We scan the ports where most hacking activities or unauthorized access might take place. We also do regular network monitoring to look for any suspicious activity. We are not perfect at it, but we are like a credit card company looking for some suspicious activity on the network.