How do we know the attacker is really gone?
You cannot know for certain, but you can build reasonable confidence. Check that you understand how they got in and that the way is closed, that every account and tool they created has been removed, and that credentials have been reset. Then look for the absence of activity: no connections to their known servers, no new administrator accounts, no unexplained logins, no scanning between hosts. Search your logs and endpoints for the indicators from your investigation, such as IP addresses, domains and file hashes. Keep a heightened watch for at least several weeks, because some attackers wait. A compromise assessment by an outside firm gives an independent view. NetSenX supports the absence test from the network: beaconing, scanning, lateral movement and unusual outbound volume are flagged on every plan, Free included, so silence on the segments it monitors means something.