# How do I detect a PLC program change outside working hours?

Combine a record of when your engineers really work on the controllers with a sensor that sees program downloads and writes on the network. A program change at 02:00 on a Sunday is not proof of an attack, since maintenance often happens while the line is stopped, but someone should be able to explain it the next morning. Keep a simple change log with the planned maintenance windows, compare it with what the network shows, and keep a known-good copy of each PLC program offline so you can compare and restore it. Some controllers can also report a changed program to the SCADA system. From the Pro plan, NetSenX flags OT activity outside working hours and decodes S7comm requests such as a program block download, with the block name, from a SPAN or TAP port. It does not read the program's content or compare versions; your engineering software does that.

FAQ: [OT and IoT](https://netsenx.com/en/faq/ot) · https://netsenx.com/en/faq/how-to-detect-a-plc-program-change-outside-working-hours

## Read next

- https://netsenx.com/en/ot-network-monitoring
- https://netsenx.com/en/compare

## Related questions

- [Can network monitoring see an S7 PLC being stopped?](https://netsenx.com/en/faq/can-network-monitoring-see-an-s7-plc-being-stopped)
- [Can network monitoring show who changed a PLC setpoint?](https://netsenx.com/en/faq/can-network-monitoring-show-who-changed-a-plc-setpoint)
- [Does NetSenX record the values written to our controllers?](https://netsenx.com/en/faq/does-netsenx-record-the-values-written-to-controllers)
- [Can OT alerts help a quality or safety investigation?](https://netsenx.com/en/faq/can-ot-write-events-support-a-quality-or-safety-investigation)
- [Does NetSenX raise a separate anomaly alert for each industrial protocol?](https://netsenx.com/en/faq/does-netsenx-raise-a-separate-alert-for-each-industrial-protocol)