A method for detecting an attack on a work environment connected to a communication network includes: electronically emulating, by a network security device connected to the communication network, the work environment; registering, by the network security device, network traffic; comparing, by the network security device, the registered network traffic with predefined network traffic; and triggering, by the network security device, a first attack warning signal in the event of a deviation between the registered network traffic and the predefined network traffic.