A compromise assessment answers one question that alerts cannot: is an attacker already inside, quietly, using access you have not noticed? Government advisories keep showing why the question matters. CISA and its partners reported Volt Typhoon holding footholds in some victim networks for at least five years, and told defenders to assume significant dwell time. This guide explains what a compromise assessment is, how it differs from threat hunting and incident response, how to scope one, which evidence to collect, how to judge the findings, and how to buy or run one well. It is for security leaders commissioning an assessment and the practitioners who run or support it. For the continuous, hypothesis-led practice, see the Threat Hunting Guide.
Key takeaways
- It is a bounded, evidence-based verdict on a defined scope at a point in time, with a stated confidence level, not an open-ended search.
- Coverage decides credibility. An assessment that reached 60 percent of endpoints and no identity logs cannot say "no compromise found" with any confidence.
- Assume long dwell time and look at artefacts that persist for months or years, not only the last 30 days of SIEM data.
- Identity is now half the work: directory, IdP, cloud control plane, OAuth and service account evidence finds attackers who never dropped malware.
- Plan for a positive result. Rules of engagement must say what happens the moment active compromise is found, so the assessment hands over to incident response without tipping off the attacker.
What a compromise assessment is, and how it differs
A compromise assessment is a proactive, time-boxed investigation of an environment to find evidence of current or past intrusion, followed by a report stating what was examined, what was found and how confident the assessors are. It borrows techniques from digital forensics and threat hunting, but its purpose, output and buyer are different.
| Activity | Starting point | Output | Typical duration |
|---|---|---|---|
| Compromise assessment | No confirmed incident; a question about current state | Verdict per scope area, confidence, findings, hygiene issues | Two to eight weeks, one-off or annual |
| Threat hunting | A hypothesis about a technique | Hunt record, new detections, data gaps | Continuous, days per hunt |
| Incident response | A confirmed or suspected incident | Containment, eradication, recovery, root cause | Until closure |
| Penetration test or red team | Can an attacker get in? | Exploitable paths and controls bypassed | Days to weeks |
| Vulnerability assessment | What weaknesses exist? | Prioritised vulnerability list | Continuous or periodic |
The difference matters for procurement. Incident response retainers and schemes such as the NCSC's Cyber Incident Response scheme assure providers for responding to incidents that have happened; the NCSC page does not describe proactive assessment. When buying a compromise assessment, ask specifically about method and coverage rather than assuming an IR accreditation covers it. See the Incident Response Retainer Buyer's Guide.
When to commission one
- After a relevant advisory: an exploited vulnerability in an edge device you ran before the patch, or a campaign against your sector. CISA's advisory on Ivanti Connect Secure said the vendor's integrity checker did not detect compromise and told organisations to assume stored credentials were compromised; that is a case for an independent assessment, not a checker result.
- Mergers and acquisitions: before connecting an acquired network or directory to yours. See the Identity Mergers and Acquisitions Guide.
- Leadership or board assurance: a new CISO, a regulator question or an insurer request for evidence.
- After an incident: to confirm eviction across the wider estate once the primary incident is closed.
- Weak signals: unexplained account lockouts, a third party reporting your credentials for sale, or a supplier breach.
- Before major change: cloud migration or directory consolidation, so you do not carry an intruder into the new estate.
Scoping and rules of engagement
Scoping is where most assessments succeed or fail. Write it down and get it signed by the sponsor and the system owners.
| Scope element | What to define | Example |
|---|---|---|
| Estate | Business units, sites, environments | All production; corporate IT; excluding OT |
| Asset classes | Endpoints, servers, DCs, edge devices, cloud tenants, SaaS, email | Windows, Linux, macOS, AD, Entra ID, AWS, M365 |
| Coverage target | Percentage of each asset class that must report data | 95 percent of endpoints, 100 percent of DCs and edge devices |
| Look-back period | How far back evidence must reach | All available, minimum 12 months for identity logs |
| Intelligence focus | Actors or techniques of concern | Sector campaigns, edge device exploitation, identity abuse |
| Escalation rule | What happens on a positive finding | Stop, notify named contact within 1 hour, invoke IR plan |
| Data handling | Where collected data is stored and for how long | Assessor tenant in UK region, deleted 90 days after report |
- Stealth: limit who knows about the assessment. The joint Five Eyes advisory AR20-245A warns that a warned adversary may hide tracks or take more damaging action, such as deploying ransomware.
- Do not touch suspected attacker infrastructure and do not pre-emptively block it or reset credentials; AR20-245A lists both as common mistakes.
- Out-of-band communications: keep assessment findings off potentially compromised email and chat.
- Legal privilege: decide whether counsel commissions the work, because a positive finding may trigger notification duties.
Evidence to collect
A compromise assessment combines a broad sweep of lightweight artefacts with deep forensics on a sample of high value systems. The table draws on the host and network artefacts listed in AR20-245A and the Volt Typhoon detection guidance in AA24-038A.
| Source | Artefacts | What they reveal |
|---|---|---|
| Windows hosts | Running processes with parent-child relationships, services, scheduled tasks (T1053.005), run keys (T1547.001), Prefetch, Shimcache, Amcache, installed software, local accounts, listening ports, DNS settings, static routes | Persistence, past execution, tools left behind |
| Windows event logs | Security 1102 (log cleared; AA24-038A says all should be investigated), TerminalServices LocalSessionManager 21 to 25 (RDP sessions), ESENT 216, 325, 326, 327 (possible NTDS.dit copying) | Lateral movement, credential theft, anti-forensics |
| Linux and macOS | Cron and systemd units, launch agents and daemons, authorized_keys, shell history, SUID changes | Persistence and remote access |
| Domain controllers | Privileged group membership history, replication events, GPO changes, krbtgt password age | Domain-level compromise. See the Active Directory Domain Compromise Response Playbook |
| Edge devices | Configuration diffs, local accounts, file integrity against vendor images, web shells (T1505.003), logs exported off-box | Exploitation of VPNs, firewalls and gateways (T1190, T1133) |
| Network | DNS logs, proxy logs, NetFlow, remote access sessions, user agents, connections to known indicators | Command and control, proxying (T1090), exfiltration |
| Identity and cloud | IdP sign-ins and audit logs, MFA registrations, OAuth grants, service principal credentials, cloud control plane logs | Valid account abuse (T1078), added credentials (T1098.001), cookie replay (T1550.004) |
| Inbox rules, forwarding, delegated access, mailbox audit logs | Business email compromise and collection |
Collection at scale: endpoint collection frameworks run the same artefact query across thousands of hosts. Velociraptor's documentation, for example, describes hunts that schedule collection on all matching clients and warns that a 100 MB file from 10,000 machines needs over 1 TB of storage, so it recommends targeted artefacts tested on one or two endpoints first. The same principle applies to EDR live response and commercial agents.
Analysis method
AR20-245A describes four analysis approaches that together form the core of a sound assessment:
- Indicator search: sweep collected data for known-bad hashes, domains, IP addresses and file paths from current intelligence. Fast, but blind to anything new.
- Frequency analysis: use large datasets to establish what is normal for timing, locations, ports and file attributes, then examine deviations.
- Pattern analysis: look for repeated behaviour that suggests automation or routine operator activity, filter normal activity and examine what remains.
- Anomaly review: experienced analysts examine the residue for values that do not fit, such as system binaries in user folders. AA24-038A gives an example: comsvcs.dll found outside System32, and unexpected files in C:\Windows\Temp\ and C:\Users\Public\.
Stacking (least-frequency analysis) across thousands of hosts is the workhorse: a scheduled task present on three machines out of 8,000 deserves a look. Every finding should be triaged into malicious, suspicious, unresolved, hygiene issue or benign, with the evidence recorded. See the Indicators of Compromise vs Indicators of Attack Guide.
Where identity fits
Many recent intrusions used valid credentials and tokens rather than malware, so an assessment that only examines endpoints will miss them. Include these checks:
- Privileged accounts: unexplained members of Domain Admins, Global Administrator or cloud owner roles, and dormant admin accounts with recent sign-ins.
- Non-human identities: service principals and app registrations with recently added secrets or certificates, access keys used from new networks, and service accounts with interactive logons. See the NHI Detection Engineering Guide.
- Federation and trust: new identity providers, federated domains, token signing certificates and cross-tenant settings.
- MFA and devices: MFA methods registered from unusual locations and devices registered shortly after a password reset.
- OAuth grants: high-privilege consents to unfamiliar apps. See the SaaS and OAuth App Governance Guide.
- Leaked credentials: check infostealer and breach sources for your domains. See the Infostealer Logs Monitoring and Response Guide.
Running an assessment: a phased approach
- Prepare (week 0): sign the scope and rules of engagement, name an escalation contact, agree data handling, and confirm log retention. AR20-245A recommends centralised logs kept for at least a year; if yours are shorter, record it as a limitation.
- Deploy and validate coverage (week 1): roll out collectors to a pilot group, check performance impact, then extend. Track coverage per asset class daily and chase gaps with owners.
- Sweep (weeks 1 to 3): collect lightweight artefacts estate-wide, run indicator and stacking analysis, and pull identity, cloud and email logs.
- Deep dive (weeks 2 to 4): full forensic triage of DCs, edge devices, jump hosts, admin workstations and anything flagged in the sweep. See the Digital Forensics (DFIR) Guide.
- Escalate if positive: stop broad collection on affected systems, preserve evidence and invoke the incident response plan. Do not alert the attacker by cleaning up.
- Report (final week): verdict per scope area, confidence, findings with evidence, hygiene issues and recommendations.
- Remove and roll back: uninstall temporary agents, revoke assessor accounts and API credentials, and confirm data deletion on the agreed date.
What a good report contains
| Section | Contents |
|---|---|
| Verdict | Per scope area: evidence of active compromise, evidence of past compromise, no evidence found, or not assessed |
| Coverage and limitations | Percentage of each asset class examined, look-back achieved, data that was missing |
| Findings | Each with timeline, affected assets, evidence, ATT&CK mapping and classification |
| Hygiene issues | Weaknesses that would help an attacker, such as unmanaged admin accounts or missing logging |
| Detection gaps | Where existing tooling would not have alerted, with suggested rules |
| Recommendations | Prioritised, owned, with effort estimates |
Decision guidance: in-house, provider or hybrid
| Option | Fits when | Trade-offs |
|---|---|---|
| In-house team | Mature SOC with EDR everywhere, hunting skills, long retention | Cheapest; risk of blind spots and less independence for board or regulator assurance |
| External provider | Board, insurer or acquirer needs an independent view; limited internal forensics | Independent and experienced across many intrusions; cost; needs agent deployment and data sharing |
| Hybrid | Internal team has tooling but wants external analysts and intelligence | Good knowledge transfer; needs clear ownership of findings |
- Small organisations: focus scope on the identity provider, email tenant, edge devices and a sample of endpoints; these hold most of the risk and are cheapest to examine.
- Large organisations: run it by business unit, start with crown jewels and tier 0, and reuse the collection framework afterwards for continuous hunting.
- Annual or triggered: an annual baseline plus triggered assessments after major advisories is a common pattern; continuous hunting reduces how much each one has to cover.
Measuring whether it worked
- Coverage achieved: percentage of in-scope assets per class that returned complete data, against the target.
- Look-back achieved: oldest evidence examined per source, compared with the required period.
- Time to escalate: from first malicious finding to incident response engaged.
- Unresolved findings: number still classified suspicious at report time (should be close to zero).
- Detection gaps closed: new rules deployed within 90 days from the assessment's gap list.
- Hygiene remediation rate: percentage of hygiene issues fixed by the agreed date.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | RA-10 Threat Hunting, SI-4 System Monitoring, AU-6, AU-11, IR-4, CA-2 | Proactive search, log review and retention, handover to incident handling |
| NIST CSF 2.0 | DE.CM-01, DE.CM-09, DE.AE-02, DE.AE-07, RS.AN-03, ID.IM-02 | Monitoring, analysis with intelligence, improvements from assessments |
| NIST SP 800-61 Rev. 3 | CSF 2.0 community profile for incident response | Positions proactive detection inside the IR lifecycle |
| CIS Controls v8.1 | Control 8 (Audit Log Management), Control 13 (Network Monitoring and Defense), Control 17 (Incident Response Management) | Data the assessment depends on and the escalation path |
| ISO/IEC 27001:2022 Annex A | A.8.15 Logging, A.8.16 Monitoring activities, A.5.25 Assessment and decision on information security events | Evidence and event assessment |
| MITRE ATT&CK v20 | T1078, T1003.003, T1505.003, T1053.005, T1547.001, T1543.003, T1021.001, T1090, T1190 | Techniques the sweep should cover |
Common failure patterns
- Clean verdict on thin coverage: the report says nothing was found, but a fifth of servers never reported and identity logs were out of scope. Always state coverage alongside the verdict.
- Trusting vendor integrity tools alone: the Ivanti Connect Secure exploitation showed a vendor checker can miss compromise; examine edge devices independently and assume stored credentials are exposed.
- Short look-back: using only 30 days of SIEM data when the attacker has been present for years, as with the Volt Typhoon intrusions.
- Tipping off the attacker: resetting passwords or blocking infrastructure mid-assessment, which AR20-245A lists among common incident handling mistakes.
- Ignoring non-human identities: examining user accounts but not service principals, access keys and OAuth apps.
- No handover plan: a positive finding stalls while people work out who owns the response.
Lessons from incidents
Edge device campaigns are the most common trigger for assessments. In the Ivanti case, CISA's direction to reset admin passwords, API keys and service account passwords, and to revoke certificates before reconnecting, shows the scope of what an assessment must cover beyond the appliance itself: every credential the device held, and every system those credentials could reach. See the Edge Device Compromise Investigation Playbook.
Practitioner checklist
- Write a signed scope with coverage targets, look-back period and an escalation rule.
- Keep the assessment need-to-know and communicate findings out of band.
- Confirm log retention before starting and record any shortfall as a limitation.
- Collect estate-wide lightweight artefacts and deep forensics on DCs, edge devices and admin hosts.
- Include IdP, cloud control plane, OAuth, email and non-human identity evidence.
- Use indicator, frequency, pattern and anomaly analysis, not indicator sweeps alone.
- Classify every finding and resolve suspicious items before the report.
- Report a verdict per scope area with coverage and confidence.
- Turn detection gaps into rules and track hygiene fixes to closure.
- Remove assessor agents and credentials, and confirm data deletion.
Standards and references
- Canadian Centre for Cyber Security and Five Eyes partners: Technical Approaches to Uncovering and Remediating Malicious Activity (AR20-245A)
- CISA, NSA, FBI and partners: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A)
- NIST: SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management
- NIST: SP 800-53 Rev. 5 (RA-10 Threat Hunting)
- CISA and partners: Identifying and Mitigating Living Off the Land Techniques
- NCSC: Cyber Incident Response scheme
- Velociraptor: Hunting documentation
Related NHI Mgmt Group resources: Threat Hunting Guide · Identity Threat Hunting Guide · Incident Response Guide · Forensic Readiness Guide