Have I been hacked?

Look for behaviour that has changed: new outbound destinations, connections at regular intervals, sign-ins at odd hours, one machine connecting to many others, and unusual outbound volume. Each can be checked in firewall, DNS and directory logs. Two or more together are worth an investigation; continuous network monitoring watches for all of them every day, not only on the day you look.

Yes. In joint advisory AA24-038A of 7 February 2024, CISA, the NSA and the FBI reported that Volt Typhoon actors had kept access to some victims' IT environments for at least five years. Attackers who use the same administration tools as your IT team leave few signatures behind, which is why behaviour on the network matters.

Export the top outbound destinations from your firewall or DNS server and look at the rare ones; review successful sign-ins outside business hours; count how many internal hosts each workstation contacts on SMB, RDP, SSH and WinRM ports; and compare each server's outbound volume with its own average.

No. NetSenX adds the network view: it sees devices that run no agent and the movement between hosts. Endpoint protection still covers what happens inside each machine. The Free plan has no time limit and needs no credit card, so you can see what it finds on your own network first.

Yes. Attackers who use stolen passwords and the administration tools already on your systems can stay quiet for a long time: nothing breaks, so nobody looks. What gives them away is behaviour, such as a computer contacting a new outside server at regular intervals, one machine connecting to many others, or uploads at night. NetSenX flags beaconing, scanning, lateral movement and unusual outbound data volume on every plan, Free included. It does not see activity that never touches the network.

Often, yes. An attacker who controls one machine uses it to look around and move on: scanning for other hosts, trying the passwords stored on the first machine and connecting over administration protocols such as SMB, RDP or SSH. On a flat network, where every computer can reach every server, nothing slows this down. Three free measures limit how far they get: segment the network so that workstations cannot reach servers they do not need, take local administrator rights away from everyday accounts, and use a different password for every system. NetSenX flags the scanning and the new host-to-host sessions this movement creates, on every plan, Free included. It does not see what the attacker does inside the first machine before anything touches the network.

Rarely on its own. Slowness usually has ordinary causes: a backup, an operating system update, a video call, a busy link. It is worth a closer look when it comes with traffic you cannot explain, such as a server uploading large amounts at night, a computer connecting to an unfamiliar destination at regular intervals, or a device that never sent much suddenly sending a lot. Start with your firewall or router: which internal address is using the bandwidth, and where is the traffic going? If the answer is a known job, you are done. A performance monitor shows that a link is busy; NetSenX shows unusual outbound volume per host, judged against that host's own normal, and whether the pattern looks like data leaving.

It can be. Switching off security tools is a common early step for attackers and ransomware, because it removes a witness before the real work starts. Check the endpoint console for who or what changed the setting and when, look for new administrator accounts, new services and scheduled tasks on that machine, and isolate it if you cannot explain the change. Ask the vendor's support whether an update could have done it; sometimes that is the answer. This is endpoint evidence: a network sensor does not see a setting change on a computer. What it can show is whether that machine then started behaving unusually on the network, such as contacting a new outside server at regular intervals or opening sessions to other hosts, which NetSenX flags on every plan.

Start with what you already have: the DHCP leases on your router or server, the MAC address tables on your switches and the client list of the Wi-Fi controller. Compare them with your inventory and investigate anything unexplained; the first half of a MAC address identifies the manufacturer, which often tells you whether a device is a printer, a phone or a small computer. Port security or 802.1X stops unknown devices from joining in the first place. The NetSenX network map, on every plan, shows the hosts seen on monitored segments and who they talk to, so a new device that starts talking stands out. A device that stays silent, or sits on a segment you do not monitor, does not appear there.

Yes, from the access point or Wi-Fi controller: its client list shows every connected device with its MAC address, signal strength and often a device name. Compare it with what you expect, and check the router's DHCP leases for devices that took an address recently. A few settings make the list easier to trust: a separate guest network for visitors and personal phones, a Wi-Fi password that changes when staff leave, and WPA2 or WPA3 Enterprise with individual logins instead of one shared key. Modern phones use a different MAC address on each network, so an unfamiliar address is not proof of an intruder. NetSenX does not manage Wi-Fi, but its network map shows the devices that talk on monitored segments, so a newcomer reaching internal servers stands out.

Yes, if the socket is patched to a live switch port. A visitor, a contractor or an intruder can plug in a laptop, or leave a small computer such as a Raspberry Pi behind a printer, and it then sits inside your firewall. Prevention is cheap: disconnect switch ports that are not in use, use 802.1X or at least port security so that only known devices get access, put meeting rooms and reception on a guest network, and look behind printers and under desks during walk-throughs. Detection is the second layer. The NetSenX network map, on every plan, shows new devices that start talking on monitored segments, and NetSenX flags a hidden device that calls out at regular intervals as beaconing. If the device reaches the attacker over its own mobile connection, only what it does inside your network is visible, such as scanning; a device that only listens stays invisible.

Usually days to weeks, sometimes far longer. Mandiant's M-Trends 2026 report puts the global median dwell time, the time from the start of an intrusion to its discovery, at 14 days for the incidents it investigated in 2025. A median hides a long tail: half of those intrusions lasted longer than that. Dwell time is short when the attacker is noisy, as with ransomware, and long when the goal is quiet access or data theft, and intrusions that an outside party discovers have tended to run longer than those a company finds itself. What shortens it is someone watching behaviour, not only signatures: regular check-ins with a new outside server, scanning, new sessions between hosts. NetSenX flags those on every plan, Free included, on the segments it monitors.

Most monitoring leaves nothing you can see on the screen, so look at what is installed and who manages the computer. Company monitoring normally appears in the list of installed programs or management profiles and should be described in a written policy; ask IT or HR if you are unsure. Signs that something unapproved may be running include a remote-access tool you did not install, the mouse or windows moving on their own, a new browser extension, the webcam light turning on, or security software that has been switched off. On the network, a computer that regularly sends data to an unfamiliar outside server is the clearest technical sign. NetSenX watches devices and connections, never people: it flags that kind of beaconing on every plan, but it does not see what runs inside the computer.

Usually not directly. Passive sniffing, a device that only listens, sends nothing and so leaves almost nothing to detect. What you can detect is the work an attacker has to do to see traffic that is not meant for them. On a switched network they must redirect it, for example with ARP spoofing, or plug into a mirror port, a hub or a tap. Switch features such as dynamic ARP inspection and DHCP snooping block the redirection, port security limits who can plug in, and encrypting internal services with HTTPS, SSH and SMB encryption makes captured traffic far less useful. A sensor watching the segment sees unusual ARP announcements and the new device that starts talking; a listener that stays completely silent is invisible to NetSenX, as it is to any network sensor.

From many of them, if the network lets them. Once inside, an attacker can reach every system the compromised machine can reach and log in wherever its stored or stolen passwords work. Shared folders, a file server that everyone can read and one administrator password used on every computer make that list long. Three things shorten it: segments that keep workstations away from servers they do not need, accounts with the fewest rights that still let people work, and multi-factor authentication (MFA) on remote access and administrator logins. Stolen data also has to cross the network twice: once when the attacker gathers files from other hosts, and again when they send them out. NetSenX flags new host-to-host sessions and unusual outbound data volume per host, on every plan, Free included.

Through a service that answers on that address, or through a person. Your public IP address on its own is not a door; the open ports behind it are. Attackers scan the whole internet for remote desktop, VPN gateways, firewalls with remote management, mail and web servers, and then try stolen passwords or known vulnerabilities on whatever answers. The other common route skips the public address entirely: a phishing e-mail makes an employee run something, and the infected computer then calls out to the attacker. Check from outside which ports you expose, close everything that is not needed, put the rest behind a VPN with multi-factor authentication (MFA), and patch internet-facing devices first. On monitored segments, NetSenX shows which hosts are reached from outside and flags the beaconing that follows an infection.

Yes, and often an easy one. Printers, IP cameras, video recorders, smart TVs and door systems run small operating systems that are rarely updated, often keep their default passwords and cannot run antivirus. Attackers use them in two ways: as a hidden foothold that nobody watches, and as a starting point for scanning the rest of the network. Change default passwords, update the firmware, switch off services you do not use, and put these devices in their own network segment that cannot reach your servers, or the internet beyond what they need. Because you cannot install an agent on them, watch them from the network: from a SPAN or TAP port, NetSenX sees their destinations and flags beaconing and scanning, on every plan, without any software on the device.

It can be. Smart TVs, screen-sharing boxes and conference systems are computers with microphones, cameras and network access, updated on their makers' schedule, if at all. Many contact vendor clouds all day, even in standby, and some accept screen sharing from anyone on the same network. Put them on their own network segment that cannot reach your file servers or the laptops presented on them, turn off features you do not use, change default passwords and apply updates. Then check what they actually do: watched from a SPAN or TAP port, NetSenX sees their destinations and flags beaconing and scanning on every plan, without software on the device. Whether a vendor cloud abroad is acceptable is your decision; NetSenX shows the traffic, it does not judge the vendor.

Often it is the employee, but you only know after checking. Logins from a new country or provider happen with travel, a new phone or a mobile network that routes through another city, and they also happen when someone uses a stolen password. Ask the person directly, through a channel other than the account in question, whether it was them. Then look at the identity logs of the service: was multi-factor authentication (MFA) completed, were mailbox rules or new devices added, and did the same account sign in from two distant places within an hour? This evidence lives in your identity provider, VPN and SaaS logs, not on the network. NetSenX adds the network side, such as a device that starts scanning or opens new sessions to servers afterwards; it does not see identity events or link a login to a person.

Sometimes, because a rebuild only cleans the machines you rebuilt. What survives is usually somewhere else: passwords and session tokens the attacker stole, accounts they created in the directory or in cloud services, a remote-access tool on a server nobody reimaged, scheduled scripts on a file share, changed firewall rules, or a backup that already contained their tools. Before you call an incident closed, reset every credential that may have been exposed, review new accounts, mail forwarding rules and remote-access software everywhere, compare firewall and VPN settings with a known-good copy, and restore only from backups taken before the intrusion. Then watch closely for several weeks. Renewed connections to the attacker's servers are a typical sign of something missed; NetSenX flags command-and-control beaconing on every plan, Free included.

Partly, yes. Several national bodies offer free services: in Spain, INCIBE's Antibotnet service checks whether your public IP address appears in reports of infected devices, and national CERTs in other countries pass similar reports on to the owners of affected networks; ask your internet provider whether it forwards them to you. Free checks on your side help too: your firewall's log of blocked outbound connections, DNS logs that show lookups of known malicious domains, and any device that calls the same outside server around the clock. A reputation check tells you that something behind your public address was reported, not which device it was. NetSenX flags command-and-control beaconing per host on every plan, Free included, which points to the device itself.

A compromise assessment is a time-limited investigation that answers one question: is an attacker in our environment now, or were they recently? Specialists review endpoint, log and network evidence for signs of intrusion, rather than testing whether an intrusion is possible, as a penetration test does. It makes sense before an acquisition, after a supplier or a peer in your sector was breached, when you take over a network nobody documented, or when something odd happened that nobody could explain. Ask the provider what data they need, how far back they can look and what they will not cover. Its quality depends on the evidence that already exists: network history recorded before the assessment starts is worth more than anything collected afterwards. NetSenX keeps alerts and their reasons for the history your plan includes: 30 days on Free, longer on paid plans.

Find out how they were attacked, then check that exact path in your own company. Read the public statement, the advisory from your national CSIRT or sector body, and any reporting that names the method: an exploited VPN or firewall, a shared supplier, phishing, a known ransomware group. Criminal groups often reuse the same vulnerability or the same supplier access against many companies at once, so if you share software or a service provider with the victim, ask the provider directly. Patch the named product, review remote access and supplier accounts, and confirm that your backups are offline and restorable. Then look at your network for the early steps: new outside servers contacted at regular intervals, internal scanning and new administrator sessions. NetSenX flags these on every plan, Free included; it cannot tell you what happens on segments it does not monitor.

Look at every link with them, and at anything new. Start with the connections between you: shared VPN tunnels, remote-access accounts they use on your systems, file transfers, e-mail threads and shared cloud folders. Suspend or rotate those credentials until they confirm what was affected, and treat their e-mails asking for payment changes with care, because attackers reuse stolen mail threads. If their advisory or statement lists indicators of compromise, such as IP addresses, domains or file hashes, search your firewall, proxy and DNS logs for them going back several weeks. Then watch behaviour: hosts that suddenly reach new outside servers at regular intervals, scanning, unusual uploads. NetSenX flags those on every plan, and its network map shows who talks to whom on the segments it monitors.

Turn last year's incident into a test. Write down each step the attacker took, from first access to the moment you noticed, and for each step ask which control or log would see it today. Then close the gaps: if the way in was a VPN account without multi-factor authentication (MFA), check that every remote account now has it; if you only noticed at encryption, find out which earlier step crossed the network and whether anything would alert on it now. A tabletop exercise or a breach and attack simulation replays the scenario without real harm. NetSenX covers the network steps most incidents share, such as beaconing, scanning, lateral movement and unusual outbound data volume, on every plan; breach and attack simulation is included from the Business plan. What happens only inside a host needs endpoint protection.

Because nobody inside was looking in the right place. A customer receives a fake invoice from your hacked mailbox, a bank reports odd transfers, the police or a national CERT find your data on a criminal server, or the attackers announce it on their leak site. Inside the company, the signs were often there but unread: firewall logs nobody reviews, an antivirus alert closed as noise, a server uploading at night. Mandiant's M-Trends reports have repeatedly found that intrusions discovered by an outside party had been running longer than those a company found itself. Hearing it from outsiders also costs you control over the timeline and the message. Reading what already crosses your network changes that; NetSenX turns it into explained alerts for beaconing, scanning, lateral movement and unusual uploads, on every plan, Free included.

By asking who, where and when, and comparing the answer with normal. A backup moves data from known hosts to a known destination, usually at a fixed time, with a similar volume every night. An update downloads to many hosts from the vendor's servers in a short burst. Theft looks different: a host that rarely uploads sending a lot, to a destination nobody else uses, at an hour when it is normally quiet, or a workstation suddenly reading many file shares. Keep a short list of your scheduled jobs, their hosts and their times, so that anyone can check an alert against it. NetSenX judges each host against its own normal destinations, volumes and times of day, explains on every alert which network features drove it, and lets you mark an alert as a false positive, with the decision kept in the audit log.

By recording it before you need it. Normal is a description of who talks to whom, when and how much: which servers each workstation uses, which outside services it reaches, when backups run, which devices stay quiet at night. Most small companies have never written this down, which is why an odd connection is hard to judge in the middle of an incident. Start with a simple list of your servers, scheduled jobs, remote-access tools and the suppliers who connect in. Firewall and DNS logs from an ordinary week give you a first picture. NetSenX learns each host's normal from the traffic on the segments it monitors and compares every new connection with it, and its network map, on every plan, shows who talks to whom. A newly installed sensor needs time with your own traffic before its view of normal is reliable, and NetSenX tells you when it does not yet have enough data.

An indicator of compromise is a piece of evidence that suggests a system has been attacked: an IP address or domain known to be used by attackers, the hash of a malicious file, a suspicious file name, the TLS fingerprint of a known malware client, or a configuration change a piece of malware makes. Advisories from CISA, national CERTs and security researchers publish them so that others can search their own logs. They are useful and short-lived: attackers change servers and recompile their tools, so an address that was malicious last month may belong to someone innocent today. That is why indicators complement behaviour rather than replace it. Search your firewall, proxy and DNS logs for the indicators in any advisory that concerns you. From the Starter plan, NetSenX compares TLS handshakes with fingerprints of known malware where the agent captures packets, on Linux or as a SPAN/TAP sensor, and it flags behaviour such as beaconing on every plan.

Yes. Antivirus and endpoint tools look for known malicious files and suspicious behaviour on the machine, and they can only report from machines where they are installed and running. Attackers who log in with a stolen password and use the administration tools already present give them little to flag, and a printer, camera or server without the agent reports nothing at all. A tool that was switched off may also look quiet rather than red. Check which machines actually report to the console, when each last checked in, and whether any have been silent for days. Then add a second, independent view: the network. On the segments it monitors, NetSenX watches behaviour that crosses it, such as beaconing to a new outside server, scanning, new sessions between hosts and unusual uploads, on every plan, Free included, whether or not a host runs any agent.

Treat it as an incident until you have an explanation. New administrator accounts are a common way for attackers to keep access, and they are often named to look ordinary, such as a variant of a service or support account. Do not delete it straight away: disable it, note its name, its creation time and who or what created it, and save the directory and system logs that show this before they are overwritten. Then ask the obvious people, such as your IT provider or a software vendor, whether they created it. If nobody did, look for what else changed at the same time, reset the passwords of the other administrators from a clean device and call your incident-response provider. The account itself is identity evidence that a network sensor does not see; NetSenX shows whether hosts used around that time began scanning or opening new sessions to servers.

First, whether it is a job you know. Look at the time, the destination and the volume, and compare them with your backup schedule, software updates and any synchronisation with a cloud service. A known backup goes to a known destination at a fixed time. If the destination is new, the volume unusual or the server normally quiet at that hour, find the responsible process on the server itself, check who logged in shortly before, and use the firewall or proxy log to see how long it has been happening. Cut the server off from the internet if the transfer continues and nobody can explain it. NetSenX flags unusual outbound data volume per host on every plan and keeps the time, destination and volume of each alert for the history your plan includes; it does not see which files were inside an encrypted transfer.

Not necessarily, but it means something behind that address behaved badly, or was reported as doing so. Common causes are a compromised mailbox or device sending spam, a computer infected with malware that belongs to a botnet, an open service abused by others, or an address that belonged to someone else before your provider assigned it to you. Look up which list it is and the reason it gives, check your mail server and firewall logs for unusual outbound mail or connections, and change the password of any mailbox that sent unexpected messages. Ask for removal only after the cause is fixed, or you will be listed again. A blocklist points to your public address, which many devices share; NetSenX flags beaconing and unusual outbound traffic per host, on every plan, which helps you find the device.

Possibly, so check rather than dismiss it. Hardware explains many cases: a failing mouse, a wireless receiver picking up another device, or a touchpad reacting to a sleeve. Remote control is the other explanation, either by your own IT support or by someone else using a remote-access tool. Ask IT whether anyone was connected at that moment, look at the computer's installed programs and running remote-support tools, and check whether new accounts, password changes or payments followed. If nobody can explain it, disconnect the computer from the network, leave it powered on and call your incident-response provider. Remote-control tools need a network connection, often to a vendor's relay server, so the traffic is there to see: NetSenX shows that computer's connections and flags regular check-ins with a new outside server as beaconing, on every plan.

Observe before you act, and then act all at once. An attacker who notices you looking may delete evidence, move to another machine or start encryption early, so avoid noisy steps, such as resetting the user's password or running a full scan, before you have a plan. First collect what you can quietly: the endpoint console's history, firewall and DNS logs, and the connections the computer makes. Decide with your incident-response provider which accounts and hosts to contain, then do it together: isolate, reset credentials from a clean device and block the attacker's destinations within the same short window. Work from a clean device, and do not discuss the incident over a mailbox that may be compromised. A NetSenX sensor on a SPAN or TAP port observes without touching the computer, and its alerts list the destinations, timing and volume a containment plan needs.