# How do we stop an attacker who is already in our network?

By containing first and then removing, in one coordinated move. Find out as much as you can quietly: which hosts and accounts are involved, how the attacker gets in and out, and where their tools are. Then act together: isolate the affected hosts at the switch or firewall, block their outside destinations, disable or reset the compromised accounts from a clean device, and close the way in, such as a VPN account or an exposed service. Acting piecemeal warns the attacker, who may switch hosts or start damaging systems. Bring in an incident-response firm if you have not already, and keep a log. After containment, rebuild affected machines and watch closely for weeks. NetSenX does not remove attackers; it shows from the network which hosts are involved and where they connect, which is what a containment plan needs, and it flags renewed activity afterwards.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/how-to-stop-an-attacker-already-in-our-network

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [How fast do attackers move once they are inside?](https://netsenx.com/en/faq/how-fast-do-attackers-move-once-inside)
- [How do we know if the PC we use for online banking is infected?](https://netsenx.com/en/faq/is-the-pc-we-use-for-online-banking-infected)
- [How would we know if our ERP database was copied out of the company?](https://netsenx.com/en/faq/how-would-we-know-if-our-erp-database-was-copied-out)
- [Can network monitoring tell a backup upload from data theft?](https://netsenx.com/en/faq/can-network-monitoring-tell-a-backup-from-data-theft)
- [Why would a normal workstation connect to the domain controller at night?](https://netsenx.com/en/faq/why-would-a-workstation-connect-to-the-domain-controller-at-night)