Abstract: A security method in a network environment comprising a corporate network populated with one or more devices connectable to the corporate network over a first communication interface and connectable to other devices over a device-to-device communication interface distinct from the first communication interface, each device comprising a node in the network, one or more of the devices comprising a mobile device and one or more of the devices comprising an intentionally vulnerable node in the network, the method comprising: logging exchanged messages across the interfaces at the intentionally vulnerable node; monitoring the interfaces; identifying a candidate malicious message; tracking back from messages, including from a candidate malicious message; determining the paths used by the messages; determining the source and/or destination of a path to localise the candidate malicious message source.