The Confidence Standard · Insight Pillar
Find out if you're already compromised,
before it becomes an incident.
A point-in-time forensic sweep for undetected compromise.
Professional Service, expert-led, project-based work. Deep expertise, delivered with structure.
Part of the Cybersecurity portfolio, Insight pillar.
This service serves the CISO KPI: Risk Awareness.
PILLAR 01
INSIGHT
Compromise Assessment finds what monitoring alone missed.
PILLAR 02
PREVENTION
Findings drive the containment and hardening work that follows.
PILLAR 03
RESILIENCE
Ongoing MDR or XDR closes the visibility gap this assessment surfaces.
Sized to urgency and environment scope.
A due-diligence sweep and a post-rumor investigation need different depth.
RAPID
Fast Answer
Focused sweep across core endpoints and identity logs, built for M&A due diligence or a fast go/no-go answer.
Scope this tier →
STANDARD
Full Environment Sweep
Endpoints, servers, network traffic and identity logs, with a full indicators-of-compromise review and written findings.
Scope this tier →
EXTENDED
Deep Forensic Review
Extended log retention analysis and memory forensics for environments with a specific reason to suspect long-dwell compromise.
Scope this tier →
What a forensic sweep looks for.
Indicators of compromise
Known malicious file hashes, command-and-control traffic patterns and other signatures your existing tools may not flag.
Persistence mechanisms
Scheduled tasks, registry changes and backdoor accounts an attacker sets up to survive a reboot or a password reset.
Lateral movement evidence
Signs an attacker moved between systems using legitimate credentials, which standard antivirus rarely catches.
A clear answer, either way
A documented finding of compromise, or documented assurance that the sweep found none, both usable as evidence.
When this is the right move, and when it's not.
Start here if...
- You have a reason to suspect compromise (a rumor, an anomaly, a third-party warning) but no confirmed incident.
- You are acquiring a company and need assurance about what you are inheriting.
- Your cyber insurance renewal or a client contract requires a documented compromise assessment.
- You want assurance before a major system migration or cloud move that nothing is already inside.
Something else first if...
- You have a confirmed, active incident right now. Emergency response, 24/7 is the right next step.
- You want to test whether your defenses can be exploited, not whether they already have been. Penetration Testing answers that question directly.
- You want ongoing detection instead of a one-time sweep. MDR or XDR covers that continuously.
This rarely stands alone
IF IT FINDS SOMETHING
Rapid Incident Response
A confirmed finding hands off directly to containment and recovery.
CLOSES THE GAP
Managed Detection & Response
Ongoing monitoring so the next compromise doesn't sit undetected for weeks or months.
See MDR →
BROADER BENCHMARK
Skyrocket Cyber Maturity
If the finding is clean, this is the natural next step to harden the whole program
Straight answers before the call.
How is this different from incident response?
Incident response starts after a compromise is confirmed and is about containment and recovery, on the clock. This starts before anything is confirmed: a structured investigation to find out whether compromise exists at all. If it finds evidence of an active incident, the engagement can transition directly into incident response.
How long does it take?
Rapid tier engagements are built to move fast; Standard and Extended tiers take longer given the broader scope.
Will this disrupt our operations?
No. The sweep runs on read-only access and forensic collection agents that don't interfere with normal system operation. There's no need to take anything offline unless the sweep finds something that requires it.
What happens if you find evidence of compromise?
You get a documented finding with chain-of-custody handling intact, so it holds up for legal, insurance or law-enforcement purposes if needed. From there, the natural next step is Rapid Incident Response to contain and recover.
Know for certain, instead of hoping nothing is there.
Get in touch to scope a compromise assessment built to your environment and your reason for asking.