Incident Response & Digital Forensics

Compromise Assessment

Answer the question 'are we already breached?' before the attacker answers it for you.

The situation

A time-boxed hunt for evidence of current or historical compromise across the estate, using threat intelligence, log analysis and endpoint telemetry.

Commissioned before a major transaction, after an industry-wide vulnerability disclosure, when a peer organisation is breached, or simply because an executive asked and nobody could answer with confidence.

What the client receives

Schedule of deliverables

01Threat hunting across endpoints, network and cloud telemetry
02Indicator of compromise and TTP sweep against current intelligence
03Persistence mechanism and lateral movement review
04Log coverage and detection gap analysis
05Findings report with containment recommendations
06Detection improvement backlog

Frameworks and standards

Assessment is carried out against named references, so a conclusion can be traced back to the requirement it was measured against.

MITRE ATT&CK
NIST SP 800-61r3
Threat intelligence feeds

Incident Response & Digital ForensicsIncident Response RetainerA named team, a guaranteed response time and a contract already signed when it matters.Service detail Incident Response & Digital ForensicsDigital Forensics & InvestigationDefensible evidence, and an answer to what actually happened.Service detail

Discuss this engagement

Tell us about the estate, its telemetry and what prompted the question and we will set out the scope, the method and the reporting format.