# Is it a compromised account or a compromised device, and why does it matter?

Because the clean-up is different. A compromised account means someone has a user's password or session, usable from anywhere: the fix is to reset credentials, revoke sessions, review mailbox rules and enforce multi-factor authentication (MFA), and the evidence is in identity and service logs. A compromised device means someone controls the machine itself, often with malware: the fix is to isolate and rebuild it, and the evidence is on the endpoint and in its network traffic. Many incidents involve both, such as passwords stolen from an infected laptop, or an account used to install tools on a server. Find out which you have before choosing actions, or you will reset passwords on a device that captures the new ones. NetSenX sees the device side on the network: a machine calling an outside server, scanning or opening new sessions. Account misuse from outside your network belongs to identity logs.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/compromised-account-or-compromised-device

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What are the early warning signs of ransomware on a network?](https://netsenx.com/en/faq/what-are-the-early-warning-signs-of-ransomware-on-a-network)
- [Can network monitoring detect ransomware before encryption?](https://netsenx.com/en/faq/can-network-monitoring-detect-ransomware-before-encryption)
- [Does NetSenX stop ransomware?](https://netsenx.com/en/faq/does-netsenx-stop-ransomware)
- [What should we do first if we see these signs?](https://netsenx.com/en/faq/what-should-we-do-first-if-we-see-these-signs)
- [What should we do first if we are hit by ransomware?](https://netsenx.com/en/faq/first-steps-after-a-ransomware-attack)