COMPROMISE ASSESSMENT: Investigate the signs that an intrusion may have gone unnoticed.
A compromise assessment examines selected systems and available records for signs of attacker activity that may have gone unnoticed. We investigate suspicious accounts, exposed assets or concerns left by an earlier incident, distinguishing observed evidence from unresolved questions and explaining where collection or retention gaps limit the conclusions.
- Discipline
- Managed Security & Advisory
- Engagement type
- Assessment
A focused investigation into a specific concern.
After an exposure
A vulnerable or misconfigured service was accessible and you need to examine whether it may have been used.
After an unexplained event
An alert or unusual access pattern needs investigation beyond the original response.
After a change in responsibility
You are taking ownership of an environment with limited visibility into its security history.
After an earlier incident
You want to investigate remaining concerns within a defined scope rather than assume the original cleanup settled them.
Frame the question before collecting the evidence.
We agree the concern being investigated, the relevant systems and the period that can be examined. Available endpoint records, identity activity, cloud logs and other evidence are assessed against that question. Where appropriate to the environment, the investigation looks for suspicious access, persistence, privilege changes and movement between systems.
Some checks require additional access or collection. We explain their purpose and any operational impact before they are introduced.
Establish what the investigation can support.
What you receive
The systems, evidence sources and time period examined.
Relevant observations, their interpretation and confidence in the findings.
Affected accounts or systems where the evidence supports that conclusion.
Actions needed to contain or investigate concerns further.
Gaps in records or visibility that restrict what can be determined.
If we identify signs of active compromise, the priority shifts to response. We raise the issue promptly and agree the next actions rather than wait for the assessment report.
Is this the same as penetration testing?
No. Penetration testing examines how weaknesses can be exploited under controlled conditions. A compromise assessment investigates evidence of actual or suspected attacker activity in the environment.
Does a clean result prove we were never breached?
No. An assessment can report that no evidence was identified in the agreed scope. It cannot establish what happened outside the systems, records and time period available to investigate.
Can the assessment work with limited historical logs?
Potentially, but the investigation and confidence in historical conclusions will be limited. We assess the available sources before agreeing a scope that would overstate what can be answered.
Give the concern a defined investigation.
Tell us what prompted the question and which systems may be involved. We can establish what evidence is available and what the assessment could reasonably determine.
Related services: Managed SOC / MDR.