A fiber network is monitored in order to detect physical intrusion. The state of polarization of an optical fiber is monitored. A fiber tap is determined to have occurred if the state of polarization of the fiber changes beyond a predetermined amount found to be associated with all types of fiber taps. Alternately, it may be determined that a fiber tap has occurred if the state of polarization changes beyond a second predetermined amount and in a predetermined direction. Monitoring of the state of polarization occurs before and after a time period chosen to be less than a time during which the state of polarization of the optical fiber is expected to drift. This step eliminates false positives due to natural fiber PMD drift.