Penetration tests find what's exploitable. Audits find what's compliant. Compromise assessments find what's already happening — or already happened — that nobody noticed.
It's the question most SMBs don't ask: is something inside our environment right now that shouldn't be?
Why this is different from a pen test
A pen test simulates an attacker trying to get in. A compromise assessment assumes the attacker is already in. The work is different. It's threat hunting, not vulnerability scanning. The team looks for indicators of compromise — patterns of behavior, artifacts left behind, signs of persistence — across your environment.
The reason this matters: most breaches sit undetected for months. The average dwell time — the time between initial intrusion and discovery — is still measured in months for most SMBs. During that time, the attacker is mapping your environment, moving laterally, exfiltrating data quietly. They're not setting off alarms because there are no alarms set for what they're doing.
What a good compromise assessment covers
Endpoint analysis. Looking at devices for evidence of malware, unauthorized tools, suspicious processes, persistence mechanisms. The standard EDR catches the noisy stuff. A compromise assessment catches what's been deliberately quiet.
Network analysis. Traffic patterns, unusual connections, data flowing to places it shouldn't. Beaconing — the regular check-in patterns that compromised systems use to phone home — shows up here.
Cloud and SaaS analysis. Configurations that have changed without authorization. Admin accounts that have been added quietly. Logs that show access patterns inconsistent with normal use.
Email environment. Forwarding rules added to inboxes. Sign-ins from impossible locations. Sessions that suggest token theft.
Active Directory and identity systems. Unusual privilege escalations, accounts created and then idle, group memberships that don't match business roles.
When it's worth doing one
Some triggers are obvious. You're acquiring a company and want to know what you're inheriting. You're going through cyber insurance underwriting and need to demonstrate environment health. You suspect something is off — strange activity, weird login alerts, employees noticing things that don't add up.
Some are less obvious but more important. You haven't ever had a formal look. Your environment grew faster than your security team. You took over an environment from a previous IT provider and want a baseline before claiming it's clean. You're moving toward a higher security maturity and want to start from a verified position.
A compromise assessment is also a useful check after major incidents elsewhere — when a vendor in your supply chain has been breached, when a threat actor relevant to your industry is active, when something in the news suggests you should look.
What the report tells you
Done well, a compromise assessment produces three things. A clear statement of whether evidence of compromise exists. A list of indicators that warrant deeper investigation. A set of recommendations for closing the gaps that allowed those indicators to exist in the first place.
It's not theoretical. It's specific to your environment, with findings tied to systems you can actually point to.
The cost-of-not-doing-it math
Most breaches that go undetected cost more than ones caught quickly. Every week of dwell time is more data accessed, more lateral movement, more cleanup. Catching something at week two is a contained incident. Catching the same thing at week 40 is a disaster.
Defensible runs compromise assessments for SMBs that want to know what's actually in their environment. Talk to an expert.
