# What is a compromise assessment, and do we need one?

A compromise assessment is a time-limited investigation that answers one question: is an attacker in our environment now, or were they recently? Specialists review endpoint, log and network evidence for signs of intrusion, rather than testing whether an intrusion is possible, as a penetration test does. It makes sense before an acquisition, after a supplier or a peer in your sector was breached, when you take over a network nobody documented, or when something odd happened that nobody could explain. Ask the provider what data they need, how far back they can look and what they will not cover. Its quality depends on the evidence that already exists: network history recorded before the assessment starts is worth more than anything collected afterwards. NetSenX keeps alerts and their reasons for the history your plan includes: 30 days on Free, longer on paid plans.

FAQ: [Have I been hacked?](https://netsenx.com/en/faq/signs) · https://netsenx.com/en/faq/what-is-a-compromise-assessment

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing

## Related questions

- [A company in our sector was hacked. How do we check whether we are next?](https://netsenx.com/en/faq/a-company-in-our-sector-was-hacked-are-we-next)
- [What should we look for on our network after a partner or peer company is breached?](https://netsenx.com/en/faq/what-to-look-for-after-a-partner-company-is-breached)
- [We had an incident last year. How do we make sure we would detect it if it happened again?](https://netsenx.com/en/faq/how-to-detect-a-repeat-of-last-years-incident)
- [Why do companies so often learn about a breach from outsiders?](https://netsenx.com/en/faq/why-companies-learn-about-breaches-from-outsiders)
- [How do we tell a network attack from a heavy update or backup?](https://netsenx.com/en/faq/how-to-tell-a-network-attack-from-an-update-or-backup)