What Is a Compromise Assessment?

What a Compromise Assessment Actually Covers

Endpoint Forensics

The endpoint forensic component of a compromise assessment examines a sample of representative endpoints — typically servers and high-privilege workstations — for evidence of attacker presence. The work includes memory analysis (running processes, injected code, suspicious modules), persistence mechanism review (scheduled tasks, registry run keys, WMI subscriptions, services), execution artifact analysis (PowerShell history, prefetch files, shimcache, AmCache), and lateral movement evidence (RDP and SMB activity logs, credential access artifacts). Coverage is sample-based for cost reasons; the sample is selected to maximize the probability of detecting compromise if it exists.

Network and Identity Telemetry

The network and identity telemetry components examine logs and detection data for indicators of compromise. This includes authentication logs (suspicious logins, impossible-travel patterns, abnormal MFA failures), identity provider audit logs (OAuth grants, application consents, privilege changes), network DNS and proxy logs (beaconing patterns, traffic to known-bad infrastructure), and email security logs (BEC indicators, suspicious external forwards, sent-folder anomalies that suggest account takeover).

Cloud Platform Audit Logs

For organizations with material cloud presence, compromise assessment work extends into cloud platform audit logs. Microsoft 365, Google Workspace, AWS, Azure, and GCP each produce extensive audit telemetry that can surface attacker activity invisible at the endpoint or network layer. Cloud-resident attacks frequently leave no endpoint forensic evidence at all because the attack operates entirely through API calls authenticated with stolen credentials or OAuth grants.

When Compromise Assessments Are Warranted

M&A Due Diligence

Pre-close compromise assessment has become standard practice for mid-market and larger PE deals. The diligence question is whether the target organization is currently compromised — because acquiring a compromised target means inheriting the breach and all of its consequences (regulatory notification, customer disclosure, R&W exclusions, remediation cost). The 2018 Marriott / Starwood case is the canonical example: Marriott's M&A diligence did not include compromise assessment, the inherited Starwood environment had been compromised since 2014, and Marriott absorbed the regulatory and customer-impact consequences post-close.

Post-Incident Validation

After incident response activity concludes, compromise assessment validates that the response was complete — that no attacker presence remains in the environment. The work is particularly important for incidents involving sophisticated threat actors who may have established multiple persistence mechanisms; the incident response team may have remediated the obvious indicators while missing the secondary persistence. Compromise assessment as the closeout phase of incident response is increasingly standard practice.

Threat Intelligence Triggers

When threat intelligence indicates active campaigns against the organization's industry, geography, or supply chain, compromise assessment determines whether the campaign has already succeeded against your specific environment. Recent examples include the assessments triggered by SolarWinds disclosure in 2020, the MOVEit campaign in 2023, and the various supply chain incidents that produce broad downstream exposure. Acting on threat intelligence without verifying current exposure leaves the worst-case outcome (active compromise from the named campaign) undetected.

Unexplained Anomalies

Operational anomalies that cannot be explained through normal troubleshooting sometimes warrant compromise assessment to rule out attacker activity. Examples include unexpected outbound network traffic, unexplained changes to security configurations, anomalous account behavior, and customer reports of suspicious activity. Compromise assessment in these cases is the structured investigation that either rules out compromise or confirms it — both outcomes producing actionable information.

How Compromise Assessments Differ From Adjacent Disciplines

Compromise Assessment vs. Penetration Testing

Penetration testing simulates attacks to identify exploitable vulnerabilities. Compromise assessment looks for evidence that an actual attack has already succeeded. The two disciplines are complementary but not interchangeable: a clean penetration test does not mean the environment is not currently compromised (because the compromise may have used techniques the pen test did not simulate), and a successful compromise assessment finding does not mean the environment is broadly vulnerable (the attacker may have exploited a specific path now closed).

Compromise Assessment vs. Vulnerability Assessment

Vulnerability assessment enumerates exploitable weaknesses in the environment. Compromise assessment looks for evidence that weaknesses have been exploited. Organizations with mature vulnerability management programs still benefit from compromise assessment because the discipline addresses a different question: 'are we currently compromised' rather than 'where are we exposed to future compromise.'

Compromise Assessment vs. Continuous Threat Hunting

Threat hunting is the ongoing operational discipline of proactively searching for attacker presence using hypothesis-driven investigation. Compromise assessment is a point-in-time engagement with defined scope and deliverables. Organizations with mature MDR services typically receive continuous threat hunting as part of the service; compromise assessment is the supplemental engagement that provides deeper, broader investigation than continuous hunting can deliver within ongoing service economics.

Compromise Assessment vs. Incident Response

Incident response is reactive — initiated when a security event has been identified. Compromise assessment is proactive — initiated to determine whether security events exist that have not yet been identified. The work shares forensic methodology; the engagement context and deliverables differ. A compromise assessment that finds active compromise typically transitions into incident response engagement.

Related Reading

• What is Incident Response? — the reactive counterpart
• What is Threat Hunting? — the continuous version of the same investigative discipline
• What is Cyber Due Diligence? — the M&A framework that frequently incorporates compromise assessment
• What is MDR? — the operational service that includes continuous threat hunting

The Technology Due Diligence Cluster

This article is part of Cloudskope's technology due diligence series for private equity sponsors and corporate acquirers.

• Technology Due Diligence: The Sponsor's Guide
• When Diligence Finds an Active Compromise
• Technology Due Diligence Red Flags That Kill Deals
• The Technology Due Diligence Checklist
• Turning Diligence Findings Into Deal Terms

What is a compromise assessment?

A compromise assessment is a point-in-time investigation that determines whether an organization is currently compromised, meaning whether an attacker has active or dormant access to systems, data, or accounts. The assessment uses forensic techniques to examine endpoint, network, identity, and cloud telemetry for indicators of compromise. The output is a clear answer to: are we breached right now, and if so, what does the attacker have access to?

How is a compromise assessment different from a penetration test?

A penetration test simulates an attacker to find vulnerabilities that could be exploited. A compromise assessment investigates whether the organization has already been exploited. The penetration test looks forward (what could happen); the compromise assessment looks backward and present (what has happened and what is happening now). The two assessments answer different questions and require different methodologies.

When should an organization run a compromise assessment?

Triggers include: post-M&A close to validate the security state of the acquired entity, after detection of suspicious activity that did not produce a confirmed incident, before transitioning to a new security platform or service provider, after a senior employee departure with privileged access, and during periods of elevated threat actor targeting against the organization's sector. Some organizations run compromise assessments annually as a standing program control.

What does a compromise assessment actually look at?

Comprehensive assessments examine: endpoint telemetry for malicious processes, persistence mechanisms, and unauthorized tools; network traffic patterns for command-and-control communication, unusual data flows, and lateral movement; identity logs for anomalous authentication, privilege escalation, and credential theft indicators; cloud platform logs for OAuth grants, configuration changes, and data exfiltration; and email systems for malicious rules, forwarded messages, and phishing artifacts. The scope and depth vary with engagement size.

Who performs compromise assessments?

Specialist firms with forensic and threat intelligence capability: Mandiant (Google), CrowdStrike Services, Kroll Cyber, NCC Group, Cybereason, and others. The big-four consulting firms offer compromise assessment services through their cyber practices. The quality of an assessment depends heavily on the experience of the analysts and the breadth of telemetry the engagement can access. Firms with mature threat intelligence and large investigation portfolios typically produce higher-quality findings.

What does a compromise assessment cost?

Every compromise assessment is custom scoped. Cost depends on how large the environment is, which systems need to be in scope, and how deep the investigation has to go, so it is quoted after a short scoping call rather than from a price list. When the concern is limited to Microsoft 365 and Azure, CLOUDSKOPE SARTUS™ covers it as a fixed-fee engagement.

What's the first step toward running a compromise assessment?

Define the trigger and scope. What event prompted the consideration of an assessment, and what systems must be in scope to address the trigger adequately? The scope definition determines vendor selection and pricing. For PE-driven assessments, Cloudskope's M&A cyber due diligence work routinely includes scoped compromise assessment as a component of the broader diligence workstream.

Illustrative Example: When Pre-Close Diligence Finds an Attacker Already Inside

This example is a composite, written to show how the work plays out. It does not describe a specific client or transaction.

A sponsor is weeks from closing on a mid-market services company. Financial and legal diligence are clean, and the baseline cyber review has not raised material concerns. A compromise assessment is run as standard pre-close protocol, not because anyone suspects a problem.

Endpoint forensics surfaces unusual PowerShell activity on a handful of servers. Deeper work finds signs of credential theft months earlier, several persistence mechanisms, and a slow, steady flow of data to attacker-controlled infrastructure. The target's IT team had no idea. The attacker had stayed below the thresholds that would have triggered its endpoint alerts.

The finding changes the deal. Close is paused while incident response contains the environment and confirms what was taken. Representations and warranties coverage is revised to exclude consequences of the compromise, and the price is adjusted for remediation cost and regulatory exposure. The deal closes later, on terms that reflect what the buyer is actually acquiring.

The lesson: the compromise existed before diligence started. The baseline review did not find it because compromise assessment was not in its scope. The assessment did, and its cost was small next to the adjustment it produced.

Frequently Asked Questions

How long does a compromise assessment take?
Typical mid-market engagements run 4-8 weeks depending on environment complexity, scope of endpoint sampling, and depth of cloud platform analysis. Pre-close M&A engagements may run faster (2-4 weeks) when scope is constrained to material findings only. The timeline includes data collection, analysis, and findings report production.

Is a compromise assessment the same as incident response?
No. Compromise assessment is proactive, initiated to determine whether compromise exists without knowing in advance. Incident response is reactive, initiated when a security event has been identified. Both use overlapping forensic methodology but differ in trigger, scope, and deliverable. A compromise assessment that finds active compromise typically transitions into incident response.

How much does a compromise assessment cost?
Every compromise assessment is custom scoped. Cost depends on how large the environment is, which systems need to be in scope, and how deep the investigation has to go, so it is quoted after a short scoping call rather than from a price list. When the concern is limited to Microsoft 365 and Azure, CLOUDSKOPE SARTUS™ covers it as a fixed-fee engagement.

What if the assessment finds evidence of compromise?
Standard response is to scope the finding through incident response engagement, determining the full extent of attacker presence, validating containment, and producing the remediation roadmap. Compromise assessment findings frequently surface during the engagement; mature providers transition smoothly between assessment and response work.

Should we conduct a compromise assessment as part of every M&A deal?
For material acquisitions in industries with significant cyber risk exposure (healthcare, financial services, technology, regulated manufacturing), yes, particularly when the target has not maintained mature security operations capability. The Marriott / Starwood case is the standard example of why this discipline matters. Smaller acquisitions may use lighter-weight scope appropriate to deal economics.