Compromise Check

“Are we already breached?” A focused hunt for intruder evidence — persistence, suspicious access, and the things your alerts missed.

Request a scoping call Our methodology
Why this matters: The average intruder sits in a network for months before anyone notices — the Velvet Ant backdoors survived since 2016 inside trusted authentication binaries. If the question keeping you up is “are they already inside?”, a scan will not answer it. This is a targeted hunt for the evidence an intruder leaves behind.

What we cover

  • Persistence hunting: accounts, tasks, services, authentication tampering
  • Suspicious authentication patterns and impossible-travel access
  • EDR/AV blind-spot review and tamper checks
  • Key artifact review: logs, memory, and persistence locations
  • Exfiltration indicators in egress and DNS patterns
  • Clear verdict: evidence found, or clean with confidence bounds

How we test

1Hypothesis setup

We start from realistic intrusion scenarios for your stack — what would an attacker have done to stay?

2Artifact hunting

Targeted review of the locations and artifacts those scenarios touch.

3Timeline analysis

Anything suspicious gets reconstructed into a timeline: what happened, when, from where.

4Verdict & response

A clear answer with evidence — and immediate containment steps if we find something.

What you get

  • Clear compromise verdict with evidence
  • Reconstructed timelines for anything found
  • Immediate containment recommendations
  • Detection improvements so it cannot repeat silently

The engagement at a glance

📞 Free scoping call

A short conversation about your environment. You receive a written scope, timeline, and fixed quote — no obligation.

✍️ Signed authorization

Testing begins only with your written permission and agreed rules of engagement. Always.

⏱️ Time-boxed delivery

A calendar agreed before we start, with an agreed communication plan while testing runs.

🔁 Retest included

A verification pass over everything you fix — included in the price, not an add-on.

See the full engagement process → and how pricing is scoped in our public pricing guide.

Related research from Hmmnm

Memory forensics: evidence that never touches diskhmmnm.com Conti’s 60,000 chats: anatomy of a ransomware gianthmmnm.com SOC automation & autonomous defensehmmnm.com

Common questions

How is this different from a penetration test?

A pentest simulates a future attack from outside. A compromise check hunts for an attack that may already have happened — persistence, tampering, and missed evidence.

What access do you need?

Read access to key systems and logs: authentication logs, EDR console, and selected hosts for artifact review. We agree the exact scope beforehand.

What if you find something?

You get immediate containment steps, a reconstructed timeline, and — if you want — hands-on help executing the response.

Authorization first, always. Testing happens only with your written permission and agreed rules of engagement — the same ethics that govern responsible disclosure on this site.
Explore other services 🌐 Web Application Penetration Testing 🤖 AI & LLM Security Assessment ☁️ Cloud & Identity Security Review 🔗 Software Supply Chain Security Assessment 📡 Threat Intelligence & Detection Review 🎓 Security Training & Workshops 🖥️ Network Penetration Testing 📱 Mobile App Security Testing 🎯 Red Team Simulation 🤝 Purple Team Exercise 🎣 Phishing Simulation 🔍 Attack Surface Review 🕵️ Breach Exposure Check 🚑 Incident Response Support 🛟 Ransomware Readiness Check 👔 Virtual CISO 📊 Security Maturity Check 🔑 Password Strength Audit 📋 Compliance Readiness 🧬 API Security Testing 🧾 Source Code Review 🧱 Zero Trust Assessment 🏬 Third-Party Risk Assessment 🐞 Bug Bounty Support 🔬 Security Research Services 🎤 Campus & Corporate Seminars 🌱 Security Internship Program \U0001F9E9 Threat Modeling

Want this assessed for your environment?

A short scoping conversation is enough to get a fixed quote. No obligation — a researcher replies.

Start the conversation →