A login from a new location: is it a breach or an employee on a new device?

Often it is the employee, but you only know after checking. Logins from a new country or provider happen with travel, a new phone or a mobile network that routes through another city, and they also happen when someone uses a stolen password. Ask the person directly, through a channel other than the account in question, whether it was them. Then look at the identity logs of the service: was multi-factor authentication (MFA) completed, were mailbox rules or new devices added, and did the same account sign in from two distant places within an hour? This evidence lives in your identity provider, VPN and SaaS logs, not on the network. NetSenX adds the network side, such as a device that starts scanning or opens new sessions to servers afterwards; it does not see identity events or link a login to a person.

← All 35 questions on Have I been hacked?All topics