# How do we detect misuse of our RMM tool in client networks?

Watch for remote sessions that do not match your technicians' work: unusual hours, unusual target machines, many machines in a short time, or sessions followed by new connections inside the client network. Start in the tool itself: enable its audit log, alert on new admin accounts and on scripts pushed to many devices, and review it weekly. Compare sessions with your ticket system. On the network side, a sensor in each client network sees what happens after a session starts: a host suddenly connecting to many others, scanning, or sending data out. NetSenX flags lateral movement and new sessions that do not fit a host's normal, on every plan, in each client's own tenant.

FAQ: [MSPs and MSSPs](https://netsenx.com/en/faq/msp) · https://netsenx.com/en/faq/how-to-detect-misuse-of-an-rmm-tool-in-client-networks

## Read next

- https://netsenx.com/en/problems-we-solve
- https://netsenx.com/en/partners

## Related questions

- [What should an MSP monitor to detect a compromise of its own tools?](https://netsenx.com/en/faq/what-should-an-msp-monitor-to-detect-a-compromise-of-its-own-tools)
- [How can an MSP add night and weekend coverage for clients without hiring?](https://netsenx.com/en/faq/how-can-an-msp-add-night-and-weekend-coverage-without-hiring)
- [What can an MSP promise clients about after-hours security monitoring?](https://netsenx.com/en/faq/what-can-an-msp-promise-about-after-hours-monitoring)
- [How should an MSP describe security monitoring in a contract without promising a SOC?](https://netsenx.com/en/faq/how-to-describe-security-monitoring-in-an-msp-contract)
- [Who is liable if a monitored client is breached?](https://netsenx.com/en/faq/who-is-liable-if-a-monitored-client-is-breached)