Compromise Assessment · from $2,000
Before we start watching, we find out what's already lurking.
Most security products only see what happens after you install them. An attacker who got in last spring is still there. The assessment is how we find out whether one is.
What it answers
Four questions, answered with evidence.
Has anything persisted?
Anything set up to survive a restart that nobody on your team put there.
Has anything been taken?
Signs that passwords, keys, browser sessions or files have already been collected.
Is anything calling out?
Machines talking to infrastructure they have no business talking to, right now.
Who has access?
Accounts, keys, remote-access tools and permissions that nobody remembers granting.
One week
How the engagement runs.
Scope
A kickoff call to agree which machines are in scope and who we talk to when we find something.
Collect
Read-only collection deployed to each machine. Nothing is changed, removed or blocked during the assessment.
Hunt
Days of analysis, guided by current research on the macOS and Linux families actively attacking small companies.
Report
A written report and a walkthrough call, with findings ranked by what to fix first.
What you receive
A report you can hand to the people asking.
- An executive summary for leadership, your insurer or the customer who sent the questionnaire.
- Prioritized findings, each one explaining what was found, why it matters and what to do about it.
- Citations to published research wherever a finding matches a known threat, so the report rests on evidence, not on our say-so.
- A walkthrough call to go through it together and answer questions.
If we find something active during the week, we don't wait for the report. You'll hear about it the same day.
An honest limit
A clean result means exactly what it says.
If we find nothing, the report says so plainly, and it says what that does and doesn't mean: Evidence that the things we looked for are absent, not a guarantee that nothing is there. No assessment can promise more than that, and one that claims to is overselling.
What it does give you is a documented, dated baseline: A record that someone competent looked, and what they found.
Find out what's already on your machines.
One week, read-only, fixed fee. You'll hear the same day if we find anything active.