# Could an insider stealing money with malicious code have been spotted?

Sometimes, from the side effects rather than the intent. Spain's INCIBE has published a real case in which an employee introduced malicious code and stole a million euros. Cases like this rely on access the person already has, so prevention lies in process: separation of duties for payments, approval by a second person, code review for changes to financial systems, and prompt removal of access when roles change. Technical signs can still appear: a workstation contacting an unfamiliar outside server, new connections to the payment or ERP system from a machine that never used it, unusual uploads. NetSenX watches devices and connections, never people: it can flag that behaviour on the network, on every plan, but it does not judge intent and does not see what happens inside an application. Investigating a person is a matter for HR and lawyers, and for the works council where one exists.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/could-an-insider-stealing-with-malicious-code-be-spotted

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Was our website outage a cyber attack? How do we find out?](https://netsenx.com/en/faq/was-our-website-outage-a-cyber-attack)
- [Does network detection stop DDoS attacks, and how does it differ from DDoS protection?](https://netsenx.com/en/faq/does-network-detection-stop-ddos-attacks)
- [What does NetSenX give us during an incident?](https://netsenx.com/en/faq/what-does-netsenx-give-us-during-an-incident)
- [A supplier with access to our systems has been hacked. What do we do?](https://netsenx.com/en/faq/a-supplier-with-access-to-our-systems-was-hacked)
- [Is it a compromised account or a compromised device, and why does it matter?](https://netsenx.com/en/faq/compromised-account-or-compromised-device)