Intrusion detection for a multimode fiber optic cable uses a light signal launched into the fiber through the low ratio leg of a tap coupler to establish a narrow spectral width, under-filled non-uniform mode field power distribution in the cable. A small portion of the higher order signal modes at the remote end is monitored for transient changes in the mode field power distribution which are characteristic of fiber intrusion to activate an alarm. The active signal of a multimode optical fiber is monitored for both signal degradation and transient power disturbance patterns that could indicate fiber damage or physical intrusion. A translator can be provided in an existing optical fiber system in which the data signals are translated in wavelength and/or launch conditions to optimize the monitoring signals in an otherwise non-optimized system.