It reviews your logs, systems and data for evidence that an attacker is present or has been, then gives you a report you can remediate from — mapped to the standards you are measured against.
What is a compromise assessment?
A compromise assessment is a review of an organisation’s logs, systems and data for evidence that an attacker is already present, or has been. It differs from testing, which looks for routes in that nobody has used yet: an assessment looks for the ones somebody already has.
Most organisations find out they were compromised from somebody else — a bank, a customer, a regulator, or the attacker. The evidence was usually in their own logs the whole time.
It is common for organisations to lack the time to proactively deal with vulnerabilities, leading to breaches and a costly post-attack clean-up and remediation process.
At Wizard Cyber we believe the only way to secure your organisation against cyber attacks is to adopt a proactive approach to cyber security development and improvement. Our compromise assessment service is designed to help you do that.
By collecting the necessary logs, handling the encryption and upload, and analysing every piece of data against our cyber threat models, we produce a report that details the vulnerabilities present within your system. The report is mapped to industry standards such as ISO 27001, so your team can build a remediation plan from it directly.
The service is designed to work alongside the security tooling you already run, including your SIEM and endpoint protection.
These get used interchangeably and they are not interchangeable. Buying the wrong one is the most expensive mistake in this part of the market.
Looks backwards and inwards, through logs and systems, for evidence of a presence you have not noticed.
Looks forwards and outwards, for routes that exist but nobody has used yet. It tests the locks; an assessment looks for footprints.
An inventory of known weaknesses. It is a component of an assessment rather than an alternative to one — step 03 below.
Begins once you already know. An assessment is what you run when you do not.
Five situations where an assessment is the right thing to buy. The first two are the ones nothing else on this site speaks to.
Cyber policies are still largely priced from self-assessment questionnaires, which ask an organisation to report on controls nobody has independently looked at. An assessment replaces that with evidence: what is actually deployed, what is actually logged, and whether anything is already inside. For an underwriter that changes the basis of the decision. For a buyer it is often the difference between a quoted premium and a declined submission.
Cyber diligence in a transaction usually happens on a deadline, against an estate the buyer has never seen and the seller has every reason to present well. An assessment is the part that does not rely on either side’s account of it. What it finds can move a valuation, reshape the warranties, or occasionally stop a deal — and finding it after completion means you have bought it.
When investigating a suspected breach, a full review highlights current or historical compromise you may be unaware of, and identifies the weaknesses that allowed it.
The documentation produced can be used in regulatory assessments and contributes to vulnerability management requirements.
Demonstrates due diligence to partners and collaborators. Regular assessments show you are not carrying unnecessary exposure on their behalf.
Six steps, in order. The shape is fixed; the depth of each is scoped with you at the first meeting.
A consultant works through your current security measures with you. The first call is where we understand the organisation, introduce the people who will do the work, and agree the timeline.
A review of the controls in place, on site or remotely as needed. Interviews with senior managers identify how people, process and technology actually relate to one another — which is rarely how the documentation says they do.
Internal and external, scoped from the questionnaire completed at the first meeting. External scans run from our premises; internal scans are usually remote, with an on-site visit where the estate requires it.
Our team, threat intelligence feeds and tooling gather what can be found about your organisation and its people from outside it. If we can find something that presents a risk, it is fair to assume somebody else can too.
A model built from real-world observation, showing which parts of the organisation are exposed to which kinds of attack — so you can see where the gaps are rather than being told there are some.
A report documenting the status of each measure and the level of risk against each vulnerability, with the actions recommended to reduce it. Delivered in a meeting rather than emailed, so the findings can be argued with. What you end up holding is a picture of your estate built from evidence rather than recollection.
Beyond finding what is already there, an assessment sets a baseline and a direction for everything that follows.
This is the part an organisation cannot easily do for itself, and not because it lacks the skill. Monitoring reports on what it was configured to notice, from the moment it was switched on. An assessment looks at what is already there — including the months before anyone was watching, and the log sources nobody thought to connect. Most of what it finds has been sitting in data the organisation already owned.
A documented position rather than an impression. Most organisations describe their security posture from memory, a spreadsheet somebody exported, and the last thing that went wrong. The report replaces that with a dated, evidenced statement of where you actually are — which is the thing a second assessment measures against. Without it, “better than last year” is a feeling rather than a finding.
Your IT or security team does not have to run the assessment themselves, which leaves their time for the improvements it identifies.
One card, not two. The data gathered gives your team something concrete to prioritise and plan against, rather than a ranked list of assumptions.
A regular assessment is what turns security from something you do after an incident into something you do before one.
There is no standard size, and a number before the first conversation would be a guess. Four things move the work, and all four are settled with you at the start rather than discovered halfway through.
The volume and variety of log sources is the single biggest driver. Collecting, encrypting and uploading is our side of it; how much there is to collect is yours.
External scanning runs from our premises. Internal scanning is usually remote, and an on-site visit is only needed where the estate requires it.
The controls assessment depends on interviews with the people who actually run things, which is rarely the number named on the org chart.
A first assessment sets the baseline. A repeat one measures against it, and is a different and smaller piece of work.
A compromise assessment is a review of an organisation’s logs, systems and data for evidence that an attacker is already present, or has been. It differs from testing, which looks for routes in that nobody has used yet: an assessment looks for the ones somebody already has.
A penetration test asks whether somebody could get in. A compromise assessment asks whether somebody already has. A test examines the locks; an assessment looks for footprints. Both are useful and they answer different questions, which is why buying one when you needed the other is an expensive mistake.
Incident response begins once you know something has happened. A compromise assessment is what you run when you do not know — and if it finds something, incident response is what follows.
Logs from the systems in scope, access for internal and external scanning, and time with the people who run the estate. Collecting the logs, handling the encryption and managing the upload are our side of the work rather than yours.
A report documenting the status of each security measure and the level of risk against each vulnerability found, mapped to standards such as ISO 27001 so your team can build a remediation plan directly from it. It is delivered in a meeting rather than emailed, so the findings can be questioned.
No. An assessment is a fixed piece of work with an end, and the report is yours whatever you do next. If it finds something active, incident response is what follows — and you are free to run that with us, with somebody else, or with your own team.
Usually, yes — because the two answer different questions. Monitoring tells you about what it was configured to notice, from the moment it was switched on. An assessment looks at what is already there, including the period before anyone was watching and the sources nobody thought to connect. It is designed to work alongside the tooling you run rather than replace it.
The process is built to avoid it. Scans are typically performed remotely, and an on-site visit happens only where the internal scan requires one. The parts that take your people’s time — the first meeting, the interviews and the results meeting — are scheduled with you rather than sprung on you.
The first conversation is a scoping one: what you run, what you log, and how much of it is in scope. It costs you an hour and tells you whether an assessment is the right thing to buy at all.
