# We had an incident last year. How do we make sure we would detect it if it happened again?

Turn last year's incident into a test. Write down each step the attacker took, from first access to the moment you noticed, and for each step ask which control or log would see it today. Then close the gaps: if the way in was a VPN account without multi-factor authentication (MFA), check that every remote account now has it; if you only noticed at encryption, find out which earlier step crossed the network and whether anything would alert on it now. A tabletop exercise or a breach and attack simulation replays the scenario without real harm. NetSenX covers the network steps most incidents share, such as beaconing, scanning, lateral movement and unusual outbound data volume, on every plan; breach and attack simulation is included from the Business plan. What happens only inside a host needs endpoint protection.

FAQ: [Have I been hacked?](https://netsenx.com/en/faq/signs) · https://netsenx.com/en/faq/how-to-detect-a-repeat-of-last-years-incident

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing

## Related questions

- [Why do companies so often learn about a breach from outsiders?](https://netsenx.com/en/faq/why-companies-learn-about-breaches-from-outsiders)
- [How do we tell a network attack from a heavy update or backup?](https://netsenx.com/en/faq/how-to-tell-a-network-attack-from-an-update-or-backup)
- [How do we know what normal looks like on our network?](https://netsenx.com/en/faq/how-do-we-know-what-normal-looks-like-on-our-network)
- [What is an indicator of compromise (IOC)?](https://netsenx.com/en/faq/what-is-an-indicator-of-compromise)
- [Our antivirus shows everything green. Can we still be compromised?](https://netsenx.com/en/faq/antivirus-shows-green-can-we-still-be-compromised)