The website has slowed down, even though visitor numbers haven’t gone up. The CPU stays busy at night, unfamiliar messages keep appearing in the mail queue, and the provider reports suspicious requests from the server’s IP address. The first assumption is usually simple: something has broken. But it may be more serious than that. A server can still look perfectly normal while somebody else is already using it to send spam, attack other systems, or reach stored data.