A compromise assessment is an investigation that answers one question: has this computer or network already been compromised? Instead of only trying to block new threats, it looks for evidence that an attacker or malicious software is present now, or was present in the past.
Why compromise assessments exist
Most security tools are built to prevent. Prevention is essential, but it is never perfect. Attackers deliberately try to stay out of sight, and some of the most damaging intrusions involve no obvious malware at all: stolen passwords, legitimate tools used for the wrong purpose, or a small change that quietly lets someone back in later.
That is why “no threats found” is not the same as “not compromised.” A compromise assessment starts from the opposite direction. Rather than waiting for something to trigger an alert, it goes looking for signs that something has already happened.
Compromise assessment vs. antivirus, EDR, and forensics
| Approach | Main job | Built for | Question it answers |
|---|---|---|---|
| Antivirus | Blocks known malicious files and behavior as they appear | Everyone | Is this file or program dangerous? |
| EDR (endpoint detection and response) | Continuously records activity across many computers and supports incident response | Security teams | What is happening across our organization right now? |
| Digital forensics | Preserves and reconstructs evidence in detail after an incident | Trained investigators | Exactly what happened, when, and how? |
| Compromise assessment | Looks for evidence that a system has already been compromised | Traditionally consultants; with Magentic, anyone | Has this system been compromised, and how sure are we? |
These approaches complement each other. A compromise assessment does not replace antivirus or EDR. It answers a question they are not designed to answer on their own.
What a compromise assessment looks at
Every investigation is different, but most compromise assessments examine the same kinds of evidence:
- What is running: the programs active on the system, and how they were started.
- What starts automatically: anything set to come back after a restart, a common way for intruders to keep access.
- Network activity: which other computers and services the system is talking to.
- Accounts and sign-ins: who has signed in, and when, and whether any accounts are new or unexpected.
- System history: logs and records of past activity, where the system keeps them.
- Security settings: protections that were turned off or changed.
Just as important is knowing what could not be examined. A careful assessment states its blind spots, because an investigation that could not see something cannot vouch for it.
Signs your computer may be compromised
- Programs or browser extensions you don’t remember installing
- Security software that was turned off without you doing it
- Pop-ups, redirects, or a browser home page that changed on its own
- Password-reset emails or sign-in alerts you didn’t trigger
- Friends receiving messages from your accounts that you didn’t send
- Unexplained slowness, fan noise, or network activity while the computer is idle
None of these signs proves a compromise on its own. Computers misbehave for ordinary reasons too. They are reasons to look closer.
When to get a compromise assessment
- After clicking a suspicious link or opening an unexpected attachment
- After a security alert or account warning you can’t explain
- When a computer starts behaving in ways you can’t account for
- Before trusting a used, shared, or inherited computer
- For businesses: after a security incident at a vendor or partner, or as a routine check
What to do if you think your computer is compromised
- Don’t panic, and don’t wipe it yet. Reinstalling right away can destroy the evidence that explains what happened and what else might be affected.
- Assess the computer. Find out whether it has actually been compromised, and how, before deciding what to do next.
- Disconnect if harm is ongoing. If you see active misuse, such as files being locked, money moving, or someone else controlling the screen, disconnect the computer from the internet.
- Secure your accounts from another device. Use a phone or computer you trust to change important passwords and turn on two-factor authentication.
- Get professional help when the stakes are high. For a business, or when money, legal matters, or sensitive data are involved, contact an incident response professional.
- Recover cleanly. If a compromise is confirmed, restore from a known-good backup or reinstall the operating system, then change your passwords again.
How Magentic approaches compromise assessment
Compromise assessments have mostly been delivered by expert incident responders, for organizations that can afford them. Magentic by BlueMaple is built to bring the same kind of investigation to anyone. It examines a computer, separates the ordinary from the unusual, and explains its conclusion in plain language, including how confident it is and what it could not see.
Magentic is in private development. Learn more about Magentic.