Almost every digital forensics and incident response provider sells a compromise assessment, but two engagements with the same name can differ tenfold in coverage, depth and price, and a clean report is only worth the telemetry behind it. A compromise assessment answers one question: is an attacker in our environment now, or were they recently? Buyers commission one after a peer breach, before an acquisition closes, when a new security leader arrives, or when an advisory names a product they run. This vendor-neutral guide is for security leaders, procurement and deal teams writing a statement of work or comparing proposals. The method itself, evidence types and analysis approach are covered in our Compromise Assessment Guide; reactive response capacity is covered in the Incident Response Retainer Buyer's Guide. This page is about choosing and contracting the provider.
Key takeaways
- Buy coverage, not a brand of tooling. The conclusion can only be as wide as the endpoints, identity systems, cloud tenants and edge devices the provider actually examined, so contract for a stated coverage percentage per asset class.
- Insist on a hypothesis-led hunt. Indicator sweeps find known malware; hunts for valid account misuse, persistence and living off the land behaviour find the intrusions that matter.
- Define the deliverable before the price. A defensible report states what was examined, what was not, the confidence level and the evidence behind every finding.
- Agree what happens if they find something. Escalation, switching to incident response, legal privilege and rates must be settled before the agent goes on the first host.
- Treat the provider's access as a risk in its own right. Collection agents, admin credentials and evidence uploads need the same controls as any privileged third party.
Define requirements
- Trigger and question: write down why you are buying. A pre-acquisition assessment needs a date-bounded answer for a target you do not control; a post-advisory assessment needs depth on one product and the identities around it; a new-leader baseline needs breadth. See the Cyber Due Diligence in Mergers and Acquisitions Guide.
- Scope by asset class: count Windows, macOS and Linux endpoints and servers, domain controllers, identity providers, cloud accounts and subscriptions, SaaS tenants, email, and internet-facing appliances such as VPNs and firewalls. Edge devices are where many intrusions start and where endpoint agents cannot run.
- Look-back period: agree how far back the assessment must see. It is limited by log retention, so record what you hold for each source before the provider promises anything.
- Existing telemetry: say whether the provider will deploy its own collection tooling, use your EDR and SIEM, or both. Using what you already run is cheaper but inherits its blind spots.
- Constraints: change windows, OT or clinical systems that cannot take agents, data residency for collected evidence, staff clearance and whether the target organisation (in a deal) may know about the work.
- Governance: who commissions the work (often external counsel, to support privilege), who receives findings, and who decides to escalate.
Size changes the answer. A small organisation with a single cloud tenant and a few hundred endpoints can get a meaningful result from a fixed-fee, two to three week engagement using its existing EDR plus identity log review. A large or regulated enterprise, or an acquisition target with unknown tooling, usually needs a provider-deployed collection layer, several hunters working in parallel and a phased timeline.
Capability areas
| Capability area | What it covers | What to check |
|---|---|---|
| Endpoint and server collection | Forensic artefacts, memory, persistence locations, process and execution history across operating systems | Operating systems supported, agent footprint, collection without reboot, removal at close |
| Identity analysis | Directory, identity provider and privileged account review; abuse of valid accounts (ATT&CK T1078) and account manipulation (T1098); service accounts, OAuth grants and tokens | Named methods for hybrid directories, cloud identity and non-human credentials |
| Cloud and SaaS | Control plane and tenant audit logs, new principals, keys, federation changes, mailbox rules | Platforms they have assessed before; read-only access model |
| Edge and network devices | Integrity checks of appliances, web shell (T1505.003) and configuration review, network flow analysis | Whether checks go beyond the appliance vendor's own tool |
| Hunting method | Hypotheses drawn from threat intelligence and living off the land behaviour, baselining, anomaly review | Example hypotheses for your sector; how hunts are documented |
| Threat intelligence | Actor and campaign context, indicator matching, advisories relevant to your products | Sources and how intelligence shapes the hunt plan |
| Escalation to response | Moving from assessment to incident response when activity is confirmed | Time to switch, rates, team continuity, privilege handling |
| Hygiene findings | Exposures found along the way: stale privileged accounts, missing logging, unpatched edge devices | Prioritised, separated from compromise findings |
CISA's guidance on identifying and mitigating living off the land techniques explains why indicator sweeps are not enough: attackers use tools already present in the environment, and weaknesses in many networks make it hard to tell malicious activity from legitimate administration. A provider should show how it baselines normal administration before calling something anomalous.
Evaluation criteria
An illustrative weighting: 30% coverage and telemetry, 25% hunting method and people, 20% reporting and evidence quality, 15% operational safety, 10% commercial terms.
| Criterion | What good looks like | Weak signs |
|---|---|---|
| Coverage commitment | Coverage target per asset class written into the statement of work, with a daily coverage report during collection | "Enterprise-wide" with no count; no visibility of hosts missed |
| Identity depth | Reviews directory, identity provider, privileged and non-human accounts, consent grants and federation trust | Endpoints only; identity treated as a log search |
| Method | Documented hypotheses, mapping to MITRE ATT&CK, human analysis of anomalies | Automated indicator scan sold as a hunt |
| People | Named lead with relevant platform experience; hunters, not only tool operators | Team named after signature; heavy subcontracting |
| Evidence handling | Chain of custody, hashing, encrypted storage in agreed region, deletion certificate | Evidence in a shared portal with no retention terms |
| Report quality | Scope, coverage gaps, confidence statement, timeline, evidence per finding, prioritised actions | A score or traffic light with no evidence |
| Operational safety | Agent tested on a pilot group, rollback, change approval, least-privilege access | Domain admin requested up front; no pilot |
| Assurance | Relevant independent assurance, such as the NCSC assured Cyber Incident Response scheme in the UK, assessed against the NCSC's CIR Technical Standards | No independent assessment and no references for similar estates |
| Pricing | Fixed fee for defined scope, with unit rates for extra hosts and a capped escalation rate | Open-ended time and materials; agent licences billed after close |
Pricing is usually driven by number of endpoints and tenants, look-back period, whether the provider deploys its own tooling, and report depth. Ask each bidder to price the same scope sheet so proposals are comparable.
Where identity fits
Many confirmed intrusions are found in identity systems rather than on endpoints: a new federation trust, an unused service account with fresh logons, an OAuth application with mail access, or keys created on a cloud principal. The provider's own access is also a non-human identity risk. Collection tooling runs with high privilege on every host, and providers often ask for an administrative account. Issue dedicated, time-limited accounts with monitoring, scope cloud access to read-only audit roles, and revoke everything on the closing date. See the Identity Threat Hunting Guide.
Questions to ask vendors
- What coverage per asset class will you commit to in writing, and how will you report hosts you could not reach?
- Which identity sources do you analyse, and how do you assess service accounts, OAuth grants, federation trusts and cloud keys?
- How do you assess internet-facing appliances where your agent cannot run, and what do you do beyond the appliance vendor's integrity tool?
- Show two hunt hypotheses you would run for our sector, the data each needs, and how a negative result is recorded.
- What look-back can you achieve with our current log retention, and what will you say about the period you cannot see?
- What access do you need, at what privilege, and how is it revoked? Who on your side can see collected data?
- Where is evidence stored, for how long, and how is deletion confirmed?
- If you confirm active compromise on day three, what happens in the next hour, who decides, and at what rate?
- Can you show a redacted report, including its coverage and confidence statements?
- Who exactly will do the work, and is any part subcontracted?
Red flags
- A promise of "no compromise found" confidence without stating coverage or look-back limits.
- An assessment that ignores identity systems, cloud tenants or edge devices.
- Reliance on one vendor's integrity tool for appliances. In the 2024 VPN appliance zero-day exploitation, CISA warned that the appliance vendor's own integrity checker could miss compromise.
- Collection agents that cannot be removed cleanly, or licences that continue after the engagement.
- Requests for standing domain administrator credentials with no time limit.
- No plan for escalating to incident response, or a different team and price once something is found.
- A report template that lists hygiene findings but no evidence for compromise conclusions.
Proof of concept
- Pilot collection: agree a pilot group of 20 to 50 representative hosts, including a server and a domain controller in a change window, and confirm performance impact and rollback before wider deployment.
- Test against a known history: give shortlisted providers access to a past, closed incident or a purple team exercise in a test environment and see whether their method finds it.
- Review the hunt plan: ask for the written hypothesis list for your environment and challenge gaps against your threat model.
- Check identity reach: confirm read-only access works across directory, identity provider and cloud tenants before the main phase starts.
- Agree the report skeleton: fix coverage, confidence and evidence sections before work begins.
- Close cleanly: verify agent removal, account revocation and evidence deletion, and track the hygiene actions to closure.
Measure the engagement afterwards: achieved coverage per asset class against the commitment, number of hypotheses tested, findings with evidence, days from confirmed activity to escalation, and how many hygiene findings were closed within 90 days. Feed the gaps into your Forensic Readiness Guide work so the next assessment can see further back.
Standards and references
- NIST: SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management
- NIST: Cybersecurity Framework 2.0
- NCSC: Cyber Incident Response scheme
- CISA: Identifying and Mitigating Living Off the Land Techniques
- CISA: Best Practices for Event Logging and Threat Detection
- MITRE ATT&CK: T1078 Valid Accounts
How NHI Mgmt Group can help
We provide independent requirements, RFP and evaluation support. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: Compromise Assessment Guide · Incident Response Retainer Buyer's Guide · Threat Hunting Guide · Digital Forensics (DFIR) Guide · MDR Buyer's Guide