cloud)
- [Can I get my data out when leaving a security vendor?](https://netsenx.com/en/faq/can-i-get-my-data-out-when-leaving-a-security-vendor)
- [What is the difference between data residency and data sovereignty?](https://netsenx.com/en/faq/data-residency-vs-data-sovereignty)
- [After the Schrems II ruling, can we still use security tools from US companies?](https://netsenx.com/en/faq/after-schrems-ii-can-we-use-us-security-tools)
- [Do a vendor’s data residency promises also cover logs, backups and support data?](https://netsenx.com/en/faq/are-admin-and-audit-logs-covered-by-residency-promises)
- [Which questions should we ask a security vendor about its sub-processors?](https://netsenx.com/en/faq/which-questions-to-ask-a-security-vendor-about-sub-processors)
- [Does a network monitoring service need a data processing agreement?](https://netsenx.com/en/faq/does-network-monitoring-need-a-data-processing-agreement)
- [Is the NetSenX data processing agreement public, and what does it commit to?](https://netsenx.com/en/faq/is-the-netsenx-dpa-public)
- [Where does NetSenX store data about our employees’ devices, and for how long?](https://netsenx.com/en/faq/where-does-netsenx-store-data-about-employees-devices)
- [Do we need a data protection impact assessment before deploying network monitoring?](https://netsenx.com/en/faq/do-we-need-a-dpia-before-deploying-network-monitoring)
- [Is a smaller European security vendor a business continuity risk?](https://netsenx.com/en/faq/is-a-smaller-eu-vendor-a-continuity-risk)
- [What is the US CLOUD Act, and does it affect data stored in the EU?](https://netsenx.com/en/faq/what-is-the-us-cloud-act-and-does-it-affect-eu-data)

## [NetSenX: plans and set-up](https://netsenx.com/en/faq/product) ([Markdown](https://netsenx.com/en/faq/product.md))

20 questions

- [What does each NetSenX plan include?](https://netsenx.com/en/faq/what-does-each-netsenx-plan-include)
- [How is NetSenX deployed?](https://netsenx.com/en/faq/how-is-netsenx-deployed)
- [Do I need to install anything?](https://netsenx.com/en/faq/do-i-need-to-install-anything)
- [Which operating systems does the NetSenX agent run on?](https://netsenx.com/en/faq/which-operating-systems-does-the-netsenx-agent-run-on)
- [Does the NetSenX agent slow down our servers?](https://netsenx.com/en/faq/does-the-netsenx-agent-slow-down-servers)
- [What is the difference between the basic macOS mode and packet capture?](https://netsenx.com/en/faq/what-is-the-difference-between-the-basic-macos-mode-and-packet-capture)
- [How do I turn on the NetSenX crypto inventory (NQCI)?](https://netsenx.com/en/faq/how-do-i-turn-on-the-netsenx-crypto-inventory)
- [Does NetSenX alert from the first day after installation?](https://netsenx.com/en/faq/does-netsenx-alert-from-the-first-day)
- [What is the network map in NetSenX?](https://netsenx.com/en/faq/what-is-the-netsenx-network-map)
- [How are NetSenX alerts delivered?](https://netsenx.com/en/faq/how-are-netsenx-alerts-delivered)
- [How long does NetSenX keep alert history?](https://netsenx.com/en/faq/how-long-does-netsenx-keep-alert-history)
- [Does NetSenX detect DNS tunnelling on every plan?](https://netsenx.com/en/faq/does-netsenx-detect-dns-tunnelling-on-every-plan)
- [How do I stop backup jobs from triggering security alerts?](https://netsenx.com/en/faq/how-to-stop-backup-jobs-from-triggering-security-alerts)
- [What does a false-positive bound mean for a small IT team?](https://netsenx.com/en/faq/what-does-a-false-positive-bound-mean-for-a-small-it-team)
- [What is the NetSenX Math Guarantee?](https://netsenx.com/en/faq/what-is-the-netsenx-math-guarantee)
- [What exactly does the NetSenX Math Guarantee guarantee?](https://netsenx.com/en/faq/what-exactly-does-the-netsenx-math-guarantee-guarantee)
- [Does NetSenX offer a 24/7 monitoring service?](https://netsenx.com/en/faq/does-netsenx-offer-a-24-7-monitoring-service)
- [What does NetSenX not do?](https://netsenx.com/en/faq/what-does-netsenx-not-do)
- [What is included in the Triple Crown audit pack?](https://netsenx.com/en/faq/what-is-included-in-the-triple-crown-audit-pack)
- [Can I migrate from a legacy NDR (Vectra, Darktrace, etc.)?](https://netsenx.com/en/faq/can-i-migrate-from-a-legacy-ndr-vectra-darktrace-etc)

## [For the board and finance](https://netsenx.com/en/faq/board) ([Markdown](https://netsenx.com/en/faq/board.md))

40 questions

- [How do I answer the board when they ask if we have been hacked?](https://netsenx.com/en/faq/how-do-i-answer-the-board-when-asked-if-we-have-been-hacked)
- [Can any tool prove that a company is not hacked?](https://netsenx.com/en/faq/can-any-tool-prove-that-a-company-is-not-hacked)
- [What can a network sensor tell the board that antivirus cannot?](https://netsenx.com/en/faq/what-can-a-network-sensor-tell-the-board-that-antivirus-cannot)
- [What security evidence does a buyer ask for in due diligence?](https://netsenx.com/en/faq/what-security-evidence-does-a-buyer-ask-for-in-due-diligence)
- [How far back can NetSenX show alerts?](https://netsenx.com/en/faq/how-far-back-can-netsenx-show-alerts)
- [Can we export an incident log for a buyer or investor?](https://netsenx.com/en/faq/can-we-export-an-incident-log-for-a-buyer-or-investor)
- [What cyber metrics should a board see every quarter?](https://netsenx.com/en/faq/what-cyber-metrics-should-a-board-see-every-quarter)
- [Is a single cyber risk score meaningful for a small company?](https://netsenx.com/en/faq/is-a-single-cyber-risk-score-meaningful)
- [How do I report network security to the board without jargon?](https://netsenx.com/en/faq/how-do-i-report-network-security-to-the-board-without-jargon)
- [What cyber security evidence do investors ask a small company for?](https://netsenx.com/en/faq/what-cyber-evidence-do-investors-ask-a-small-company-for)
- [Is network monitoring expected in investor due diligence?](https://netsenx.com/en/faq/is-network-monitoring-expected-in-investor-due-diligence)
- [Can a 30-person company show investors it monitors for intrusions?](https://netsenx.com/en/faq/can-a-30-person-company-show-investors-it-monitors-for-intrusions)
- [How should we answer a customer who asks whether we have had a security incident?](https://netsenx.com/en/faq/how-should-we-answer-have-you-had-a-security-incident)
- [Is it better to disclose past security incidents to customers?](https://netsenx.com/en/faq/is-it-better-to-disclose-past-incidents-to-customers)
- [What records do we need to answer questions about past incidents?](https://netsenx.com/en/faq/what-records-do-we-need-to-answer-questions-about-past-incidents)
- [What should the board know about the cost of IT downtime?](https://netsenx.com/en/faq/what-should-the-board-know-about-the-cost-of-downtime)
- [What questions should the board ask the IT manager about security?](https://netsenx.com/en/faq/what-questions-should-the-board-ask-the-it-manager)
- [What should cyber security training for the board cover?](https://netsenx.com/en/faq/what-should-cyber-security-training-for-the-board-cover)
- [Who should own cyber security in a small company?](https://netsenx.com/en/faq/who-should-own-cyber-security-in-a-small-company)
- [What should the CEO do in the first hour of a cyber incident?](https://netsenx.com/en/faq/what-should-the-ceo-do-in-the-first-hour-of-a-cyber-incident)
- [Who in the company should decide on a ransom demand?](https://netsenx.com/en/faq/who-should-decide-on-a-ransom-demand)
- [Which payment controls stop invoice fraud and fake CEO requests?](https://netsenx.com/en/faq/which-payment-controls-stop-invoice-and-ceo-fraud)
- [Should cyber risk be in the company risk register?](https://netsenx.com/en/faq/should-cyber-risk-be-in-the-company-risk-register)
- [How should the board approve a cyber security budget?](https://netsenx.com/en/faq/how-should-the-board-approve-a-cyber-security-budget)
- [What is the difference between a security alert and an incident?](https://netsenx.com/en/faq/what-is-the-difference-between-a-security-alert-and-an-incident)
- [How does a cyber incident affect the sale of a company?](https://netsenx.com/en/faq/how-does-a-cyber-incident-affect-the-sale-of-a-company)
- [What is cyber risk appetite, and why should the board set it?](https://netsenx.com/en/faq/what-is-cyber-risk-appetite)
- [Should the board get cyber security reports from IT or from outside?](https://netsenx.com/en/faq/should-the-board-get-cyber-reports-from-it-or-from-outside)
- [How do we know our IT provider is doing a good job on security?](https://netsenx.com/en/faq/how-do-we-know-our-it-provider-is-doing-a-good-job-on-security)
- [Who should sign off answers to customer security questionnaires?](https://netsenx.com/en/faq/who-should-sign-off-answers-to-customer-security-questionnaires)
- [How do we explain a cyber incident to customers and the press?](https://netsenx.com/en/faq/how-do-we-explain-a-cyber-incident-to-customers-and-the-press)
- [Should we tell employees about a cyber incident?](https://netsenx.com/en/faq/should-we-tell-employees-about-a-cyber-incident)
- [What is a tabletop exercise, and should the board take part?](https://netsenx.com/en/faq/what-is-a-tabletop-exercise-and-should-the-board-take-part)
- [How do cyber incidents affect our customer contracts?](https://netsenx.com/en/faq/how-do-cyber-incidents-affect-customer-contracts)
- [Does a small company need a chief information security officer?](https://netsenx.com/en/faq/does-a-small-company-need-a-ciso)
- [How can the company keep running during a cyber attack?](https://netsenx.com/en/faq/how-can-the-company-keep-running-during-a-cyber-attack)
- [What should the board ask before buying a security tool?](https://netsenx.com/en/faq/what-should-the-board-ask-before-buying-a-security-tool)
- [What cyber security questions should a finance director ask?](https://netsenx.com/en/faq/what-cyber-security-questions-should-a-finance-director-ask)
- [How often should the board discuss cyber security?](https://netsenx.com/en/faq/how-often-should-the-board-discuss-cyber-security)
- [How do we check a key supplier before giving it access to our systems?](https://netsenx.com/en/faq/how-do-we-check-a-key-supplier-before-giving-it-access)

## [People, HR and insider risk](https://netsenx.com/en/faq/people) ([Markdown](https://netsenx.com/en/faq/people.md))

40 questions

- [How do we know a former employee's device is no longer on our network?](https://netsenx.com/en/faq/how-do-we-know-a-former-employees-device-is-no-longer-on-our-network)
- [What should IT check on the network when an employee leaves?](https://netsenx.com/en/faq/what-should-it-check-on-the-network-when-an-employee-leaves)
- [Can we see when an unreturned company laptop connects again?](https://netsenx.com/en/faq/can-we-see-when-an-unreturned-company-laptop-connects-again)
- [Can we see if a leaving employee uploads company data to the cloud?](https://netsenx.com/en/faq/can-we-see-if-a-leaving-employee-uploads-company-data)
- [What evidence is lawful to collect when an employee leaves for a competitor?](https://netsenx.com/en/faq/what-evidence-is-lawful-to-collect-when-an-employee-leaves-for-a-competitor)
- [Does network monitoring show which files an employee took?](https://netsenx.com/en/faq/does-network-monitoring-show-which-files-an-employee-took)
- [Does network monitoring read employees' e-mails or messages?](https://netsenx.com/en/faq/does-network-monitoring-read-employees-e-mails-or-messages)
- [What does a network sensor record about employees?](https://netsenx.com/en/faq/what-does-a-network-sensor-record-about-employees)
- [Do we need works council approval for network security monitoring?](https://netsenx.com/en/faq/do-we-need-works-council-approval-for-network-security-monitoring)
- [How do we see personal devices connected to the office network?](https://netsenx.com/en/faq/how-do-we-see-personal-devices-connected-to-the-office-network)
- [Is it risky to let new employees use personal laptops on the company network?](https://netsenx.com/en/faq/is-it-risky-to-let-new-employees-use-personal-laptops-at-work)
- [Can we get a list of every device that joined the office network this month?](https://netsenx.com/en/faq/can-we-list-every-device-that-joined-the-office-network-this-month)
- [How can we tell if a remote employee's laptop connects through anonymising services?](https://netsenx.com/en/faq/how-can-we-tell-if-a-remote-laptop-connects-through-anonymising-services)
- [What are the security risks of hiring remote workers we have never met?](https://netsenx.com/en/faq/what-are-the-security-risks-of-hiring-remote-workers-we-have-never-met)
- [Should we monitor the home networks of remote employees?](https://netsenx.com/en/faq/should-we-monitor-the-home-networks-of-remote-employees)
- [How do we know if the payroll server is reached from an unusual computer?](https://netsenx.com/en/faq/how-do-we-know-if-the-payroll-server-is-reached-from-an-unusual-computer)
- [Which servers hold the most sensitive employee data, and how do we watch them?](https://netsenx.com/en/faq/which-servers-hold-the-most-sensitive-employee-data)
- [How should HR and IT handle a security alert that involves an employee's device?](https://netsenx.com/en/faq/how-should-hr-and-it-handle-an-alert-involving-an-employees-device)
- [Can a network security tool be used for employee investigations?](https://netsenx.com/en/faq/can-a-network-security-tool-be-used-for-employee-investigations)
- [Is it legal in the EU to use network logs in a disciplinary case?](https://netsenx.com/en/faq/is-it-legal-to-use-network-logs-in-a-disciplinary-case)
- [How do we keep network security monitoring from becoming employee surveillance?](https://netsenx.com/en/faq/how-do-we-keep-security-monitoring-from-becoming-employee-surveillance)
- [Can an unused office computer be used by attackers?](https://netsenx.com/en/faq/can-an-unused-office-computer-be-used-by-attackers)
- [How do we spot activity on a computer that should be idle?](https://netsenx.com/en/faq/how-do-we-spot-activity-on-a-computer-that-should-be-idle)
- [What should IT do with the computers of employees on long-term leave?](https://netsenx.com/en/faq/what-should-it-do-with-computers-of-employees-on-long-term-leave)
- [How do we monitor contractors' laptops on our network?](https://netsenx.com/en/faq/how-do-we-monitor-contractors-laptops-on-our-network)
- [Should contractors get a separate network?](https://netsenx.com/en/faq/should-contractors-get-a-separate-network)
- [Can we see when a contractor's laptop stops connecting after the project ends?](https://netsenx.com/en/faq/can-we-see-when-a-contractors-laptop-stops-connecting)
- [Can network monitoring detect data copied to a USB stick?](https://netsenx.com/en/faq/can-network-monitoring-detect-data-copied-to-a-usb-stick)
- [Which tool stops employees copying files to USB drives?](https://netsenx.com/en/faq/which-tool-stops-employees-copying-files-to-usb-drives)
- [What can network monitoring see when copied files are uploaded later?](https://netsenx.com/en/faq/what-can-network-monitoring-see-when-copied-files-are-uploaded-later)
- [Can we limit who sees security alerts about sensitive departments?](https://netsenx.com/en/faq/can-we-limit-who-sees-security-alerts-about-sensitive-departments)
- [Does NetSenX log who looked at or changed an alert?](https://netsenx.com/en/faq/does-netsenx-log-who-changed-an-alert)
- [Does NetSenX support two-factor authentication for every user?](https://netsenx.com/en/faq/does-netsenx-support-two-factor-authentication-for-every-user)
- [What should employees be told about network security monitoring?](https://netsenx.com/en/faq/what-should-employees-be-told-about-network-security-monitoring)
- [Can HR find out from NetSenX which employee used an AI tool?](https://netsenx.com/en/faq/can-hr-find-out-which-employee-used-an-ai-tool)
- [What is insider risk, and how is it different from an outside attack?](https://netsenx.com/en/faq/what-is-insider-risk)
- [Can employees see what the security tool records about their device?](https://netsenx.com/en/faq/can-employees-see-what-the-security-tool-records-about-their-device)
- [What should an acceptable use policy say about security monitoring?](https://netsenx.com/en/faq/what-should-an-acceptable-use-policy-say-about-monitoring)
- [How long should security logs about employee devices be kept?](https://netsenx.com/en/faq/how-long-should-security-logs-about-employee-devices-be-kept)
- [Is AI-based emotion or productivity monitoring of staff allowed in the EU?](https://netsenx.com/en/faq/is-emotion-or-productivity-monitoring-of-staff-allowed)

## [What is…? Network and security terms](https://netsenx.com/en/faq/glossary) ([Markdown](https://netsenx.com/en/faq/glossary.md))

69 questions

- [What is a firewall?](https://netsenx.com/en/faq/what-is-a-firewall)
- [What is a router?](https://netsenx.com/en/faq/what-is-a-router)
- [What is a network switch?](https://netsenx.com/en/faq/what-is-a-network-switch)
- [What is a VLAN?](https://netsenx.com/en/faq/what-is-a-vlan)
- [What is an IP address?](https://netsenx.com/en/faq/what-is-an-ip-address)
- [What is a MAC address?](https://netsenx.com/en/faq/what-is-a-mac-address)
- [What is DHCP?](https://netsenx.com/en/faq/what-is-dhcp)
- [What is DNS?](https://netsenx.com/en/faq/what-is-dns)
- [What is NAT (network address translation)?](https://netsenx.com/en/faq/what-is-nat-network-address-translation)
- [What is a network port?](https://netsenx.com/en/faq/what-is-a-network-port)
- [What is a network packet?](https://netsenx.com/en/faq/what-is-a-network-packet)
- [What is a network protocol?](https://netsenx.com/en/faq/what-is-a-network-protocol)
- [What is a subnet?](https://netsenx.com/en/faq/what-is-a-subnet)
- [What is a LAN, and what is a WAN?](https://netsenx.com/en/faq/what-is-a-lan-and-a-wan)
- [What is a proxy server?](https://netsenx.com/en/faq/what-is-a-proxy-server)
- [What is a network TAP?](https://netsenx.com/en/faq/what-is-a-network-tap)
- [What is NetFlow, or flow data?](https://netsenx.com/en/faq/what-is-netflow-and-flow-data)
- [What is ARP, and what is ARP spoofing?](https://netsenx.com/en/faq/what-is-arp-and-arp-spoofing)
- [What are TCP and UDP?](https://netsenx.com/en/faq/what-is-tcp-and-udp)
- [What are ICMP and ping?](https://netsenx.com/en/faq/what-is-icmp-and-ping)
- [What is SMB, the file-sharing protocol?](https://netsenx.com/en/faq/what-is-the-smb-file-sharing-protocol)
- [What is a domain controller?](https://netsenx.com/en/faq/what-is-a-domain-controller)
- [What is NTP, and why does correct time matter for security?](https://netsenx.com/en/faq/what-is-ntp-and-why-does-time-matter-for-security)
- [What is syslog?](https://netsenx.com/en/faq/what-is-syslog)
- [What is SNMP?](https://netsenx.com/en/faq/what-is-snmp)
- [What is an endpoint?](https://netsenx.com/en/faq/what-is-an-endpoint)
- [What is a host in networking?](https://netsenx.com/en/faq/what-is-a-host-in-networking)
- [What is a DMZ in networking?](https://netsenx.com/en/faq/what-is-a-dmz-in-networking)
- [What are egress and ingress traffic?](https://netsenx.com/en/faq/what-is-egress-and-ingress-traffic)
- [What are east-west and north-south traffic?](https://netsenx.com/en/faq/what-is-east-west-and-north-south-traffic)
- [What are bandwidth and latency?](https://netsenx.com/en/faq/what-is-bandwidth-and-latency)
- [What are WPA2 and WPA3?](https://netsenx.com/en/faq/what-is-wpa2-and-wpa3)
- [What is an API?](https://netsenx.com/en/faq/what-is-an-api)
- [What is single sign-on (SSO)?](https://netsenx.com/en/faq/what-is-single-sign-on-sso)
- [What is NAC (network access control)?](https://netsenx.com/en/faq/what-is-nac-network-access-control)
- [What is malware?](https://netsenx.com/en/faq/what-is-malware)
- [What is the difference between a virus, a worm and a trojan?](https://netsenx.com/en/faq/what-is-the-difference-between-a-virus-a-worm-and-a-trojan)
- [What is a DDoS attack?](https://netsenx.com/en/faq/what-is-a-ddos-attack)
- [What is a brute-force attack?](https://netsenx.com/en/faq/what-is-a-brute-force-attack)
- [What is a port scan?](https://netsenx.com/en/faq/what-is-a-port-scan)
- [What is a man-in-the-middle attack?](https://netsenx.com/en/faq/what-is-a-man-in-the-middle-attack)
- [What is a vulnerability in IT security?](https://netsenx.com/en/faq/what-is-a-vulnerability)
- [What is an exploit?](https://netsenx.com/en/faq/what-is-an-exploit)
- [What is a security patch?](https://netsenx.com/en/faq/what-is-a-security-patch)
- [What is a CVE?](https://netsenx.com/en/faq/what-is-a-cve)
- [What is a CVSS score?](https://netsenx.com/en/faq/what-is-a-cvss-score)
- [What is a zero-day vulnerability?](https://netsenx.com/en/faq/what-is-a-zero-day)
- [What are TTPs?](https://netsenx.com/en/faq/what-are-ttps)
- [What is threat intelligence?](https://netsenx.com/en/faq/what-is-threat-intelligence)
- [What is an attack surface?](https://netsenx.com/en/faq/what-is-an-attack-surface)
- [What is a threat actor?](https://netsenx.com/en/faq/what-is-a-threat-actor)
- [What is an APT (advanced persistent threat)?](https://netsenx.com/en/faq/what-is-an-apt)
- [What are false positives and false negatives?](https://netsenx.com/en/faq/what-are-false-positives-and-false-negatives)
- [What is a SOC (security operations centre)?](https://netsenx.com/en/faq/what-is-a-soc-security-operations-centre)
- [What is a CSIRT or CERT?](https://netsenx.com/en/faq/what-is-a-csirt-or-cert)
- [What is a penetration test?](https://netsenx.com/en/faq/what-is-a-penetration-test)
- [What are red teams and blue teams?](https://netsenx.com/en/faq/what-are-red-teams-and-blue-teams)
- [What is a vulnerability scan?](https://netsenx.com/en/faq/what-is-a-vulnerability-scan)
- [What is a honeypot in cybersecurity?](https://netsenx.com/en/faq/what-is-a-honeypot)
- [What is a sandbox in security?](https://netsenx.com/en/faq/what-is-a-sandbox-in-security)
- [What are allowlists and denylists?](https://netsenx.com/en/faq/what-are-allowlists-and-denylists)
- [What are IDS and IPS?](https://netsenx.com/en/faq/what-are-ids-and-ips)
- [What is SOAR?](https://netsenx.com/en/faq/what-is-soar)
- [What is DLP (data loss prevention)?](https://netsenx.com/en/faq/what-is-dlp-data-loss-prevention)
- [What is an audit log?](https://netsenx.com/en/faq/what-is-an-audit-log)
- [What is dwell time in cybersecurity?](https://netsenx.com/en/faq/what-is-dwell-time)
- [What are MTTD and MTTR?](https://netsenx.com/en/faq/what-are-mttd-and-mttr)
- [What is shadow IT?](https://netsenx.com/en/faq/what-is-shadow-it)
- [What is a data breach?](https://netsenx.com/en/faq/what-is-a-data-breach)

## [Ransomware groups and families](https://netsenx.com/en/faq/ransomware-families) ([Markdown](https://netsenx.com/en/faq/ransomware-families.md))

25 questions

- [What is the difference between a ransomware family, a group and an affiliate?](https://netsenx.com/en/faq/difference-between-a-ransomware-family-group-and-affiliate)
- [What is ransomware as a service (RaaS)?](https://netsenx.com/en/faq/what-is-ransomware-as-a-service)
- [What is double extortion in ransomware?](https://netsenx.com/en/faq/what-is-double-extortion-ransomware)
- [What is a ransomware leak site?](https://netsenx.com/en/faq/what-is-a-ransomware-leak-site)
- [Where can we find official information about ransomware groups?](https://netsenx.com/en/faq/where-to-find-official-ransomware-advisories)
- [What is No More Ransom, and can it decrypt our files?](https://netsenx.com/en/faq/what-is-no-more-ransom)
- [What does a police takedown of a ransomware group mean for victims?](https://netsenx.com/en/faq/what-does-a-ransomware-takedown-mean-for-victims)
- [Why do ransomware groups change their names?](https://netsenx.com/en/faq/why-do-ransomware-groups-rebrand)
- [How should a small company use a ransomware advisory?](https://netsenx.com/en/faq/how-a-small-company-should-use-a-ransomware-advisory)
- [What is LockBit ransomware?](https://netsenx.com/en/faq/what-is-lockbit-ransomware)
- [What is ALPHV, also called BlackCat?](https://netsenx.com/en/faq/what-is-alphv-blackcat-ransomware)
- [What is Black Basta ransomware?](https://netsenx.com/en/faq/what-is-black-basta-ransomware)
- [What is Akira ransomware?](https://netsenx.com/en/faq/what-is-akira-ransomware)
- [What is Play ransomware?](https://netsenx.com/en/faq/what-is-play-ransomware)
- [What are Royal and BlackSuit ransomware?](https://netsenx.com/en/faq/what-are-royal-and-blacksuit-ransomware)
- [What is Rhysida ransomware?](https://netsenx.com/en/faq/what-is-rhysida-ransomware)
- [What is Medusa ransomware?](https://netsenx.com/en/faq/what-is-medusa-ransomware)
- [What is RansomHub ransomware?](https://netsenx.com/en/faq/what-is-ransomhub-ransomware)
- [What is Cl0p ransomware?](https://netsenx.com/en/faq/what-is-cl0p-ransomware)
- [What is BianLian ransomware?](https://netsenx.com/en/faq/what-is-bianlian-ransomware)
- [What was Hive ransomware?](https://netsenx.com/en/faq/what-was-hive-ransomware)
- [What was Conti ransomware?](https://netsenx.com/en/faq/what-was-conti-ransomware)
- [What are Phobos and 8Base ransomware?](https://netsenx.com/en/faq/what-are-phobos-and-8base-ransomware)
- [What is Ghost, or Cring, ransomware?](https://netsenx.com/en/faq/what-is-ghost-cring-ransomware)
- [What is Interlock ransomware?](https://netsenx.com/en/faq/what-is-interlock-ransomware)

## [Phishing and e-mail aftermath](https://netsenx.com/en/faq/phishing) ([Markdown](https://netsenx.com/en/faq/phishing.md))

29 questions

- [What is phishing?](https://netsenx.com/en/faq/what-is-phishing)
- [How can you tell that an e-mail is phishing?](https://netsenx.com/en/faq/how-to-spot-a-phishing-email)
- [I clicked a phishing link. What should I do now?](https://netsenx.com/en/faq/i-clicked-a-phishing-link-what-now)
- [I entered my work password on a phishing page. What now?](https://netsenx.com/en/faq/i-entered-my-work-password-on-a-phishing-page)
- [An employee entered their password on a phishing page. What should we check on the network?](https://netsenx.com/en/faq/employee-entered-password-what-to-check-on-the-network)
- [How do you clean a computer after a phishing click?](https://netsenx.com/en/faq/how-to-clean-a-device-after-a-phishing-click)
- [After a phishing click, how do attackers get from one laptop to the rest of the network?](https://netsenx.com/en/faq/how-attackers-move-from-a-phished-laptop-to-the-network)
- [Should employees report a phishing e-mail even if they did not click it?](https://netsenx.com/en/faq/should-employees-report-phishing-they-did-not-click)
- [Does security awareness training stop phishing?](https://netsenx.com/en/faq/does-security-awareness-training-stop-phishing)
- [What is spear phishing?](https://netsenx.com/en/faq/what-is-spear-phishing)
- [What are smishing and vishing?](https://netsenx.com/en/faq/what-is-smishing-and-vishing)
- [What is QR code phishing?](https://netsenx.com/en/faq/what-is-qr-code-phishing)
- [What is business e-mail compromise (BEC)?](https://netsenx.com/en/faq/what-is-business-email-compromise)
- [Can network monitoring stop CEO fraud?](https://netsenx.com/en/faq/can-network-monitoring-stop-ceo-fraud)
- [Can a phishing e-mail come from a colleague's real account?](https://netsenx.com/en/faq/can-phishing-come-from-a-colleagues-real-account)
- [A supplier asks us to change their bank details. How do we check it is genuine?](https://netsenx.com/en/faq/supplier-asks-to-change-bank-details)
- [We paid a fraudulent invoice. What should we do now?](https://netsenx.com/en/faq/we-paid-a-fraudulent-invoice-what-now)
- [A supplier's e-mail account was hacked and they wrote to us. What should we do?](https://netsenx.com/en/faq/supplier-email-was-hacked-what-should-we-do)
- [Why can't a network security tool stop invoice fraud?](https://netsenx.com/en/faq/why-cant-a-network-tool-stop-invoice-fraud)
- [Someone is sending fake invoices in our company's name. What can we do?](https://netsenx.com/en/faq/someone-sends-fake-invoices-in-our-name)
- [How do we stop criminals sending e-mail that pretends to come from our domain?](https://netsenx.com/en/faq/how-to-stop-someone-spoofing-our-email-domain)
- [What is DMARC?](https://netsenx.com/en/faq/what-is-dmarc)
- [What is MFA fatigue?](https://netsenx.com/en/faq/what-is-mfa-fatigue)
- [Can phishing get past multi-factor authentication?](https://netsenx.com/en/faq/can-phishing-bypass-multi-factor-authentication)
- [Does a password reset end a mailbox takeover?](https://netsenx.com/en/faq/does-a-password-reset-end-a-mailbox-takeover)
- [What are deepfake CEO calls, and how do we protect against them?](https://netsenx.com/en/faq/what-are-deepfake-ceo-calls)
- [What is a fake CAPTCHA or ClickFix attack?](https://netsenx.com/en/faq/what-is-a-fake-captcha-clickfix-attack)
- [Are e-mail attachments still dangerous?](https://netsenx.com/en/faq/are-email-attachments-still-dangerous)
- [What does NetSenX see after someone clicks a phishing link?](https://netsenx.com/en/faq/what-does-netsenx-see-after-a-phishing-click)

## [Cloud and SaaS security](https://netsenx.com/en/faq/cloud) ([Markdown](https://netsenx.com/en/faq/cloud.md))

25 questions

- [What is the shared responsibility model in the cloud?](https://netsenx.com/en/faq/what-is-the-shared-responsibility-model-in-the-cloud)
- [What is the difference between IaaS, PaaS and SaaS?](https://netsenx.com/en/faq/what-is-the-difference-between-iaas-paas-and-saas)
- [Does moving to the cloud make us safer?](https://netsenx.com/en/faq/does-moving-to-the-cloud-make-us-safer)
- [What does a network sensor see of our cloud and SaaS traffic?](https://netsenx.com/en/faq/what-does-a-network-sensor-see-of-cloud-traffic)
- [Can NetSenX monitor our servers in the cloud?](https://netsenx.com/en/faq/can-netsenx-monitor-our-cloud-servers)
- [How do I tell legitimate cloud traffic from an attacker's rented server?](https://netsenx.com/en/faq/how-to-tell-legitimate-cloud-traffic-from-an-attackers-server)
- [Which of our servers connect to cheap cloud hosting providers, and why?](https://netsenx.com/en/faq/why-do-our-servers-connect-to-cheap-cloud-hosting-providers)
- [Can attackers hide command-and-control inside trusted cloud services?](https://netsenx.com/en/faq/can-attackers-use-trusted-cloud-services-for-command-and-control)
- [How do we tell a legitimate cloud sync from data theft?](https://netsenx.com/en/faq/how-to-tell-a-cloud-sync-from-data-theft)
- [Can we see if a leaving employee uploads company data to the cloud?](https://netsenx.com/en/faq/can-we-see-if-a-leaving-employee-uploads-company-data-to-the-cloud)
- [Can ransomware reach the files we keep in the cloud?](https://netsenx.com/en/faq/can-ransomware-reach-our-cloud-files)
- [Is our SaaS data backed up by the provider?](https://netsenx.com/en/faq/is-our-saas-data-backed-up-by-the-provider)
- [How do we secure our Microsoft 365 or Google Workspace accounts?](https://netsenx.com/en/faq/how-to-secure-microsoft-365-and-google-workspace-accounts)
- [What is OAuth consent phishing?](https://netsenx.com/en/faq/what-is-oauth-consent-phishing)
- [Which cloud and SaaS logs should we switch on and keep?](https://netsenx.com/en/faq/what-logs-should-we-keep-for-cloud-and-saas)
- [What happens if cloud access keys leak, for example on GitHub?](https://netsenx.com/en/faq/what-happens-if-cloud-access-keys-leak)
- [What is a misconfigured storage bucket and how do we avoid one?](https://netsenx.com/en/faq/what-is-a-misconfigured-storage-bucket)
- [What is the cloud metadata service, and why do attackers want it?](https://netsenx.com/en/faq/what-is-the-cloud-metadata-service-and-why-do-attackers-want-it)
- [How do we spot cryptomining in a compromised cloud account?](https://netsenx.com/en/faq/how-to-spot-cryptomining-in-a-compromised-cloud-account)
- [How do we find SaaS apps that nobody approved?](https://netsenx.com/en/faq/how-to-find-saas-apps-nobody-approved)
- [What are CSPM, CASB and SSPM, and do we need them?](https://netsenx.com/en/faq/what-are-cspm-casb-and-sspm)
- [What should we ask a SaaS vendor about security before signing?](https://netsenx.com/en/faq/what-should-we-ask-a-saas-vendor-about-security)
- [Who is responsible when our SaaS provider is breached?](https://netsenx.com/en/faq/who-is-responsible-when-a-saas-provider-is-breached)
- [Does NIS2 make us responsible for our cloud providers' security?](https://netsenx.com/en/faq/does-nis2-make-us-responsible-for-our-cloud-providers)
- [What do we do if a cloud or SaaS account is compromised?](https://netsenx.com/en/faq/what-to-do-if-a-cloud-account-is-compromised)

## [Backups and recovery](https://netsenx.com/en/faq/backups) ([Markdown](https://netsenx.com/en/faq/backups.md))

25 questions

- [What is the 3-2-1 backup rule?](https://netsenx.com/en/faq/what-is-the-3-2-1-backup-rule)
- [What is an immutable backup?](https://netsenx.com/en/faq/what-is-an-immutable-backup)
- [What is an offline or air-gapped backup?](https://netsenx.com/en/faq/what-is-an-offline-or-air-gapped-backup)
- [How often should we test a restore?](https://netsenx.com/en/faq/how-often-should-we-test-a-restore)
- [Do ransomware gangs go after backups first?](https://netsenx.com/en/faq/do-ransomware-gangs-go-after-backups-first)
- [Why is a backup mapped as a network drive a risk?](https://netsenx.com/en/faq/why-is-a-backup-mapped-as-a-network-drive-a-risk)
- [Which computers should be able to connect to the backup server?](https://netsenx.com/en/faq/which-computers-should-connect-to-the-backup-server)
- [Can backups be infected with ransomware?](https://netsenx.com/en/faq/can-backups-be-infected-with-ransomware)
- [How do we restore from backup safely after ransomware?](https://netsenx.com/en/faq/how-to-restore-from-backup-safely-after-ransomware)
- [In what order should systems be restored after an attack?](https://netsenx.com/en/faq/in-what-order-should-systems-be-restored)
- [What are RPO and RTO?](https://netsenx.com/en/faq/what-are-rpo-and-rto)
- [Is cloud file sync, such as OneDrive or Dropbox, a backup?](https://netsenx.com/en/faq/is-cloud-file-sync-a-backup)
- [Do we need to back up Microsoft 365 and other SaaS data?](https://netsenx.com/en/faq/do-we-need-to-back-up-microsoft-365-and-other-saas-data)
- [Should the backup system have separate admin accounts?](https://netsenx.com/en/faq/should-backup-admin-accounts-be-separate)
- [How long should we keep backups?](https://netsenx.com/en/faq/how-long-should-backups-be-kept)
- [Should backups be encrypted?](https://netsenx.com/en/faq/should-backups-be-encrypted)
- [How do we protect backup servers on the network?](https://netsenx.com/en/faq/how-to-protect-backup-servers-on-the-network)
- [What is the difference between a backup plan and a disaster recovery plan?](https://netsenx.com/en/faq/difference-between-a-backup-plan-and-a-disaster-recovery-plan)
- [How should we back up virtual machines and hypervisors?](https://netsenx.com/en/faq/how-to-back-up-virtual-machines-and-hypervisors)
- [What is isolated or clean-room recovery?](https://netsenx.com/en/faq/what-is-isolated-or-clean-room-recovery)
- [How do we know a backup is clean before restoring it?](https://netsenx.com/en/faq/how-to-know-a-backup-is-clean-before-restoring)
- [Who should be allowed to delete backups?](https://netsenx.com/en/faq/who-should-be-allowed-to-delete-backups)
- [Does NetSenX back up our data?](https://netsenx.com/en/faq/does-netsenx-back-up-our-data)
- [Should we back up the configuration of firewalls, switches and routers?](https://netsenx.com/en/faq/should-we-back-up-network-device-configurations)
- [Is a snapshot a backup?](https://netsenx.com/en/faq/is-a-snapshot-a-backup)

## [EU law: GDPR, DORA, CRA and AI Act](https://netsenx.com/en/faq/eu-law) ([Markdown](https://netsenx.com/en/faq/eu-law.md))

20 questions

- [What is the GDPR, in plain terms?](https://netsenx.com/en/faq/what-is-the-gdpr-in-plain-terms)
- [Are IP addresses personal data under the GDPR?](https://netsenx.com/en/faq/are-ip-addresses-personal-data-under-the-gdpr)
- [What counts as a personal data breach under the GDPR?](https://netsenx.com/en/faq/what-counts-as-a-personal-data-breach)
- [What is the difference between a controller and a processor under the GDPR?](https://netsenx.com/en/faq/controller-or-processor-what-is-the-difference)
- [What security measures does the GDPR actually require?](https://netsenx.com/en/faq/what-security-does-the-gdpr-require)
- [Does our company need a data protection officer?](https://netsenx.com/en/faq/do-we-need-a-data-protection-officer)
- [Can we monitor our network for security on the basis of legitimate interest?](https://netsenx.com/en/faq/can-we-monitor-the-network-under-legitimate-interest)
- [How high can GDPR fines be?](https://netsenx.com/en/faq/what-are-gdpr-fines)
- [What is DORA, in plain terms?](https://netsenx.com/en/faq/what-is-dora-in-plain-terms)
- [What does DORA require from the management of a financial entity?](https://netsenx.com/en/faq/what-does-dora-require-from-management)
- [What is the Cyber Resilience Act, in plain terms?](https://netsenx.com/en/faq/what-is-the-cyber-resilience-act)
- [Does the Cyber Resilience Act apply to software companies?](https://netsenx.com/en/faq/does-the-cra-apply-to-software-companies)
- [Does the Cyber Resilience Act apply to software as a service?](https://netsenx.com/en/faq/does-the-cra-apply-to-saas)
- [What is an SBOM, and does the Cyber Resilience Act require one?](https://netsenx.com/en/faq/what-is-an-sbom-and-does-the-cra-require-one)
- [What is the EU AI Act, in plain terms?](https://netsenx.com/en/faq/what-is-the-eu-ai-act-in-plain-terms)
- [Is AI in a security tool high-risk under the AI Act?](https://netsenx.com/en/faq/is-ai-in-security-tools-high-risk-under-the-ai-act)
- [What transparency duties does the AI Act set for chatbots and AI-generated content?](https://netsenx.com/en/faq/what-are-the-ai-act-transparency-duties)
- [What do data protection by design and by default mean under the GDPR?](https://netsenx.com/en/faq/what-is-data-protection-by-design-and-by-default)
- [What records of processing activities does the GDPR require us to keep?](https://netsenx.com/en/faq/what-records-of-processing-must-we-keep)
- [How do NIS2, the GDPR, DORA, the CRA and the AI Act fit together?](https://netsenx.com/en/faq/how-do-nis2-gdpr-dora-cra-and-ai-act-fit-together)

## [Security standards: ISO 27001, SOC 2](https://netsenx.com/en/faq/standards) ([Markdown](https://netsenx.com/en/faq/standards.md))

15 questions

- [What is ISO/IEC 27001, in plain terms?](https://netsenx.com/en/faq/what-is-iso-27001)
- [What is an information security management system?](https://netsenx.com/en/faq/what-is-an-isms)
- [What is a statement of applicability in ISO 27001?](https://netsenx.com/en/faq/what-is-a-statement-of-applicability)
- [What is SOC 2, and why do customers ask for it?](https://netsenx.com/en/faq/what-is-soc-2)
- [What is the difference between a SOC 2 Type 1 and a Type 2 report?](https://netsenx.com/en/faq/soc-2-type-1-vs-type-2)
- [Do we need ISO 27001 or SOC 2?](https://netsenx.com/en/faq/iso-27001-or-soc-2-which-do-we-need)
- [What is ISO/IEC 42001?](https://netsenx.com/en/faq/what-is-iso-42001)
- [What is IEC 62443, and do we need it?](https://netsenx.com/en/faq/what-is-iec-62443)
- [Does an ISO 27001 certificate mean we meet NIS2?](https://netsenx.com/en/faq/does-iso-27001-cover-nis2)
- [Which ISO 27001 controls does network monitoring help with?](https://netsenx.com/en/faq/which-iso-27001-controls-does-network-monitoring-support)
- [Does NetSenX hold ISO 27001 or SOC 2 certification?](https://netsenx.com/en/faq/what-certifications-does-netsenx-hold)
- [What is the NIST Cybersecurity Framework 2.0?](https://netsenx.com/en/faq/what-is-nist-csf-2)
- [What is BSI IT-Grundschutz?](https://netsenx.com/en/faq/what-is-bsi-it-grundschutz)
- [What is the difference between a certification and an attestation report?](https://netsenx.com/en/faq/certification-vs-attestation-what-is-the-difference)
- [How do we prepare for our first ISO 27001 certification audit?](https://netsenx.com/en/faq/how-to-prepare-for-a-first-iso-27001-audit)

General information, not legal advice.