# How do we know if our VPN has been compromised?

Check the VPN's own logs first: sign-ins at odd hours or from unexpected countries, accounts that never used the VPN before, many failed attempts, and new configuration changes or admin accounts on the appliance. Compare its software version with the vendor's security advisories, because VPN gateways are a frequent target of exploited flaws, and run the vendor's published compromise checks if there are any. Behind the VPN, an attacker's next steps show on the network: scanning from the VPN address pool, new sessions from VPN addresses to servers they never used, large transfers out. NetSenX flags those where the segment behind the VPN is monitored, on every plan, and its VPN view lists the tunnels and gateway sessions it sees, with the country each remote address is registered in. It does not read the appliance's logs and cannot inspect the appliance itself.

FAQ: [Remote work and exposed services](https://netsenx.com/en/faq/remote) · https://netsenx.com/en/faq/how-do-i-know-if-our-vpn-is-compromised

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/encrypted-traffic-analysis

## Related questions

- [Can an infected home laptop spread malware into the office over the VPN?](https://netsenx.com/en/faq/can-an-infected-home-laptop-spread-malware-over-the-vpn)
- [Is it safe to expose SSH to the internet?](https://netsenx.com/en/faq/is-it-safe-to-expose-ssh-to-the-internet)
- [Which services should never be exposed to the internet?](https://netsenx.com/en/faq/which-services-should-never-be-exposed-to-the-internet)
- [How does remote working increase cyber-security risk?](https://netsenx.com/en/faq/how-does-remote-work-increase-cyber-risk)
- [How do I secure remote workers who access the company network?](https://netsenx.com/en/faq/how-to-secure-remote-workers-accessing-the-company-network)