What does an insurer mean when it asks whether we monitor our network?

Usually whether you would notice suspicious activity inside your network and who would act on it, not whether a firewall is installed. A firewall filters traffic at the edge; network monitoring looks at the traffic that passes, including traffic between internal devices, and raises alerts on patterns such as a device calling an outside server at regular intervals, one machine probing many others, or unusual amounts of data leaving. The question often comes with follow-ups about coverage (which sites and segments), alert review and retention of records. Answer with the actual scope: list which networks are watched and which are not, such as a remote office or a guest Wi-Fi. NetSenX is network detection and response (NDRNDR: network detection and response. Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker.): on every plan it detects beaconing, scanning, lateral movement and unusual outbound volume on the segments it watches, through an agent on Linux or macOS or a sensor on a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it./TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port. It does not see segments that are not connected to it.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on Cyber insuranceAll topics