Cybersecurity Glossary
Indicator of Compromise
Evidence suggesting that a system has already been breached.
What Indicator of Compromise means
Indicators include unfamiliar sign ins, new mailbox forwarding rules, unexpected administrative accounts, connections to known malicious addresses, and files appearing in unusual places. They are the signs to search for once you suspect something, and to alert on in advance where you can.
Why Indicator of Compromise matters for small businesses and nonprofits
Intrusions are typically discovered weeks after they begin, often by an outside party. Knowing the handful of indicators worth checking lets a small organisation confirm or dismiss a suspicion in an hour rather than a week.
What to do about Indicator of Compromise
- Check for mailbox forwarding rules regularly, a classic and quiet sign of takeover
- Alert on new administrative accounts and on sign ins from unexpected countries
- Keep logs long enough to search backwards when an indicator appears
Not sure where you stand on this?
We review your current setup against the basics, tell you plainly what is covered and what is not, and give you a ranked list with effort and cost. No jargon and no scare tactics.