Compromise Assessment for Your Business
Compromise assessment services check whether an attacker is already inside your network. Omeiro sweeps endpoints and servers for dormant backdoors, web shells, unauthorised scheduled tasks and persistence mechanisms, including kernel-level rootkits.
What compromise assessment looks at
The main areas we check, by hand with tools as support. The exact scope depends on your package and is agreed in writing before work starts.
Policies
- What exists today
- Gaps and old documents
- Plain-language drafts
Risks
- Main risks listed
- Likelihood and impact
- Owners
Vendors
- Who has your data
- Contracts and access
- Review dates
Action list
- Ranked next steps
- Quick wins
- Longer projects
Checklist Based on common risks and good practice. The exact scope depends on your package and is agreed in writing before work starts.
What you get with compromise assessment
Comprehensive forensic sweep across all endpoints and servers to detect dormant backdoors, web shells, unauthorized scheduled tasks, and persistent kernel-level rootkits.
Basic Package
Compromise check of up to 10 systems. 4-day delivery, 2 revisions.
Standard Package
Up to 40 systems; persistence sweep. 7-day delivery, 2 revisions.
Premium Package
Up to 120 systems; full report. 12-day delivery, 2 revisions.
Clear brief first
We confirm what you need before work starts, so the scope is clear on both sides.
Revisions listed
Each package shows its revision rounds. A round is one list of changes sent together.
Yours once paid
Copyright of the final work passes to you once the order is paid in full.
Work starts only after the scope is agreed in writing and you confirm you own or control the systems involved.
How our compromise assessment works
Define the scope
Systems and access are agreed.
Collect data
Artefacts and logs are gathered.
Hunt
We look for signs of persistence and backdoors.
Report
Findings and next steps are written up.
What a compromise assessment looks at and what you should prepare
The number of systems and their roles drive a compromise assessment more than company size. Domain controllers, internet-facing servers and admin laptops get the closest look because attackers settle there. Before we start, gather an asset list, remote access details and notes on anything odd your team has already seen, such as unexplained logins or new scheduled tasks. Read-only access is enough for most checks, and knowing your maintenance windows helps us separate legitimate changes from suspicious ones.
Good results are specific. A finished compromise assessment names the systems checked, the evidence reviewed, anything suspicious with the reasoning behind it, and the next steps. It cannot prove that nothing exists, so the report states the limits of what was examined. Teams often follow it with SIEM tuning or an incident response retainer so that findings are watched afterwards rather than filed away and forgotten.
In short
- Delivery in 4 to 12 days, by package.
- Fixed price, shown before you order.
- Teams that saw odd behaviour but found no clear cause.
- Copyright yours after full payment.
Compromise Assessment: common questions
How much does compromise assessment cost?
Prices are fixed and shown by package on our Compromise Assessment pricing page, so you see the full price before you order. You can also ask for a custom quote.
How long does rootkit detection take?
Delivery depends on the package: Basic 4-day delivery; Standard 7-day delivery; Premium 12-day delivery.
What is included in the Basic Package?
The Basic Package includes: Compromise check of up to 10 systems. Higher packages add more scope, revisions and support.
Can I get a custom enterprise compromise assessment package?
Yes. If none of the packages fits, use the custom package form on our pricing page to describe what you need, and our team sends you a fixed price.
What if you find something?
We report it and recommend next steps. Evidence handling and notification services are available separately.
Does a clean result mean I am safe?
It means nothing was found in scope at that time.
Will systems go offline?
Normally not, and we agree the method first.
Which systems can be checked?
Endpoints and servers. Tell us your operating systems.
How do you detect web shells and hidden persistence?
We compare files, scheduled tasks, services, startup entries and account changes against what should exist, and review logs for access patterns that do not fit. Web shells often hide in upload folders or inside legitimate-looking scripts, so those paths get a manual look.
Who owns the final work?
Copyright of the final work passes to you once the order is paid in full. Paid fonts, stock files or licences, if used, are licensed in your name.
Ready to start your compromise assessment?
Compare the packages and pick the one that fits. Not sure which? Write to us and we will help you choose.