# Who notices a remote login at 3 a.m. on a Sunday?

Often nobody until Monday, which is why attackers like weekends and holidays. The fix is less about more people and more about deciding in advance what wakes someone up. Most small companies cannot staff a night shift, so pick a few events that justify a phone call, such as a successful admin login from an unusual place, a remote session to a server at night or a large transfer out, and route only those to a phone. Everything else can wait for the morning review. Make sure your VPN and identity provider send sign-in alerts somewhere that is read, and agree who is on call during holidays. NetSenX detects around the clock, but people do not: it flags lateral movement, beaconing, scanning and unusual outbound volume on every plan and, from the Pro plan, can send alerts to Slack or a webhook so that they reach a phone. It does not provide a staffed security operations centre.

FAQ: [Remote work and exposed services](https://netsenx.com/en/faq/remote) · https://netsenx.com/en/faq/who-notices-a-remote-login-at-3-am-on-a-sunday

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/pricing

## Related questions

- [Is remote desktop (RDP) exposed to the internet dangerous?](https://netsenx.com/en/faq/is-rdp-exposed-to-the-internet-dangerous)
- [How do we know if our VPN has been compromised?](https://netsenx.com/en/faq/how-do-i-know-if-our-vpn-is-compromised)
- [Can an infected home laptop spread malware into the office over the VPN?](https://netsenx.com/en/faq/can-an-infected-home-laptop-spread-malware-over-the-vpn)
- [Is it safe to expose SSH to the internet?](https://netsenx.com/en/faq/is-it-safe-to-expose-ssh-to-the-internet)
- [Which services should never be exposed to the internet?](https://netsenx.com/en/faq/which-services-should-never-be-exposed-to-the-internet)