Compromise Assessment

A Compromise Assessment typically begins by defining the systems and data sources to be reviewed. Security specialists then analyze endpoint, network, cloud and identity data for signs of malicious activity, validate suspicious findings and provide clear recommendations for remediation or further investigation. 

A vulnerability assessment looks for weaknesses that attackers could potentially exploit. A Compromise Assessment looks for evidence that an attacker may already have exploited a weakness and gained access to the environment. While the two services are complementary, they answer different security questions. 

A Compromise Assessment is usually a focused, point-in-time investigation designed to determine whether evidence of compromise is present. Threat hunting is a more proactive process that searches for hidden attacker activity using hypotheses, threat intelligence and behavioural analysis, often as part of an ongoing security program. 

A Compromise Assessment is used to determine whether evidence of malicious activity or compromise exists. Incident Response is activated when an incident requires containment, investigation, eradication and recovery. If a Compromise Assessment identifies active compromise, the engagement may escalate into a full Incident Response investigation. 

Indicators of Compromise, or IoCs, are pieces of evidence that may suggest malicious activity has occurred. Examples can include suspicious IP addresses, malicious files, unusual authentication activity, unexpected processes, attacker infrastructure and other artifacts linked to known or suspected threats.

Yes. Where sufficient evidence remains available, a Compromise Assessment can identify signs of historic attacker activity as well as current compromise. The ability to investigate previous incidents depends on factors such as log retention, endpoint data availability and how much time has passed since the suspected activity occurred. 

It can help identify evidence that an attacker is currently active within the assessed environment. This may include suspicious authentication, malicious processes, unusual network activity or persistence mechanisms. If active compromise is confirmed, immediate Incident Response may be required to contain and investigate the threat. 

The exact scope depends on the organization and available data. An assessment may include endpoint and EDR data, network and security logs, cloud environments, user identities, authentication activity and other relevant security telemetry needed to identify signs of compromise. 

The duration depends on the size and complexity of the environment, the amount of data available and the scope of the assessment. A focused assessment may be completed relatively quickly, while larger environments or investigations involving multiple data sources may require more extensive analysis.

No. Organizations may request a Compromise Assessment for additional assurance even when there is no confirmed incident. It can be useful following suspicious activity, a major vulnerability, an acquisition, a third-party incident or whenever greater confidence is needed that existing controls have not been bypassed. 

Yes. Where relevant data is available, a Compromise Assessment can include cloud platforms and SaaS environments. Analysis may focus on suspicious authentication, compromised identities, unusual access patterns, malicious applications and other evidence of unauthorized activity. 

Yes. Identity and authentication data can be analysed for signs of account compromise, including unusual sign-ins, suspicious access patterns and other activity inconsistent with normal user behaviour. Findings can help determine whether additional accounts or systems may also require investigation. 

If malicious activity is identified, the findings are validated and the organisation is advised on the appropriate next steps. Depending on the severity of the compromise, this may include immediate containment, Digital Forensics, credential remediation, further threat hunting or escalation to Emergency Incident Response. 

No assessment can guarantee that an environment is completely secure. A Compromise Assessment provides evidence-based assurance based on the systems, data sources and time period reviewed. If no signs of compromise are found, this means no evidence was identified within the scope of the assessment, rather than proving that compromise is impossible.