# Why do companies so often learn about a breach from outsiders?

Because nobody inside was looking in the right place. A customer receives a fake invoice from your hacked mailbox, a bank reports odd transfers, the police or a national CERT find your data on a criminal server, or the attackers announce it on their leak site. Inside the company, the signs were often there but unread: firewall logs nobody reviews, an antivirus alert closed as noise, a server uploading at night. Mandiant's M-Trends reports have repeatedly found that intrusions discovered by an outside party had been running longer than those a company found itself. Hearing it from outsiders also costs you control over the timeline and the message. Reading what already crosses your network changes that; NetSenX turns it into explained alerts for beaconing, scanning, lateral movement and unusual uploads, on every plan, Free included.

FAQ: [Have I been hacked?](https://netsenx.com/en/faq/signs) · https://netsenx.com/en/faq/why-companies-learn-about-breaches-from-outsiders

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing

## Related questions

- [How do we tell a network attack from a heavy update or backup?](https://netsenx.com/en/faq/how-to-tell-a-network-attack-from-an-update-or-backup)
- [How do we know what normal looks like on our network?](https://netsenx.com/en/faq/how-do-we-know-what-normal-looks-like-on-our-network)
- [What is an indicator of compromise (IOC)?](https://netsenx.com/en/faq/what-is-an-indicator-of-compromise)
- [Our antivirus shows everything green. Can we still be compromised?](https://netsenx.com/en/faq/antivirus-shows-green-can-we-still-be-compromised)
- [An administrator account appeared that nobody remembers creating. What now?](https://netsenx.com/en/faq/an-administrator-account-appeared-that-nobody-created)