# Is slow internet a sign that we have been hacked?

Rarely on its own. Slowness usually has ordinary causes: a backup, an operating system update, a video call, a busy link. It is worth a closer look when it comes with traffic you cannot explain, such as a server uploading large amounts at night, a computer connecting to an unfamiliar destination at regular intervals, or a device that never sent much suddenly sending a lot. Start with your firewall or router: which internal address is using the bandwidth, and where is the traffic going? If the answer is a known job, you are done. A performance monitor shows that a link is busy; NetSenX shows unusual outbound volume per host, judged against that host's own normal, and whether the pattern looks like data leaving.

FAQ: [Have I been hacked?](https://netsenx.com/en/faq/signs) · https://netsenx.com/en/faq/is-slow-internet-a-sign-of-a-hack

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing

## Related questions

- [Our antivirus switched itself off. Is that a sign of compromise?](https://netsenx.com/en/faq/antivirus-turned-off-by-itself)
- [How can I see unknown devices on the company network?](https://netsenx.com/en/faq/how-to-see-unknown-devices-on-the-company-network)
- [Can you tell who is connected to the company Wi-Fi?](https://netsenx.com/en/faq/can-you-tell-who-is-connected-to-the-company-wi-fi)
- [Can someone get into our office network through a free wall socket?](https://netsenx.com/en/faq/can-someone-get-into-our-network-through-a-free-wall-socket)
- [How long do attackers stay in a network before they are found?](https://netsenx.com/en/faq/how-long-do-attackers-stay-in-a-network-before-they-are-found)