# Why do simple bandwidth alarms miss data theft?

Because they ask the wrong question. A bandwidth alarm asks whether a link is busier than a fixed limit; data theft is usually designed to stay under it. Attackers send in chunks, at night or during busy hours when a few hundred megabytes vanish among backups and video calls, and to cloud storage services your staff also use, so destination lists do not flag them either. A fixed limit also fires on every large legitimate transfer, so people stop reading the alarms. The useful question is per host: is this machine sending more, to a different destination, or at a different time than it normally does? That needs a baseline per host rather than per link. NetSenX keeps such a baseline and flags unusual outbound data volume per host on every plan, Free included.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/why-do-bandwidth-alarms-miss-data-theft

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What does Cobalt Strike activity look like on the network?](https://netsenx.com/en/faq/what-does-cobalt-strike-look-like-on-the-network)
- [Is internal port scanning a sign of an intruder?](https://netsenx.com/en/faq/is-internal-port-scanning-a-sign-of-an-intruder)
- [How do we know if someone is guessing passwords on our internal network?](https://netsenx.com/en/faq/how-to-know-if-someone-is-guessing-passwords-internally)
- [How do we detect large uploads to cloud storage from a server?](https://netsenx.com/en/faq/how-to-detect-large-uploads-to-cloud-storage-from-a-server)
- [What is PsExec or admin-share abuse, and why does antivirus not flag it?](https://netsenx.com/en/faq/what-is-psexec-and-admin-share-abuse)