Français
Nederlands
DeutschCompromise assessment
An email sent without your knowledge, an invoice altered at a customer's, credentials found in a leak: before concluding there has been an intrusion, or ruling it out, you need facts. We look for traces of an attacker in your systems, within a scope and with deliverables fixed in advance.
When to request one
- A customer or supplier received a fraudulent email or invoice that seems to come from you.
- Your credentials, or your staff's, appear in a data leak.
- A partner, your IT provider or software you use has been hacked.
- An incident was 'cleaned up' without investigation, and you want to know whether the attacker has really gone.
- Before an acquisition, or after the acrimonious departure of someone with administrator rights.
What we examine
Accounts and mailboxes
Unusual sign-ins, forwarding rules, delegated access, authorised applications and emails sent without your knowledge.
Workstations and servers
Persistence mechanisms, scheduled tasks, remote-control tools installed without your knowledge and execution traces.
Directory and privileged accounts
Accounts created or reactivated, additions to administrator groups and unexplained changes in rights.
Remote access and perimeter
VPN, firewall and remote access logs, services exposed on the internet.
Leaked credentials
Presence of your domains and addresses in known data leaks.
Indicators of compromise
Comparison with the indicators published for ongoing campaigns, including by the CCB.
How it works
A compromise assessment cannot prove that no attacker is present: it establishes what the traces examined show, and what they do not cover. That is why the scope is set in writing.
Scoping
Scope (accounts, workstations, servers, period), available sources and access, set in writing together with the timeframe and price.
Collection
Retrieval of logs and traces with recognised tools, without interrupting your business and preserving their evidential value.
Analysis
Searching for signs of intrusion and persistence, cross-checking sources and manually verifying every alert.
Conclusions
Report: what was examined, what was found and the limits of the review. If a compromise is confirmed, the engagement continues as incident response, with your agreement.
Frequently asked questions
How does it differ from a penetration test?
A penetration test looks for the doors an attacker could use. A compromise assessment looks for traces of an attacker who may already have come in. The two complement each other.
What if you find something?
We tell you immediately, without waiting for the report. The evidence collected is preserved, and the engagement can continue as incident response, with your agreement.
Do we need to install software on our machines?
It depends on the sources available. Logs from your online services are reviewed with read-only access; on workstations and servers, a collection tool may be run temporarily. The scoping specifies what will be used.
Does 'nothing found' mean 'no risk'?
No. It means that no trace of compromise was found within the scope examined, over the period covered by the available logs. The report says so explicitly and suggests measures to detect a future attempt more effectively.