Would You Know If a Hacker Was Already Inside Your Network?

October is Cybersecurity Awareness Month.

We’ve spent a lot of time talking about keeping attackers out.

Strong passwords.

Multi-factor authentication.

Employee training.

Firewalls.

Email security.

Vendor controls.

All of those things matter.

But here’s a question that doesn’t get asked nearly enough:

What if the attacker is already inside?

I was talking with a business leader once about cybersecurity when he asked me:

“Rusty, wouldn’t we know if somebody got into our network?”

I wish the answer were always yes.

Cyberattacks don’t necessarily begin with computers shutting down and giant ransom messages appearing on screens.

Sometimes the first sign is much quieter.

An unusual login.

A new email forwarding rule.

An administrator account behaving differently.

A security tool being disabled.

A user accessing something they normally don’t.

The activity may look small by itself.

The question is whether someone is watching closely enough to connect the dots.

That’s why Cybersecurity Awareness Month shouldn’t only be about prevention.

It should also be about detection.

Here are seven warning signs every credit union should understand.

1. Unusual Login Activity

Let’s start with identity.

An employee normally signs in during business hours from the same devices.

Then something changes.

There’s an unusual sign-in.

An unexpected device appears.

Authentication behavior changes.

There are repeated failed login attempts.

Or an account begins generating activity that doesn’t fit the employee’s normal pattern.

Does unusual activity automatically mean you’ve been hacked?

No.

People travel.

Employees get new devices.

Passwords get forgotten.

But unusual activity can be a reason to investigate.

The important question for leadership is:

If something unusual happened with an employee account tonight, would somebody know to look at it?

2. Unexpected MFA Requests

Imagine you’re sitting at home watching television when your phone asks you to approve a login.

You aren’t logging in.

What do you do?

An unexpected authentication request should get an employee’s attention.

Employees should understand a simple rule:

If you didn’t initiate the login, don’t approve the request.

And don’t stop there.

Report it.

An unexpected MFA request could mean someone else has obtained information associated with the account and is trying to complete the login process.

That’s why employee education and technical monitoring have to work together.

Your employee may be the first security alert.

3. Strange Email Activity

Email accounts can be valuable to attackers because they provide something important:

Trust.

If an attacker gains access to an employee’s mailbox, they may try to monitor conversations, impersonate the employee, or manipulate communication.

Warning signs could include unexpected changes to mailbox settings, suspicious forwarding behavior, unusual sent messages, or employees reporting messages they don’t remember sending.

Imagine an attacker gets into a legitimate employee mailbox.

Now a fraudulent request isn’t coming from an obviously fake address.

It’s coming from someone your staff already knows.

That’s a different problem.

This is why Microsoft 365 security deserves more attention than simply asking:

“Is our email working?”

The better question is:

“Would we recognize unusual behavior inside an employee’s account?”

4. Unexpected Account or Permission Changes

Access changes deserve attention too.

A new administrator appears.

Permissions change unexpectedly.

An old account becomes active again.

A user receives access they don’t normally need.

A vendor account changes.

Maybe there’s a perfectly reasonable explanation.

Maybe there isn’t.

The principle is simple:

Important changes should be visible.

This is especially true for privileged accounts.

An employee with ordinary access and an administrator with broad control don’t represent the same level of risk.

The more powerful the account, the more carefully changes involving that account should be monitored and reviewed.

5. Security Tools Stop Working

Here’s one that should get your attention.

A security service that normally reports information suddenly stops.

An endpoint goes quiet.

Logging changes.

Security software is unexpectedly disabled.

Monitoring stops reporting from a device.

Again, there can be legitimate explanations.

Software has problems.

Devices get replaced.

Configurations change.

But if something responsible for protecting or monitoring your environment suddenly stops doing its job, somebody should notice.

A smoke detector isn’t much help if nobody realizes the battery has been removed.

6. Devices Start Behaving Differently

Employees may notice things before your security tools do.

A computer suddenly becomes unusually slow.

Programs behave strangely.

Files change unexpectedly.

A device begins crashing.

An application opens when nobody launched it.

The employee may think:

“My computer is acting weird today.”

Maybe it’s just a technology problem.

But employees should know when unusual behavior deserves to be reported.

You don’t want people trying to diagnose a potential security incident by themselves for three hours because they don’t want to bother IT.

Give them a clear reporting process.

Let your technology team determine whether the problem is routine or something that requires investigation.

7. Your Vendors Report Something Unusual

Remember Blog #5 of our Cybersecurity Awareness Month series?

Your vendors are part of your cybersecurity environment too.

Sometimes the first indication of a problem may come from outside your organization.

A technology provider may notice unusual activity.

A software vendor may report an incident.

A cybersecurity partner may identify suspicious behavior.

A financial or business partner may question an unusual communication.

Your credit union needs a process for handling those notifications.

Who receives them?

Who investigates?

Who decides whether leadership needs to be involved?

Who documents what happened?

A warning only helps when it reaches the right person.

Prevention and Detection Need to Work Together

I sometimes see organizations put almost all their attention on prevention.

“How do we stop this from happening?”

That’s a good question.

Keep asking it.

But add another:

“How quickly would we know if prevention failed?”

Think about your physical building.

You lock the doors.

That’s prevention.

You may also have alarms, cameras, and procedures for suspicious activity.

That’s detection.

You don’t install an alarm because you expect the locks to fail.

You install it because security works better in layers.

Cybersecurity should work the same way.

A Simple Detection Framework: WATCH

During Cybersecurity Awareness Month, use the WATCH framework to start a detection conversation.

W — Watch Important Activity

Identify the systems, accounts, and events that deserve monitoring.

A — Alert the Right People

Make sure meaningful security alerts reach someone who can act.

T — Triage Quickly

Determine whether unusual activity is harmless or needs further investigation.

C — Contain the Problem

If an incident is confirmed, follow your incident response process to limit the impact.

H — Hunt for the Cause

Understand what happened, what was affected, and what needs to change.

Watch. Alert. Triage. Contain. Hunt.

You don’t need every employee to memorize cybersecurity terminology.

But leadership should understand whether those five capabilities exist.

Seven Questions to Ask Your Technology Team

During Cybersecurity Awareness Month, sit down with your technology team or IT provider and ask:

1. What security activity are we monitoring today?

2. Which accounts and systems receive the highest level of attention?

3. Who receives important security alerts?

4. What happens after an alert is generated?

5. How quickly would we investigate a suspicious employee account?

6. What happens after business hours?

7. When was the last time our monitoring detected something that required investigation?

That last question is especially useful.

You aren’t looking for a sales presentation about monitoring software.

You’re trying to understand the process.

Something happens. Who sees it? What happens next?

Don’t Confuse More Alerts With Better Security

Here’s another trap.

More alerts don’t automatically mean better cybersecurity.

If your technology team receives hundreds or thousands of notifications and nobody knows which ones matter, you’ve created noise.

The goal is not:

Alert on everything.

The goal is:

Identify meaningful activity and make sure the right people can respond.

Ask your IT or security provider how alerts are prioritized.

What requires immediate action?

What gets investigated?

What gets documented?

What gets escalated to leadership?

Technology can generate information.

People still need a process for using it.

What Happens at 2:13 A.M.?

Here’s one of my favorite questions for leadership.

“If something suspicious happened at 2:13 Sunday morning, what would happen?”

Not Monday at 9:00.

Sunday morning.

Would an alert be generated?

Would anyone receive it?

Would someone investigate?

Could they take action?

At what point would leadership be contacted?

Your answer tells you quite a bit about your cybersecurity monitoring strategy.

Cybercriminals don’t keep credit union business hours.

Your security plan shouldn’t depend on them being polite enough to wait until Monday morning.

Employees Are Part of Your Detection System

Technology isn’t your only source of information.

Remember Blog #2 in this Cybersecurity Awareness Month series?

We talked about building a security-minded team.

That matters here too.

An employee may notice:

“I didn’t send that email.”

“I didn’t approve that login.”

“I didn’t change that setting.”

“My computer is doing something strange.”

“This request doesn’t look right.”

Teach employees to report those things.

And make reporting easy.

The faster information gets to the people who can investigate it, the better.

What Should Leadership Measure?

You don’t need a dashboard with 100 cybersecurity metrics.

Start with useful questions.

How quickly are important alerts reviewed?

How quickly are confirmed incidents escalated?

Are critical systems being monitored?

Are privileged accounts receiving appropriate attention?

Are employees reporting suspicious activity?

Are repeated problems being addressed?

And perhaps most importantly:

When something happens, are we learning from it?

That’s the difference between collecting cybersecurity data and building a cybersecurity program.

Cybersecurity Awareness Month Challenge: Ask “Would We Know?”

Take 30 minutes this month.

Gather your leadership and technology team.

Then walk through five situations:

An employee’s password is compromised. Would we know?

Someone creates an unexpected administrator account. Would we know?

A vendor account starts behaving strangely. Would we know?

A Microsoft 365 mailbox is changed unexpectedly. Would we know?

A security tool stops reporting. Would we know?

You may answer yes to all five.

Great.

Now ask:

“How do we know?”

That’s where the real conversation starts.

Final Thoughts

Cybersecurity isn’t only about keeping the bad guys outside the door.

It’s also about recognizing when something isn’t right inside.

Watch important activity.

Get meaningful alerts to the right people.

Investigate quickly.

Contain confirmed problems.

Understand what happened.

Train employees to report suspicious behavior.

And test whether the process actually works.

Cybersecurity Awareness Month gives us a good reason to ask:

“Would we know?”

But that question shouldn’t disappear when October ends.

Because an attacker doesn’t necessarily announce themselves.

Sometimes the first warning is small.

One unusual login.

One unexpected MFA request.

One strange email rule.

One account change.

One employee saying:

“Something doesn’t look right.”

The organizations that are prepared are the ones ready to listen.

Would Your Credit Union Know If Something Was Wrong?

At CTG, we help credit unions look beyond cybersecurity products and understand how the entire security process works—from prevention and identity protection to monitoring, detection, incident response, ransomware recovery, Microsoft 365 security, business continuity, vendor risk, and long-term technology planning.

For more than 26 years, CTG has helped organizations make better technology decisions, backed by a team with more than 200 years of combined experience.

Our vendor-agnostic approach means the conversation starts with your environment and your risks—not a product we’re trying to sell.

This Cybersecurity Awareness Month, ask your technology team one question:

“If an attacker got into one of our accounts tonight, how quickly would we know?”

If the answer isn’t clear, let’s find out.

Talk with CTG

Phone: 330-655-8144

Email: brett.harney@ctgusa.net

Website: ctgusa.net

Let’s identify the gaps between prevention and detection—and build a cybersecurity strategy that helps your credit union recognize trouble before a small problem becomes a much bigger one.