A computer implemented method for remote intrusion monitoring of a networked device. The method includes: receiving, by an intrusion detection engine connected to a network, a network communication to a first networked device; transmitting, via the intrusion detection engine, a duplicate of the network communication to a second networked device, wherein the second networked device hosts at least one virtual model of the first networked device; applying the duplicated network communication to the at least one virtual model of the first network device hosted by the second networked device; and monitoring, using a monitoring engine, the at least one virtual model of the first networked device upon reception of the duplicated network communication by the at least one virtual model.