Who knows! That's my struggle with security, unless you have good monitoring in place it's not even trivial to notice problems.

In my case I was only made aware of the compromised VM because my hosting provider sent me very stern email about my server's IP netscanning their entire fricking address range.