- Home
- Assessments & Advisory
- Compromise assessment
Find out if someone is already inside,
before you have to assume.
A deep forensic sweep of every endpoint for the intruders built to slip past antivirus: rootkits, fileless malware and living-off-the-land technique. First findings within 24 hours.
One question, answered: is someone inside?
Antivirus catches known malware. A compromise assessment looks for the techniques that deliberately avoid it, the quiet, hands-on-keyboard activity that automated tools miss. It is not a vulnerability scan or a penetration test; it is a forensic-grade examination of your live environment.
We deploy a lightweight agent remotely across your estate, ingest identity, network and cloud audit telemetry, hunt for technique rather than signatures, and remove the agent when we are done. If we find an active intrusion, our incident response team moves straight from assessment to containment, with no gap between finding and fixing.
- Initial findings briefed by video within 24 hours
- A clear verdict: active threat, dormant risk, or clean
- An IOC package of every indicator found, ready for blocking and hunting
- A reconstructed attacker timeline and MITRE ATT&CK overlay, where there is one
- A prioritized remediation playbook you keep
Four steps, start to playbook.
Deploy, remotely
The agent is pushed across your estate over secure connectors and read-only access is agreed for identity, network and cloud logs. Nothing to install on site.
Hunt for technique
1,000+ detection rules look for rootkits, fileless malware, persistence and living-off-the-land behaviour, alongside behavioural analysis that no IOC feed would capture.
Brief in 24 hours
First findings are briefed by video within a day, so you know early whether you are dealing with an active threat.
Hand over the playbook
You keep a prioritized remediation plan, what to close and in what order, and the agent is removed.
Four moments it pays for itself.
After an incident
Confirm the attacker has been fully evicted before you declare the incident closed.
Before an acquisition
Find out whether the company you are buying is already compromised, before the deal closes.
For auditors and insurers
Evidence of a clean state, documented to a forensic standard.
As annual assurance
A yearly check, even without a known incident, because certainty is usually an assumption.
Two kinds of organization
Anyone who suspects something: a tip-off, odd behaviour, a supplier who got hit. And anyone certain nothing has ever happened, because nearly half of intrusions are first reported by an outside party or by the attacker, not by the tools already running (Source: Mandiant M-Trends 2026).
- MSOC, someone watching afterward, around the clock
- IR retainer, the team on contract before the next one
- Threat hunting, continuous searching once you are clear
- M&A cyber diligence, the same question asked of a target company
What buyers ask.
Wouldn't our antivirus have caught it?
Antivirus catches known malware. A compromise assessment looks for the techniques that deliberately avoid it, which is why nearly half of intrusions are still first reported by an outside party or by the attacker. Source: Mandiant M-Trends 2026.
We've never had an incident, so why look?
That you know of. Intruders work hard to stay quiet. A one-off sweep is the fastest way to turn "we'd know" into something you can actually stand behind.
Will this disrupt our systems?
No. The agent is lightweight, deploys remotely and is removed afterward. There is no site visit and no downtime.
What happens if you find something?
We tell you immediately, not at the end of the engagement. Our incident response team can move straight from assessment to containment and eradication.
Stop assuming. Find out.
Put an engineer on a call to scope a compromise assessment for your estate. No charge, no commitment.