Compromise Assessment
A time-boxed hunt across your estate to answer one question with evidence: is there an active or historical compromise you have not detected?
What you receive
- Estate-wide hunt against current adversary TTPs
- Findings graded by confidence, not by severity theatre
- Detection gaps mapped to your existing tooling
When you need this
Three situations that call for it. If none of them is yours, it probably is not the right spend.
You are about to complete an acquisition
At closing you inherit the target's intrusions, their notification obligations and their unmonitored estate, none of which appear in the data room. An assessment before signature turns that into a priced, dated question rather than a surprise.
A supplier has told you they were breached
Your own tooling shows nothing, but it was never tuned for the techniques that crew uses and absence of alerts is not absence of activity. A retrospective hunt against those specific behaviours answers it with evidence.
The patch went on after the exploitation window
A vendor discloses a flaw that was already being exploited before anyone had a fix, and patching closes the door without saying whether someone came through it first. That is answered by hunting the estate for the behaviours that follow exploitation, not by confirming the version number changed.
How it runs
Scoping call
Thirty minutes with an engineer, not a sales development rep. We establish what you actually need and tell you plainly if it is not us.
Written proposal
Fixed scope, fixed price, named delivery team, and the rules of engagement in writing before anyone touches a system.
Delivery
Weekly written status and a direct channel to the delivery lead. Critical findings are escalated the moment they are confirmed, never held back for the report.
Readout and retest
A working session with your team, an executive summary for your board, and a remediation retest included in the original scope rather than quoted separately.
No lock-in
Scoping costs nothing and carries no obligation. If the answer is that you do not need this, that is a legitimate outcome of the call.
Who turns up
The engineer on your scoping call is on the delivery team. We do not hand you to a different group after signature.
Scope
What this does not cover
This is time-boxed, not monitoring. It ends on a date and says nothing about the day after — continuous coverage is Managed XDR.
Unpatched software is not the subject here. We look for evidence of intrusion, not for weaknesses — that is Vulnerability Assessment.
We do not remediate what we find; if the hunt turns up an active intrusion, that becomes an Incident Response engagement.
- MITRE ATT&CK
- A catalogue of observed techniques, not a checklist — coverage means nothing without the data sources needed to see each one.
- GDPR Art. 32(1)(d)
- Requires a process for regularly testing, assessing and evaluating the effectiveness of the technical and organisational measures, not merely having them in place.
If the scope is wrong
Tell us on the call. Re-scoping before we start costs nothing; discovering it at the readout costs you the engagement.
Questions
The ones we are actually asked.
If you find nothing, what have we actually bought?
A dated, evidenced statement of what was looked for and where, plus a map of the places your telemetry does not reach. The second half is usually the more useful half, and nobody buys it deliberately.
Can you prove we have never been compromised?
No. We can establish what the available evidence shows within the window your logs genuinely cover, which is shorter than most people assume — anything earlier is a gap we name rather than fill.
Why not run this ourselves with the EDR we own?
You can, and with the time to do it properly that is a reasonable choice. An outside hunt does not inherit your tuning assumptions, and the exclusions someone added last year are exactly where things sit undisturbed.
See what an attacker sees
We map your external attack surface the way an adversary does — exposed assets, leaked credentials, impersonation domains. No agent, no access, no cost.
30 min
A scoping call, with an engineer rather than a sales rep.
What it costs
Nothing, and there is no sequence afterwards. If we are not the right fit we will say so and suggest who is.
Under attack now?
Do not use this form. The hotline is answered around the clock and reaches a duty analyst directly.