What should a small company do when a security alert arrives?
Read it, check it against what you know, and decide within the hour whether it is harmless, needs watching or needs action. First, identify the device and its owner. Second, ask whether there is an innocent explanation: a backup, an update, a new supplier, a colleague's planned work. Third, if not, contain before you investigate: disconnect the device from the network, but do not switch it off, because memory and logs help investigators. Reset passwords the device may have used, from another computer. Call your IT provider or an incident-response firm if you are unsure. Note what you did and when. NetSenX alerts say what happened, on which host and why, and the audit log records your decisions.