What to do if the audit finds signs of compromise

If your reports indicate signs of unauthorised access, treat it seriously and act methodically rather than in a panic.

Sensible priorities:

1. Work through the reports' findings — they set out what was found and what needs to be done.
2. Change credentials for the affected services and any accounts that may have been exposed.
3. Close the exposures the audit identified, so the same route cannot be used again.
4. Preserve evidence if the matter may become a formal or legal issue — don't wipe everything before it can be examined.

Remediating a compromised server properly takes care, and the wrong order of steps can either destroy evidence or leave a back door open. If you would prefer this handled for you rather than doing it yourself, contact us and we can discuss carrying out the remediation.