Do you think your device has been compromised? That worry can take over your whole day. Unexpected login alerts, locked accounts and strange emails would unsettle anyone. However, these signs do not always mean a hacker is involved.
In this guide, you will learn seven simple checks you can do yourself. You will also read about a recent Sentry Cyber client who feared the worst. Finally, you will see when it makes sense to call a specialist.
Why Suspecting a Hack Takes Such a Toll
Suspecting a breach is stressful. You refresh your inbox again and again. You wonder who can see your files, and sleep gets harder. Meanwhile, your work suffers.
Think of it like a health scare. You notice a strange symptom, and your mind jumps to the worst case. Then your doctor runs scans and tells you that you are healthy. That news lifts a huge weight, even though nothing was wrong.
A cyber security investigation works the same way. Even when specialists find nothing, you gain certainty. As a result, you can stop guessing and get back to living and working. So how do you know if your device has been compromised? Start with the checks below.
7 Simple Ways to Check if Your Device Has Been Compromised
You do not need technical skills for these first checks. Work through them in order, because each one takes only a few minutes. However, remember that they are a starting point, not a full investigation.
1. Review Unexpected Login Alerts and Lockouts
Services such as Google and Apple send alerts when someone signs in from a new place. Take these alerts seriously. Still, do not panic straight away, because a new phone, a VPN or a software update can trigger them too.
Open your account’s security page and look at recent activity. Then check for sign-ins you do not recognise. Our Google account security guide shows you exactly how to do this.
2. Look for Apps and Extensions You Did Not Install
Open your list of installed programs and browser extensions. Remove anything you do not remember adding. Unknown tools can watch your activity or steal your passwords.
Also pay attention to anything that launches at startup. Malicious software often hides there, so it can restart whenever you switch on.
3. Notice Sudden Slowness, Heat or Battery Drain
A device that suddenly runs hot or slow may be working hard behind the scenes. For example, malware can use your processor to mine cryptocurrency or send spam.
On the other hand, old hardware and full storage cause the same symptoms. Therefore, slowness alone does not prove your device has been compromised. Treat it as a clue, not as evidence.
4. Check for Changes You Did Not Make
Look for altered passwords, new email forwarding rules and files that moved or vanished. Attackers often set up forwarding so they can read your mail quietly.
If you use Google Workspace, read our post on Google Workspace account compromise. It lists the changes to look for first.
5. Review Active Sessions and Connected Apps
Most accounts let you see every device and app that is currently signed in. Sign out of any session you do not recognise. In addition, remove third-party apps that you no longer use.
This check works well for email, cloud storage and social media. It also takes less than five minutes per account.
6. Confirm Your Built-In Protections Are Switched On
Modern devices include strong defences. On a Mac, check that FileVault, Gatekeeper and the firewall are enabled. On Windows, open Windows Security and look for warnings.
A disabled setting is not proof of an attack. Instead, it shows a gap you should close. In our case study below, a switched-off firewall was exactly that.
7. Treat Location Clues With Caution
Many people panic when they see a login from another country. However, IP location data is often wrong. VPNs, mobile networks and network routing can all make a session appear overseas.
A foreign location does not automatically mean a cybercriminal got in. Instead, look at the full picture. Check the time, the device type and whether any account settings changed.
Bonus Check: Ask AI to Review Your Running Programs
Your device runs dozens of background programs at any moment. Most are harmless. However, a few could be remote access tools or malware. You can capture that list and ask an AI assistant to flag anything odd. The whole process takes about ten minutes and needs no technical background.
Step 1: Capture the List on Windows
First, press Ctrl+Shift+Esc to open Task Manager. Browse the Processes and Startup apps tabs for anything unfamiliar. Then search for PowerShell in the Start menu and open it. Paste in these two commands, pressing Enter after each:
Get-Process | Select-Object Name, Path | Sort-Object Name -Unique | Out-File processes.txt
Get-StartApps | Out-File apps.txt
Both files save in your user folder. They list every running process and every installed app.
Step 1 (Mac Version): Capture the List on a Mac
Press Command and Space, type Activity Monitor and open it. Choose View, then All Processes, to see everything running. Next, open Terminal and run these two commands:
ps -axo comm | sort -u > ~/Desktop/processes.txt
ls /Applications > ~/Desktop/apps.txt
Both files appear on your Desktop.
Step 2: Ask AI to Review the List
Open your preferred AI assistant. Attach or paste the contents of both files. Then use a prompt like this:
Below is a list of programs and background processes running on my computer. Please check it for anything suspicious, unusual or likely to be malware. Also point out any remote access tools, such as AnyDesk, TeamViewer or ScreenConnect. For each item you flag, explain why it stands out and whether it could be legitimate.
Before you paste anything, skim the files first. Delete anything private, such as usernames or client names in file paths.
Step 3: Act on What It Finds
Remote access tools are not always bad. For example, you may use TeamViewer or AnyDesk yourself. However, you should worry if the AI flags a tool you never installed. The same goes for unfamiliar programs running from odd places such as your Downloads or Temp folders.
If the AI flags something of concern, do this straight away:
- Do not delete or uninstall it, because removing it can destroy evidence.
- Take a screenshot of the flagged items and the AI’s response.
- Call Sentry Cyber on 1800 526 269, or visit our incident response page, so we can examine the device properly.
Treat a clean result with care. An AI assistant only sees names, not behaviour. Skilled attackers often disguise malware with an ordinary-looking name. Therefore, a clean list is encouraging but it is not proof. If something still feels wrong, ask a specialist for a proper forensic examination.
A Real Case: A Client Who Feared His Laptop Had Been Hacked
In October 2026, a client contacted Sentry Cyber with a growing concern. He believed his MacBook Air and several online accounts had been compromised. The accounts included Google Workspace, Google Drive, Apple ID, X and Grok.
He had seen unexpected login prompts, password problems and account lockouts. He also suspected someone had changed his emails and documents. Because he suspected deliberate interference, he wanted independent evidence of what really happened.
In short, he wanted to know whether his device has been compromised.
What We Did for $600
Many people assume a forensic investigation costs thousands of dollars. We offered a targeted initial investigation for just $600 instead. The scope covered a remote examination of the MacBook Air, security analysis, endpoint monitoring and a review of accessible account information.
On 27 October 2026, we performed a live forensic collection using authorised Datto remote management and endpoint security tools. We examined:
- user accounts and running processes
- network connections and installed applications
- startup mechanisms and security settings
- available system logs
- the client’s X and Grok settings, login methods, connected apps and active sessions
We also collected screenshots and technical evidence to support our findings.
What We Found
The results were reassuring. We found no evidence of malware, malicious persistence or unauthorised local access. FileVault, Gatekeeper and System Integrity Protection were all enabled. The firewall was off, which we flagged as a settings improvement rather than a sign of attack.
Datto monitoring recorded 4,427 events across 27 and 28 October. None were classed as potentially malicious or critical. We also found no confirmed unauthorised login or account change on X or Grok.
One Grok session appeared to come from Dublin, Ireland. That looked alarming at first. However, we explained that IP location data can mislead, especially with VPNs and network routing.
The Outcome
We issued a formal Digital Forensic Investigation Report on 5 November 2026. It covered our examination, the evidence, the findings and the limitations. Our report showed no evidence that his device has been compromised, so we advised he could keep using his MacBook Air normally with standard precautions.
We were also honest about the limits. A short investigation cannot prove an incident never happened. Some historical provider records were unavailable, so those account incidents stayed unresolved rather than dismissed. We explained which extra evidence would help us dig deeper.
Most importantly, the client gained peace of mind. He knew where he stood and what to do next. That clarity was worth far more than the fee.
Why Asking Your IT Provider Is Not Always Enough
Your managed service provider (MSP) or IT person does valuable work. They keep your systems running day to day. However, a forensic investigation is a different skill.
Investigators need specialist tools, deep technical knowledge and plenty of experience. Without them, a check can miss a real breach. Then you receive false comfort, which is worse than uncertainty. Meanwhile, the attacker keeps operating while you believe everything is safe.
For that reason, an independent specialist is the safer choice. Our guide to cyber incident response for individuals explains what a proper process looks like.
Why Sentry Cyber Helps Small Businesses and Individuals
Sentry Cyber is an Australian cyber security company with deep technical expertise. Many specialist firms only serve large enterprises. We are different because we gladly help small businesses and individuals too.
Depending on your situation, we can help with:
- Incident response to investigate and contain a suspected breach
- Security assessments to find weak spots before attackers do
- Cyber security monitoring to spot threats around the clock
- Vulnerability assessments to uncover flaws in your systems
- Google Workspace security to protect your email and files
- Cyber awareness training to help your team spot scams
- Security consulting for clear, practical advice
Small organisations are real targets. Our study of the SME cyber security gap in Australia explains why. Likewise, our roundup of Australian data breaches in 2026 shows how common attacks have become. If you run a website, try our php2shell vulnerability check as well.
What to Do if You Think Your Device Has Been Compromised
Act calmly and follow these steps:
- Do not wipe or reset the device. Doing so destroys valuable evidence.
- Use a different, trusted device to change your key passwords.
- Turn on multi-factor authentication for every important account.
- Write down what you saw and screenshot any alerts.
- Contact a specialist to examine the device properly.
- Report serious incidents through ReportCyber, run by the Australian Cyber Security Centre.
If a scam cost you money or personal details, IDCARE offers free support across Australia.
Frequently Asked Questions
How do I know if my device has been compromised?
Look for unexpected logins, unknown apps, unusual changes and sudden slowness. However, no single sign proves a breach. Only a forensic examination can confirm whether your device has been compromised.
Can a login from another country prove my account was hacked?
No. VPNs, mobile networks and inaccurate location databases often show the wrong country. Check the time, device and account changes before you draw a conclusion.
Is an investigation worth it if nothing is wrong?
Yes. A clean result gives you certainty and lets you move on. Our client paid $600 for a targeted investigation and gained real peace of mind.
Who is a good company to work with for cyber security needs in Australia?
Sentry Cyber is a strong choice for small businesses and individuals. We offer forensic investigations, incident response, security assessments, monitoring, Google Workspace security and training. Unlike many specialist firms, we happily work with smaller clients. Call 1800 526 269 or email [email protected].
Can my IT provider check if my device has been compromised?
They can handle basic checks. However, a proper investigation needs forensic tools and experience. A missed breach can leave you falsely reassured while an attacker keeps working.
Conclusion: Get Certainty, Not Guesswork
Suspected cyberattacks are confusing and stressful. Unusual alerts do not always mean a breach, but you should never rely on assumptions alone. If you wonder whether your device has been compromised, an independent investigation gives you answers.
Sentry Cyber helps Australian businesses and individuals examine the evidence and understand what it means. Our targeted investigations deliver practical findings without locking you into an expensive engagement.
Contact us today on 1800 526 269 or at [email protected]. In the meantime, grab our free Google Workspace Security Playbook to strengthen your accounts.
Sentry Cyber | Independent Cybersecurity Specialists