We investigate endpoint, network, and security data to determine whether an active or historical threat is present in the environment. Through expert analysis, we validate suspicious findings and report indicators of compromise, affected assets, and prioritized remediation actions.
The major activities our consultants perform during a Compromise Assessment include:
We embed investigative endpoint, network, and log inspection technology into host systems such as servers, workstations, and laptops.
We apply our comprehensive detection methods to evaluate network traffic, servers, workstations, laptops, and critical log data to find evidence of current and past attacker activity.
Our Cyber Security Teams perform servers, laptops and network forensic analysis, as well as malware and log analysis, to conduct the assessment.
We isolate the points identified during the evaluation. We are clearing critical findings. We carry out these cleaning steps in accordance with NIST and SANS standards.
We provide a detailed report outlining the steps taken during the evaluation, key findings, and appropriate recommendations for next steps.
