# What should an MSP monitor to detect a compromise of its own tools?

Your own sign-ins, your management tools' audit logs, and the traffic your tools create in client networks. Alert on technician logins from new countries or devices, new admin accounts, disabled multi-factor authentication, mass script deployments and API keys created outside a change. Keep those logs outside the tools themselves, so an attacker cannot erase them. Protect the servers or cloud accounts that run your tools like a client's crown jewels, and monitor their network traffic too. In client networks, watch for activity that starts from your agent's host and does not match a ticket. NetSenX can watch your own office network and each client's, as separate tenants, with lateral movement and unusual uploads raised as alerts.

FAQ: [MSPs and MSSPs](https://netsenx.com/en/faq/msp) · https://netsenx.com/en/faq/what-should-an-msp-monitor-to-detect-a-compromise-of-its-own-tools

## Read next

- https://netsenx.com/en/problems-we-solve
- https://netsenx.com/en/partners

## Related questions

- [How can an MSP add night and weekend coverage for clients without hiring?](https://netsenx.com/en/faq/how-can-an-msp-add-night-and-weekend-coverage-without-hiring)
- [What can an MSP promise clients about after-hours security monitoring?](https://netsenx.com/en/faq/what-can-an-msp-promise-about-after-hours-monitoring)
- [How should an MSP describe security monitoring in a contract without promising a SOC?](https://netsenx.com/en/faq/how-to-describe-security-monitoring-in-an-msp-contract)
- [Who is liable if a monitored client is breached?](https://netsenx.com/en/faq/who-is-liable-if-a-monitored-client-is-breached)
- [What should an MSP do if a client refuses to pay for security?](https://netsenx.com/en/faq/what-if-a-client-refuses-to-pay-for-security)