Cybersecurity
Compromise assessments
If you wanted to be sure nobody is already inside, how would you check? A compromise assessment answers that by examining your environment for known attacker techniques and traces, then reporting what was found and what could not be checked.
The problem this service solves
After an acquisition, a contractor breach or a sector-wide campaign, leaders ask whether they have already been affected. A vulnerability scan cannot answer that. An assessment of this kind searches for behavior and artifacts instead.
No assessment proves a negative. We report what we checked, what we found, and what telemetry was missing, so you know how much weight the result carries.
What is in scope
-
Endpoint and server review
Persistence, unusual processes, remote access tools, credential dumping indicators and scheduled tasks.
-
Identity review
Privileged account changes, new service principals, suspicious authentication, mailbox rules and OAuth consents.
-
Cloud review
Unexpected keys, roles, resources and cross-account activity.
-
Network review
Beaconing, rare destinations, data movement and unusual protocol use.
-
Known-threat hunting
Indicators and techniques from current campaigns relevant to your sector.
-
Visibility assessment
What data we could not review, and why that limits the result.
How the work runs
Prepare
Understand and collect.
-
1
Scoping
Choose sample systems, accounts and cloud environments and agree collection methods.
-
2
Collection
Gather lightweight triage data and log exports.
Analyze
Look for traces.
-
3
Hunting and triage
Search for techniques and indicators, investigate anomalies.
-
4
Escalation
If evidence of compromise appears, move to incident response and notify immediately.
Report
State findings and limits.
-
5
Report
What was checked, what was found, confidence and gaps.
-
6
Recommendations
Hardening and visibility improvements.
What you receive
- Findings report
- Coverage statement: what was and was not examined
- Anomalies investigated and their explanations
- Visibility gaps and priorities
- Hardening recommendations
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Read access to logs and consoles
- Permission to run collection tools on sample hosts
- Contacts for system owners
What this service is not
- A guarantee that you are not compromised
- Continuous monitoring
- An incident response (though we can move into one)
What changes afterwards
- You have evidence-based confidence, with stated limits
- Visibility gaps are known
- Any hidden access is found early
Questions people ask
Does a clean result mean we are safe?
It means we did not find signs of compromise in what we examined. We state the coverage and the data we lacked so you can judge the confidence.
What if you find something?
We tell you immediately, preserve evidence and discuss incident response.
Related
-
Threat hunting
Hypothesis-driven searches through your telemetry for attacker behavior that automated detections missed.
-
Digital forensics and incident response
Investigate suspected intrusions: preserve evidence, determine scope, support containment and recovery, and document what happened.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response