# Can network monitoring tell a backup upload from data theft?

Usually, once it knows the backup. A legitimate backup or cloud sync runs from known hosts to known destinations at regular times, with similar volumes night after night, and it starts on the day the job was set up. Theft usually differs in at least one way: a host that never uploads, a new destination, an unusual hour, or volume far above that host's normal. When theft uses the same cloud provider as your backups, the account and the exact destination differ, which a proxy or the provider's own logs show better than flow data. NetSenX compares each host's uploads with its own history and explains the alert, so the nightly backup job stays recognisable; if it does fire, mark it as a false positive once, and the decision is kept in the audit log.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/can-network-monitoring-tell-a-backup-from-data-theft

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [Why would a normal workstation connect to the domain controller at night?](https://netsenx.com/en/faq/why-would-a-workstation-connect-to-the-domain-controller-at-night)
- [What is ARP spoofing, and how do we detect it on a small office network?](https://netsenx.com/en/faq/what-is-arp-spoofing-and-how-to-detect-it)
- [Can someone on our Wi-Fi read other users' traffic?](https://netsenx.com/en/faq/can-someone-on-our-wi-fi-read-other-users-traffic)
- [How much time do we have once ransomware starts touching file shares?](https://netsenx.com/en/faq/how-much-time-once-ransomware-touches-file-shares)
- [Can we see which program on a server made a large upload?](https://netsenx.com/en/faq/can-we-see-which-program-made-a-large-upload)