# How do I test that our network detection actually works?

Generate harmless versions of the behaviour it should catch, on a test host you own, and check what alerts appear and how quickly. Start simple and announce the test to anyone who might react. A port scan from a spare laptop against your own subnet should be flagged. A script that calls the same outside test server every few minutes for an hour imitates beaconing. Copying a large archive from a test server to an external storage account at night imitates data theft. Write down what you did, when, and what the tool raised, then review the alert text: would a colleague know what to do? Repeat after major changes to the network or the tool. Breach and attack simulation (BAS) automates such tests. NetSenX includes BAS from the Business plan; on every plan you can run manual tests like these against the detections it raises.

FAQ: [NDR, EDR, SIEM, XDR, MDR](https://netsenx.com/en/faq/tools) · https://netsenx.com/en/faq/how-to-test-that-network-detection-actually-works

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/blog/2026-09-24_ndr-vs-edr-vs-siem

## Related questions

- [What is breach and attack simulation, and does a mid-sized company need it?](https://netsenx.com/en/faq/what-is-breach-and-attack-simulation)
- [How often should we test our detection with simulated attacks?](https://netsenx.com/en/faq/how-often-should-we-test-detection-with-simulated-attacks)
- [What is NDR (Network Detection and Response)?](https://netsenx.com/en/faq/what-is-ndr-network-detection-and-response)
- [What does NDR stand for?](https://netsenx.com/en/faq/what-does-ndr-stand-for)
- [How does network detection and response work?](https://netsenx.com/en/faq/how-does-network-detection-and-response-work)