A cyber security compromise assessment is a point-in-time investigation that determines whether an attacker has already gained unauthorised access to your network, even if none of your existing tools have raised an alarm. Unlike a penetration test, which asks “can someone break in?”, it asks “has someone already broken in, and are they still here?” Most engagements run two to four weeks and combine automated analysis with manual threat hunting across endpoints, network traffic and cloud environments, finishing with a report of findings and remediation steps.

Introduction

Most Australian businesses assume that if they haven't received an alert, they haven't been breached. That assumption is doing quiet damage. CyberCX's 2025 DFIR Threat Report found that espionage-related intrusions in Australia now take an average of 404 days to detect, up from 390 in 2023, while financially motivated attacks are found faster but still average 24 days before anyone notices.

A compromise assessment exists to close that gap. Instead of waiting for a tool to fire an alert, it actively hunts for evidence a tool might have missed. This guide covers what it involves, why it matters for Australian organisations, how it differs from services you may already have, and how to know if you need one.

What Is a Compromise Assessment?

A compromise assessment is a structured, time-bound investigation that determines whether an organisation's environment is currently, or has previously been, compromised, and identifies the weaknesses that allowed it to happen.

It's built on a different assumption than most security tools. Firewalls, antivirus and even EDR platforms are designed to prevent or flag malicious activity as it happens. A compromise assessment assumes the worst has already occurred and works backwards to prove or disprove it, using forensic-style analysis across a meaningful window of time.

The output isn't a list of vulnerabilities you might have; it's evidence of what's actually happened, or reasonable assurance that it hasn't.

Why Is It Important?

Modern attackers are optimised to avoid detection, and most organisations only find out about a breach once the damage is done. ASD's ACSC responded to over 1,200 cyber security incidents in FY2024–25, an 11% increase on the previous year. Businesses reported an average loss of $80,850 per cybercrime incident, with large organisations averaging $202,691 both sharp increases. ASD's ACSC now explicitly advises Australian organisations to operate with an “assume compromise” mindset rather than relying on prevention alone.

(Figures above are drawn from ASD's ACSC Annual Cyber Threat Report; readers should check cyber.gov.au for the most current published figures, as these are updated periodically.)

A compromise assessment matters because it answers the question that keeps security leaders up at night: not “are we protected?” but “are we already compromised, right now, without knowing it?”

Ransomware remained the most disruptive cybercrime threat reported to ACSC during the same period, and the number of reported data breaches increased throughout FY2024–25. Sectors under the most pressure include healthcare, where ransomware incidents doubled year on year and 95% of reported cases resulted in successful compromise, along with finance, legal and critical infrastructure — all attractive targets because of the sensitive data they hold or the essential services they run.

How Does It Work?

A compromise assessment deploys lightweight data collection tools across endpoints, network and cloud environments, gathers weeks of activity data, then has threat hunters comb through it for indicators of compromise and known attacker tactics.

Analysts map findings against frameworks like MITRE ATT&CK, combining automation with manual investigation, because sophisticated intrusions are specifically designed to slip past automated tools alone.

Key Benefits

• Certainty instead of guesswork about whether you're compromised
• Uncovers dormant threats that have sat unnoticed for months
• Validates whether existing security tools are actually working
• Supports cyber insurance and compliance requirements
• Informs M&A due diligence before inheriting a company's network risk
• Builds a security baseline that speeds up future detection

Common Threats Uncovered

• Malware or backdoors that evaded antivirus and EDR
• Compromised or reused credentials in active use
• Misconfigured cloud storage or overly generous access controls
• Evidence of prior unauthorised access, even if the attacker has left
• Suspicious outbound connections to command-and-control infrastructure
• Supply chain and third-party exposures

Business Risks of Skipping One

• Large-organisation cybercrime costs now average over $200,000 per incident
• Undetected breaches can mean missed Notifiable Data Breaches obligations
• Longer dwell time means more damage and a costlier eventual response
• Reputational damage once a breach becomes public
• Increasing friction with insurers and regulators who expect proactive assurance

Step-by-Step Process

1. Scoping — define the systems, endpoints and timeframe to assess
2. Sensor deployment — lightweight agents begin real-time data collection
3. Data collection window — typically a minimum of two weeks to establish a baseline
4. Automated analysis — data is correlated against known indicators of compromise
5. Manual threat hunting — analysts investigate ambiguous or high-risk anomalies
6. Findings validation — suspected compromises are verified to rule out false positives
7. Reporting and debrief — a detailed report and prioritised remediation plan is walked through with your team

Best Practices and Common Mistakes

• Don't wait for a trigger event; proactive assessments catch more than reactive ones
• Allow a realistic data collection window rather than rushing to one week
• Don't confuse this with a penetration test — one finds exploitable weaknesses, the other finds evidence they were already exploited
• Don't narrow scope purely to save cost; it often excludes the systems most likely to be targeted
• Insist on manual threat hunting, not automated scanning alone
• Treat findings as a remediation roadmap, not a one-off report to file away

Australian Compliance Considerations

A compromise assessment isn't a mandated activity, but it can support several existing obligations. Under the Notifiable Data Breaches scheme, organisations are generally required to notify the OAIC and affected individuals when a breach is likely to cause serious harm — and an undetected breach can't be reported. ASD's Essential Eight framework places weight on detection maturity, and an assessment can provide evidence of how existing controls perform in practice.

Sectors regulated under the Security of Critical Infrastructure (SOCI) Act generally face heightened risk-management expectations, which is one reason proactive assurance activity is common in those industries. Separately, mandatory ransomware reporting obligations have been introduced for larger Australian businesses and critical infrastructure entities in recent years — organisations should confirm current thresholds and requirements directly with the Australian Government, as these details are periodically updated. Some cyber insurers also request evidence of proactive assurance activity as part of underwriting or renewal.

This section is general information only, not legal or compliance advice. Organisations should confirm their specific obligations with a qualified legal or compliance advisor, and verify current regulatory requirements directly with the relevant Australian Government agency before relying on any figures or thresholds mentioned in this article.

Frequently Asked Questions

What is a compromise assessment?

An investigation that determines whether your environment is currently or has previously been compromised, and identifies the vulnerabilities that made it possible.

How is it different from a penetration test?

A penetration test asks whether an attacker could get in. A compromise assessment asks whether one already has.

How is it different from incident response?

Incident response is reactive, triggered once a compromise is confirmed. A compromise assessment is proactive, run to find out if there's anything to respond to.

How long does it take?

Most engagements run two to four weeks, with a minimum of roughly two weeks of data collection for a reliable baseline.

How much does it cost in Australia?

Cost depends heavily on the number of endpoints, cloud environments and network locations in scope, so it's best confirmed directly with a provider.

Do small businesses need one?

Smaller organisations are often targeted precisely because attackers assume weaker detection — sector risk and data sensitivity matter more than headcount.

Does it replace ongoing monitoring like MDR?

No. It's a point-in-time deep dive that complements continuous services like MDR or a SOC, rather than replacing them.

Is a compromise assessment worth it if we've never had a confirmed breach?

Yes — “never been breached” and “never had a breach detected” are two different statements, and a compromise assessment is precisely what distinguishes between them.

How often should it be repeated?

Annually is a common baseline for regulated or high-risk organisations, with extra assessments triggered by mergers or suspected incidents.

Key Takeaways

• A compromise assessment answers “are we already compromised?”, a different question to a penetration test or vulnerability scan
• Serious intrusions in Australia currently go undetected for an average of 24 to over 400 days depending on attacker motivation
• It combines automated analysis with manual threat hunting across endpoints, network, cloud and log data
• It directly supports the Notifiable Data Breaches scheme, Essential Eight alignment and cyber insurance requirements
• It's most valuable after a merger, in a regulated sector, or simply for proactive assurance rather than reactive discovery

Conclusion

A compromise assessment won't prevent every future attack, but it answers a question most organisations quietly avoid asking: not “are we protected?” but “are we already compromised, right now, without knowing it?” Given how long serious intrusions can sit undetected in Australian networks, that's a question worth answering properly, before a customer, regulator or attacker answers it for you.

If you're not certain whether your environment is clean, ThreatDefence's Compromise Assessment service combines full-stack visibility with hands-on threat hunting from analysts who've responded to real Australian breaches. Get in touch to scope an assessment for your environment to see exactly what's covered.