Who notices a remote login at 3 a.m. on a Sunday?

Often nobody until Monday, which is why attackers like weekends and holidays. The fix is less about more people and more about deciding in advance what wakes someone up. Most small companies cannot staff a night shift, so pick a few events that justify a phone call, such as a successful admin login from an unusual place, a remote session to a server at night or a large transfer out, and route only those to a phone. Everything else can wait for the morning review. Make sure your VPN and identity provider send sign-in alerts somewhere that is read, and agree who is on call during holidays. NetSenX detects around the clock, but people do not: it flags lateral movement, beaconing, scanning and unusual outbound volume on every plan and, from the Pro plan, can send alerts to Slack or a webhook so that they reach a phone. It does not provide a staffed security operations centre.

← All 40 questions on Remote work and exposed servicesAll topics