Compromise Assessments · Breach detection
Are attackers already inside? Find out from the evidence.
We examine your network logs, system configurations and security tool data for signs of unauthorised access, data exfiltration and malicious activity, then show how far any compromise goes and how to restore a secure state.
Why assess now
A quiet dashboard is not proof of safety.
Confirm or rule out a breach
Specialised tools and analysis look for unauthorised access and exfiltration that routine monitoring can miss, so you work from evidence rather than hope.
Understand the real impact
If we find a compromise, we establish its extent, the attacker's methods and the effect on your data, systems and networks, so decisions rest on facts.
Restore a secure state
A remediation plan and risk mitigation advice take you from findings to fixed, and a follow-up review confirms that the changes have held.
How we investigate
Six phases. Evidence first, conclusions second.
Every conclusion is backed by data your team can inspect, from the first log we collect to the recommendations for restoring your environment.
Preparation
We define scope and objectives, identify the assets to assess and gather the information and access the investigation needs.
Data collection
Network logs, system configurations and security tool data are collected from across your environment for analysis.
Analysis
Specialised tools confirm signs of compromise and establish the extent of the breach, its source and the methods used.
Impact assessment
Our experts examine affected systems and networks in detail to determine the impact and the risk the compromise poses.
Recommendations
We set out how to mitigate the risk, strengthen your security posture and return systems and networks to a secure state.
Reporting
A complete report documents the findings, the recommendations and the steps already taken to bring the risk under control.
What you receive
Evidence analysed, findings proven, remediation followed up.
Expected outcomes: an evidence-based answer on compromise, a clear view of impact if one is found, and a checked path back to a secure state.
01 · Examine
Evidence we analyse
Network logs
System configurations
Security tool data
Other relevant data sources
02 · Explain
Findings and evidence
Executive Summary for leadership
Detailed Report: extent, methods, impact
Technical documentation of tools and analysis
03 · Restore
Remediation and follow-up
Remediation Plan to a secure state
Risk Mitigation Recommendations
Follow-up review of remediation
Related experience
Detection and forensics work we are trusted with.
Banking & financial services · Jordan · 2025
Network detection and response renewal awarded
Judiciary · Jordan · 2025
NCSC Tahseen: judges trained in digital investigations and cyber evidence
Government · Jordan · 2025
CHFI forensic investigator training for a ministry
Related services
Answer today's question. Stay ready for tomorrow's.
A compromise assessment tells you where you stand now. These services keep watch and respond if the answer changes.
Incident Response Retainer
Experienced responders and a customised response plan, ready if an assessment confirms an active threat.
See the retainerAdvanced Threat Hunting
Hunters follow indicators of compromise through your logs and telemetry between formal assessments.
See threat huntingManaged Detection & Response
24/7 monitoring, threat intelligence and incident response from our SOC, for continuous visibility afterwards.
Explore MDRCHFI and ECIH training
EC-Council forensics and incident handling courses that build investigation skills inside your own team.
View forensics coursesFAQ
Compromise assessment, the facts first.
What CISOs and IT directors ask when they suspect something is wrong, or want to be sure it is not.
When should we commission a compromise assessment?
When something looks wrong but nothing is confirmed, after a breach at a supplier or peer organisation, or as a periodic check that your existing controls have kept attackers out of your environment.
Will the assessment interrupt our operations?
The work centres on collecting and analysing data such as logs, configurations and security tool output, rather than attacking your systems. We agree access and collection methods with your team during preparation.
What will you need from our team?
Access to the relevant data sources, a contact who knows the environment and agreement on which assets are in scope. The more complete your logs and configuration data, the clearer the conclusions we can give you.
What happens if you find an active compromise?
We establish its extent, source and methods, and give you recommendations to contain the risk and restore systems to a secure state. If you need hands-on help, our incident response retainer gives you experienced responders.
How will we see the findings?
An executive summary for leadership, a detailed report on extent, methods and impact, technical documentation of the analysis and a remediation plan. A follow-up review later checks that the plan was implemented effectively.
Request a compromise assessment
Share what you have seen. We'll establish the facts.
Share what prompted your concern and which environments matter most, and an investigator will reply with a proposed scope and data collection plan.
Tell us what prompted the concern
An investigator confirms scope and data sources
We send a scoped plan for the assessment