Incident Response and Digital Forensics
Compromise Assessment
When there is no known incident, we search your environment for signs of an undetected breach. We report the result clearly, specifying the scope and visibility.
What it is
A compromise assessment determines whether the environment is currently or was recently compromised. Traces are collected from endpoints, identity infrastructure, and cloud accounts. These are analyzed against known attacker behavior and current threat intelligence. Unlike a penetration test, it searches for attacker traces, not vulnerabilities.
Scope
- Collecting persistence and execution traces from servers and workstations
- Reviewing permission and configuration changes in Active Directory and cloud identities
- Searching internet-facing systems for web shells and unauthorized changes
- Searching network and DNS logs for command and control traffic
- Determining whether each finding is a real incident or a false positive
The need
When organizations need it
- Before connecting the network of a company you are acquiring to your own.
- When a software product or service provider you use is reported as compromised.
- When a new CISO wants to determine if the environment they inherited contains an undetected breach.
Method
How we work
-
Scope
We jointly define which systems, timeframes, and log sources will be examined.
-
Collection
We collect traces from systems using your existing EDR or a temporary collection tool.
-
Analysis
We analyze traces using attacker behavior and current threat intelligence, and resolve each indicator.
-
Result
We separately report what was found, what was not, and any areas with insufficient visibility.
Outcome
What you have at the end
You know whether there are signs of a breach in your environment, and for which scope and period. Areas with insufficient visibility and risks to address are also listed.
Frequently asked questions
If nothing is found, does that mean our environment is clean?
A clean environment cannot be guaranteed. The report states that no breach was found in the systems and period examined. Areas with insufficient visibility are listed separately.
What happens if signs of a breach are found?
The assessment transitions to incident response. Since evidence is already collected, response begins immediately.
Incident Response and Digital Forensics
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting