Apparatus for an optical communications network has optical paths for optical traffic, and optical ports, one of which is an unused output port. A security monitoring system has a blocking part coupled removably to the unused output port to occupy it to prevent unauthorized access. An optical detector can detect optical signals passing through the unused output port to the blocking part, and there is alarm circuitry configured to output an alarm signal based on the detecting of the optical signals. This monitoring can help make the node more secure from interference or from eavesdropping. By blocking the port, the monitoring can be independent of the type of signals on the optical paths. The system can be passive or active, and does not require a change in the installed node configuration and so can be added easily to existing infrastructure.