Compromise assessment
Are we already breached? What a compromise assessment tells your board
Most boards are afraid to ask the question. Here is what an evidence-led compromise assessment can tell decision-makers, and what happens when the team finds something.
JODOR Research · 29 October 2026 · 6 min read
For application-level access improvements, read our VPN-to-ZTNA migration guide and whitepaper. Access redesign complements investigation; it does not establish whether a compromise has occurred.
Every security leader has had the same quiet thought after reading the news: if they got in there, are they already in here? A compromise assessment is how you answer that question with evidence instead of hope.
What we actually look at
A careful assessment reviews the places an intruder may leave traces: endpoints, identities, logs and network records that are available within the agreed scope. The team looks for accounts that behave unexpectedly, tools that should not be there, and connections that warrant investigation. The exact evidence depends on the environment, the access available and the question the organisation needs answered.
The best outcome is a clean bill of health you can trust. The second best is finding the intruder before they act.
What changes when the question is urgent
An assessment is not a substitute for incident response. If there is an active indication of compromise, preserve relevant evidence, involve the response team and agree on containment decisions before routine investigative work changes the environment. If there is no confirmed incident, a defined review can still help leaders understand what is known, what remains uncertain and where to focus next.
The useful question is not simply whether something was found. It is whether the evidence is strong enough to support a decision, and what additional checks would change that decision.
What the board receives
A concise answer — compromised, no evidence of compromise within the agreed scope, or needs a closer look — backed by a technical report the team can act on. The report should explain its boundaries, evidence, limitations and recommended actions in priority order. It gives directors a clear account of what is known without implying that any assessment can prove the absence of every possible threat.
Key takeaways
- Ask the question before an attacker answers it for you.
- Evidence is stronger than assumptions: review available endpoint, identity, log and network records.
- Make the assessment's scope and limitations clear.
- The deliverable is a decision for the board and practical next steps for the security team, not a pile of alerts.
