# What is impossible travel, and which tool detects it?

Impossible travel is a sign-in pattern in which the same account signs in from two places that nobody could travel between in the time that passed, such as Madrid at 09:10 and another continent at 09:40. It usually means a stolen password or session token in use, although a VPN service, a mobile network or a cloud proxy can produce false matches. It is detected by the systems that see sign-ins together with the account name: your identity provider, the cloud office suite or the VPN gateway. Most offer it as a built-in risk signal; check that it is switched on and that someone receives the alert. Location comes from address registration data, so treat it as an indicator, not proof. A network sensor such as NetSenX does not see account sign-ins and does not raise impossible-travel alerts. It helps afterwards, by showing what the session did inside the network: scanning, lateral movement or large transfers out.

FAQ: [Remote work and exposed services](https://netsenx.com/en/faq/remote) · https://netsenx.com/en/faq/what-is-impossible-travel-and-which-tool-detects-it

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/encrypted-traffic-analysis

## Related questions

- [Can network monitoring see where our VPN users connect from?](https://netsenx.com/en/faq/can-network-monitoring-see-where-vpn-users-connect-from)
- [Can NetSenX monitor a laptop that is outside the office?](https://netsenx.com/en/faq/can-netsenx-monitor-a-laptop-outside-the-office)
- [Do home-office laptops need the NetSenX agent installed?](https://netsenx.com/en/faq/do-home-office-laptops-need-the-netsenx-agent)
- [Should executive laptops get extra monitoring?](https://netsenx.com/en/faq/should-executive-laptops-get-extra-monitoring)
- [What does a network sensor see when a laptop comes back to the office after a trip?](https://netsenx.com/en/faq/what-does-a-sensor-see-when-a-laptop-returns-from-a-trip)