# How can we tell if a stolen password is being used?

Mainly from sign-in logs, because they record who signed in, from where and how. Look for sign-ins from new countries, unfamiliar devices or hosting providers, successful sign-ins right after many failures, newly registered MFA methods, new mail forwarding rules, and access to applications the person never uses. Most identity providers and cloud office suites can flag risky sign-ins; switch this on and make sure someone reads the alerts. Check public breach notification services for your company domain, and act on what they report by resetting the password and checking for reuse. The network shows the second half: what the attacker does with the account. NetSenX flags lateral movement, scanning, beaconing and unusual uploads from devices on monitored segments, on every plan, which is often how an account takeover becomes visible inside the company. It does not see the sign-in itself, and it does not read passwords.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/how-to-detect-a-stolen-password-being-used

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Should administrators use separate accounts for admin work?](https://netsenx.com/en/faq/should-admins-use-separate-accounts-for-admin-work)
- [What is privileged access management (PAM), and do we need it?](https://netsenx.com/en/faq/what-is-privileged-access-management)
- [Can network monitoring see attacks on accounts and the directory?](https://netsenx.com/en/faq/can-network-monitoring-see-identity-attacks)
- [Does NIS2 require zero trust?](https://netsenx.com/en/faq/does-nis2-require-zero-trust)
- [How do we limit what a compromised laptop can reach?](https://netsenx.com/en/faq/how-to-limit-what-a-compromised-laptop-can-reach)