Compromise Assessment.

Leftovers from an incident that was already handled.

Where an organization has been through a major incident, remnants of it are still in the estate. Tooling that was never removed, accounts that were never disabled, persistence that survived the remediation, and hosts rebuilt everywhere except the one that mattered.

None of this means the response failed. It means the response ended when the pressure did, which is when everyone stops looking. An assessment is the first time anyone checks the closing state against the estate rather than against the report.

Traces of penetration testing, in three forms.

The first is the tooling and the techniques a tester left behind. On the evidence alone these look the same as an intruder, and separating the two is work that has to be done before anything else can be believed.

The second matters more. The technologies a penetration test usually targets have been hardened, but partially. A vulnerable network protocol is disabled on most hosts and still answering on the rest. A setting is corrected in one forest and not the other. The finding was closed in the report and not in the estate, and the half that was missed is the half still reachable.

The third is what the test itself switched on and nobody switched off. An account created for the engagement, given the privilege it needed to prove a point, and still in that group months later. Credentials shared across a team during the test and never rotated afterwards. Delegation and trust attributes written onto computer or service objects to demonstrate a path to a privileged identity, left in place once the path was demonstrated.

None of it was careless at the time. Each change was deliberate, scoped to the test, and meant to be reverted. The test ended, the report was delivered, and the environment was never put back. What remains is not a finding the report describes. It is exposure the test created, and it is usually held by an account nobody is watching.

Configuration that leaves an attacker room to move.

Active Directory, Entra ID and the endpoint security controls, configured in ways that hand an adversary options. Delegation, privilege, trust relationships, policy exceptions and control settings decided for convenience years ago and never revisited since.

These are not vulnerabilities in the sense a scanner reports. Nothing here is unpatched. They are paths, and there are usually more of them than anyone in the organization expects, because no single change looked dangerous on the day it was made.

Credentials already in someone else’s hands.

Two independent sources tend to point at the same accounts. The first is deep research into the places stolen credentials are traded, run against the organization’s domains and its people rather than against a keyword. The second is in the estate’s own authentication logs: the pattern left by a credential broker checking a list, testing which of the logins they are holding are live and which were fabricated by whoever sold them.

That second pattern is easy to dismiss as noise. It is not a brute force run and does not look like one. It is a measured pass against real usernames, sized to answer a commercial question rather than to break in: how much of this list is still good. By the time it appears, the credentials have already changed hands.

Many organizations already buy brand protection or credential monitoring, and it rarely surfaces what an assessment finds. Those services watch the sources that are straightforward to watch. The credentials that matter are usually somewhere else, in a set that was never posted publicly because it was sold directly. A valid login is the cheapest way into an estate: it needs no vulnerability, and on the day it is used it does not look like an attack.