How do I answer the board when they ask if we have been hacked?
With what you can show, not with a guess. A useful answer has three parts: what your monitoring shows today (open alerts and incidents, and the devices behind them), what it covers (which sites, network segments and devices are watched), and what it cannot see (the content of encrypted traffic, activity that never crosses the network, segments nobody monitors). A confident “no” that later proves wrong costs more credibility than an honest “nothing seen on the parts we watch”. NetSenX gives you that picture in plain language: on every plan, Free included, it flags beaconing to command-and-control servers, scanning, lateral movement and unusual outbound data volume, and it shows which segments its sensors watch. It cannot prove that nothing happened elsewhere.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.