Can network monitoring tell a backup upload from data theft?

Usually, once it knows the backup. A legitimate backup or cloud sync runs from known hosts to known destinations at regular times, with similar volumes night after night, and it starts on the day the job was set up. Theft usually differs in at least one way: a host that never uploads, a new destination, an unusual hour, or volume far above that host's normal. When theft uses the same cloud provider as your backups, the account and the exact destination differ, which a proxy or the provider's own logs show better than flow data. NetSenX compares each host's uploads with its own history and explains the alert, so the nightly backup job stays recognisable; if it does fire, mark it as a false positive once, and the decision is kept in the audit log.

← All 69 questions on Attack techniques explainedAll topics