Can network evidence show that a specific customer's data did not leave?

Partly. Network records can show that a particular server, the one holding that customer's data, sent no unusual volume out during the period, and that no new outside destination received data from it. That is meaningful evidence, especially if the server normally sends little. It is not proof on its own: data could have been copied to another internal machine first and sent from there, sent in small amounts below obvious thresholds, or taken through a channel the sensor does not watch, such as a cloud service accessed directly or a segment that is not monitored. Present it to the customer as what it is: evidence of absence on the paths you monitor, combined with server and cloud logs. NetSenX keeps per-host alerts on unusual outbound volume, and its network map shows which hosts talked to that server.

← All 60 questions on Incident responseAll topics