# How do we know the attacker is really gone?

You cannot know for certain, but you can build reasonable confidence. Check that you understand how they got in and that the way is closed, that every account and tool they created has been removed, and that credentials have been reset. Then look for the absence of activity: no connections to their known servers, no new administrator accounts, no unexplained logins, no scanning between hosts. Search your logs and endpoints for the indicators from your investigation, such as IP addresses, domains and file hashes. Keep a heightened watch for at least several weeks, because some attackers wait. A compromise assessment by an outside firm gives an independent view. NetSenX supports the absence test from the network: beaconing, scanning, lateral movement and unusual outbound volume are flagged on every plan, Free included, so silence on the segments it monitors means something.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/how-do-we-know-the-attacker-is-really-gone

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Can we keep using our computers after a ransomware attack?](https://netsenx.com/en/faq/can-we-keep-using-computers-after-ransomware)
- [How do we recover safely after a cyber incident?](https://netsenx.com/en/faq/how-to-recover-safely-after-a-cyber-incident)
- [Can we keep working during a cyber incident?](https://netsenx.com/en/faq/can-we-keep-working-during-a-cyber-incident)
- [How long should we watch the network closely after an incident?](https://netsenx.com/en/faq/how-long-to-watch-the-network-after-an-incident)
- [What is a lessons-learned review after an incident?](https://netsenx.com/en/faq/what-is-a-lessons-learned-review-after-an-incident)