What is impossible travel, and which tool detects it?

Impossible travel is a sign-in pattern in which the same account signs in from two places that nobody could travel between in the time that passed, such as Madrid at 09:10 and another continent at 09:40. It usually means a stolen password or session token in use, although a VPN service, a mobile network or a cloud proxy can produce false matches. It is detected by the systems that see sign-ins together with the account name: your identity provider, the cloud office suite or the VPN gateway. Most offer it as a built-in risk signal; check that it is switched on and that someone receives the alert. Location comes from address registration data, so treat it as an indicator, not proof. A network sensor such as NetSenX does not see account sign-ins and does not raise impossible-travel alerts. It helps afterwards, by showing what the session did inside the network: scanning, lateral movement or large transfers out.

← All 40 questions on Remote work and exposed servicesAll topics