# Can network monitoring detect ransomware before encryption?

Often, because the steps before encryption cross the network: command-and-control check-ins, scanning, lateral movement and data theft. That is the window in which an attack can still be stopped. Not every attack shows all of them, and an attack confined to one machine gives the network little to see.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/can-network-monitoring-detect-ransomware-before-encryption

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Does NetSenX stop ransomware?](https://netsenx.com/en/faq/does-netsenx-stop-ransomware)
- [What should we do first if we see these signs?](https://netsenx.com/en/faq/what-should-we-do-first-if-we-see-these-signs)
- [What should we do first if we are hit by ransomware?](https://netsenx.com/en/faq/first-steps-after-a-ransomware-attack)
- [What are the steps after a ransomware attack, in order?](https://netsenx.com/en/faq/steps-after-a-ransomware-attack-in-order)
- [Should we pay the ransom?](https://netsenx.com/en/faq/should-we-pay-the-ransom)