Unexplained Anomalies
Sign-ins at unusual times, disabled security software or nighttime data traffic – harmless individually, but together possibly a pattern.
Incident Response & Forensics
Compromise Assessment: Are Attackers Already in Your Network?
Clarity instead of gut feeling.
Not every attack is noticed right away: attackers gain access, set up backdoors and wait. With a compromise assessment, we specifically search endpoints, logs, identities and cloud services for traces of current and past attacks. You get a well-founded answer as to whether there are signs of compromise in your environment – and what to do next.
- Endpoints, identities & cloud
- Remote & on-site
- Individual quote
Definition
What Is a Compromise Assessment?
A compromise assessment is a proactive, structured examination of your IT environment for signs of compromise. It answers the uncomfortable question: “Have we been hacked – and are the attackers still here?” Unlike in digital forensics, there is usually no confirmed incident at the outset, but rather a trigger: a suspicion, a warning from outside, an acquisition or the desire for certainty.
To do this, we combine a broad search for known traces of intrusion (indicators of compromise, IoCs) with the analysis of suspicious behavior patterns (indicators of attack, IoAs) and hypothesis-driven threat hunting – on endpoints, in logs, in Active Directory and in cloud services such as Microsoft 365 and Entra ID.
This means the assessment answers a different question than a vulnerability assessment or a penetration test. Those show where attackers could get in – a compromise assessment searches for traces of attackers who may have taken that path long ago. That’s crucial, because an update closes a vulnerability but doesn’t remove a backdoor that’s already installed. In addition, attackers often disguise themselves with valid credentials and legitimate tools – activity that no vulnerability scan uncovers.
Our Approach
How We Search for Traces of Attackers
It starts with a confidential conversation about the trigger, your environment and your goals. If there’s a specific suspicion, we coordinate communication via a separate channel so that attackers who may be reading along don’t notice anything.
For data collection, we use your existing EDR, temporary collection tools or exports of logs and audit logs. We specifically collect the artifacts that attackers leave behind. We secure cloud logs first because, depending on the license, some of them are retained for only days or weeks.
In the analysis, we check the data against current IoCs, look for outliers and test hypotheses: Were credentials read from memory? Is remote maintenance software running that nobody approved? We verify suspicious findings forensically – and if a suspicion is substantiated, we inform your designated contact person immediately.
Typical Triggers
Have We Been Hacked? Reasons for a Compromise Assessment
Warning from Outside
Tips from the BSI (Germany’s Federal Office for Information Security), the police, your IT service provider or business partners deserve to be checked – even if everything seems normal internally.
Exploited Vulnerability in Edge Systems
A critical vulnerability in a VPN gateway, firewall or mail server was actively exploited before your update was installed. We determine whether attackers used that window of opportunity.
Leaked Credentials
Passwords or internal data turn up in data leaks or on the dark web, for example reported by our Dark Web Monitoring. We determine whether they were used for access.
Acquisition or Merger
Before you connect the network of an acquired company, you should know whether you’d be taking on attackers as well.
Around Audits and Compliance Evidence
Before a certification or before providing evidence to supervisory authorities – or when an audit has revealed gaps in logging – find out whether there are signs of an undetected compromise.
After a Security Incident
Were all access paths really removed? In module DER.2.3 of its IT-Grundschutz framework, the BSI warns that if the cleanup after a targeted attack remains incomplete, the attackers are very likely to return – for example, after a longer dormant period.
How It Compares
Compromise Assessment, Pentest or Vulnerability Assessment?
Three services, three questions – they complement each other, but they don’t replace each other.
Where Are We Vulnerable?
Vulnerability Assessment
Finds known vulnerabilities across the board – verified and prioritized.
- Looking ahead: possible entry points
- Method: scans with manual verification
- Result: list of open vulnerabilities
Can an Attacker Get In?
Penetration Test
Exploits vulnerabilities in a controlled way and demonstrates how far an attacker could get.
- Looking ahead: real-world exploitability
- Method: manual attacks based on recognized standards
- Result: proven attack paths
Is Someone Already In?
Compromise Assessment
Searches for traces of actual attackers – current or past.
- Looking back and at the present: real activity
- Method: IoC search and threat hunting
- Result: a verdict on compromise
Process
How a Compromise Assessment Works
Discreet and – as across our entire Incident Response & Forensics practice – based on recognized incident response phases.
-
01
Preparation & Scoping
A confidential initial consultation, with a non-disclosure agreement if you wish. We define the systems, data sources and time period, clarify data protection and co-determination issues, and prepare an individual quote.
-
02
Data Collection
Collection tools or your EDR, export of logs and cloud audit logs – remotely or on-site, read-only and resource-friendly, and as passive as possible in OT networks.
-
03
Detection & Analysis
IoC matching, behavioral analysis and threat hunting across endpoints, identities, network and cloud, mapped to MITRE ATT&CK.
-
04
Verification & Escalation
We verify suspicious findings forensically. If a compromise is confirmed, we inform you immediately and, if you wish, support containment, eradication, recovery and reporting obligations.
-
05
Report & Follow-Up
Results report and debriefing with management and IT. Afterward, we remove any tools that were installed temporarily.
Results Report
A Clear Verdict, Backed by Evidence
At the end, there’s a clear overall assessment: compromise detected, indicators requiring clarification, or no signs within the scope examined. We document which systems, data sources and time periods we examined – and where missing logs limit the validity of the results.
- Executive summary with overall assessment and need for action
- Scope examined, data sources and time period
- Findings with evidence, timestamps, systems and accounts
- Mapping to MITRE ATT&CK
- Blind spots in logging and detection
- IoCs and detection rules for your monitoring
- Prioritized measures and lessons learned
Find Out Whether Attackers Are in Your Network
A compromise assessment provides clarity – discreetly, vendor-independently and with specific next steps. We discuss the trigger and scope in confidence.
FAQ
Frequently Asked Questions About Compromise Assessments
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
How can I tell whether my company has been hacked?
Encrypted files or a ransom note usually come at the end of an attack – at that point, it’s an acute emergency, and you should immediately call our 24/7 emergency hotline at +49 2932 465265-0 or use the Report an emergency form. Before that, there are often only subtle signs: sign-ins from foreign countries, new administrator accounts, unknown remote maintenance software or forwarding rules in mailboxes. A compromise assessment checks such signs systematically.
What happens if you actually find attackers?
We inform your designated contact person immediately and plan the next steps with you: securing evidence, locking out the attackers in a coordinated way, cleaning up systems. If you wish, we take over the digital forensics, coordinate with your cyber insurer and support you with reporting obligations – for example, the report to the data protection supervisory authority under Art. 33 GDPR (without undue delay and, where feasible, within 72 hours of becoming aware of the breach) or, if you fall under NIS2, the early warning of a significant incident to the joint reporting office of the BSI and the BBK (Federal Office of Civil Protection and Disaster Assistance) within 24 hours.
How does a compromise assessment differ from digital forensics?
Digital forensics starts with a known incident and goes deep: How did the attackers get in, and which data is affected? A compromise assessment goes broad and determines whether there is an incident at all. A finding can be the starting point for a forensic investigation.
Do we need a SIEM or EDR for this?
No. We’re happy to use existing tools; otherwise, we deploy temporary collection tools. How far back we can look, however, depends on which logs you retain – and that’s exactly where Forensic Readiness comes in.
How often does a compromise assessment make sense?
Whenever there’s a reason – as soon as there’s a suspicion, a critical vulnerability has been exploited or networks are being merged. Beyond that, on a regular basis, for example annually or after a change of service provider – as a complement to your penetration tests.
Does a compromise assessment provide 100 percent certainty?
No – no reputable provider can promise that. You receive a well-founded statement for the systems, data sources and time periods examined; we openly state any missing data, such as logs that have already been overwritten, in the report.
How is a compromise assessment billed?
The effort depends on the number of systems, the cloud services and the time period examined. After scoping, you receive an individual quote; we agree on any extensions with you in advance.
Related pages
Request a Compromise Assessment in Confidence
Briefly tell us about the trigger and key details of your environment, such as the number of systems and the cloud services you use – we treat your inquiry confidentially and will get back to you personally. Acute incident? You can reach our 24/7 emergency hotline at +49 2932 465265-0, or use Report an emergency.