Insights from Compromise Assessment projects: missed incidents and hidden threats

Kaspersky researchers analyzed the results of Compromise Assessment projects conducted in 2025 and identified key reasons why attackers can remain undetected in corporate infrastructures for months. Below are the main findings — the full report is available at this link.

60% of incidents were not detected by existing security tools before the Compromise Assessment began. About 20% of threats were identified only through manual analysis by specialists.

More than half (52%) of high‑severity incidents showed traces of compromise for over 90 days. In one case, attackers remained in the infrastructure for about four years, using compromised domain controllers for covert cryptomining.

40% of detected web shells were found in backups, creating a risk of re‑compromise after infrastructure restoration.

86% of organizations that claimed to have a vulnerability management process still had exploitable misconfigurations. The authors attribute this to a lack of formalized vulnerability management processes and incomplete asset inventory: in 25% of cases individual servers were not monitored at all.

In every project that revealed an incident, attackers used remote‑administration tools and Living off the Land (LoLBins) techniques to disguise their activity as legitimate OS processes.

The researchers also note that organizations conducting Compromise Assessments regularly are far less likely to face high‑severity incidents than those turning to such audits only after an attack.