Obviously, examination ahead of and right after patching. You need to be inside the behavior of checking the login/logout occasions of users. Frequently a location Check out will do. Personally, I just look for anything at all out of your regular. As an illustration, a VPN consumer logging in at two PM from unrecognized IP address should be a pink