10 Signs Your Company Is Compromised

In cybersecurity, time is the most critical asset. The average time it takes for a company to detect a data breach is a staggering 207 days. During that time, attackers are quietly mapping your network, stealing intellectual property, and preparing for a ransomware deployment.

If you are reading this because you have a "bad feeling" about a server glitch or a strange email, do not ignore it.

Here are the top 10 technical and behavioral indicators that your company infrastructure has been compromised, based on the forensic investigations my team and I have conducted over the last decade. For a broader look at the threat landscape statistics driving these compromises, read our State of Cybersecurity 2026 report.

The Top 10 Indicators of Compromise (IoCs)

1. Unexpected Administrative Account Creation

The Sign: You notice a new user account like admin_temp, support_user, or sys_test that no one on your IT team created.
What It Means: Attackers are establishing persistence. Even if you patch the original hole they used to get in, this account gives them a backdoor to return later.

2. Massive Outbound Traffic Spikes

The Sign: Your network monitoring tools show gigabytes of data leaving your network at 2:00 AM.
What It Means: This is Data Exfiltration. Attackers are stealing your customer databases, source code, or emails before they lock your systems with ransomware.

3. "Ghost" Administrative Tools Running

The Sign: You see legitimate tools like PowerShell, PsExec, or AnyDesk running on computers where they strictly don't belong (e.g., an HR employee's laptop).
What It Means: Hackers use "Living off the Land" (LotL) attacks. They use your legitimate administrative tools to hide their malicious activity from antivirus software.

4. Spontaneous Antivirus Disablement

The Sign: Your Endpoint Detection security (EDR/Antivirus) keeps turning itself off, or alerts are mysteriously cleared.
What It Means: Malware or a human intruder has gained high-level privileges and is blinding your defenses before launching the main attack.

5. Repeated Locked User Accounts

The Sign: Dozens of employees are complaining that they are locked out of their accounts repeatedly.
What It Means: This suggests a Brute Force Attack or Password Spraying. Attackers are actively trying thousands of passwords against your Active Directory.

6. Browser Pop-ups or Redirects on Internal Systems

The Sign: Internal staff report strange toolbars, homepage changes, or browser extensions they didn't install.
What It Means: Usually a sign of Adware or Spyware. While often dismissed as a nuisance, in a corporate environment, this is often the entry point for stealing session cookies and accessing cloud portals.

7. Slow or Sluggish Internet Speed

The Sign: The network is crawling, but your ISP says everything is fine.
What It Means: Your systems might be part of a Botnet used to attack others (DDoS), or attackers are using your bandwidth to transfer massive files. The same botnet capacity is what gets pointed at your own infrastructure later — see our guide to protecting against DDoS attacks for the defensive layers that stop both directions.

8. Strange File Extensions (.crypt, .lock)

The Sign: You open a shared drive and see files renamed to financials.xlsx.locked or holiday_party.jpg.enc.
What It Means: RANSOMWARE. This is the final stage. The encryption process has begun. Disconnect everything immediately.

9. Unexplained Server Reboots

The Sign: Servers are restarting at odd times without a scheduled update.
What It Means: Attackers often need to reboot a machine to install a rootkit or to clear system logs that would reveal their presence.

10. Emails Sent From Your Domain (That You Didn't Write)

The Sign: Clients are replying to emails you never sent, asking about the "invoice" attached.
What It Means: Your email server is compromised. Attackers are using your trusted domain into a Business Email Compromise (BEC) campaign to scam your partners.

🚨 I See These Signs. What Do I Do NOW?

If you identified more than one of these signs, assume you are breached. Do not panic, but act swiftly.

Step 1: Disconnect, Don't Power Off

Disconnect infected machines from the network (unplug the ethernet cable, turn off Wi-Fi).
Crucial: Do not turn the machine off if possible. Rebooting destroys valuable evidence (RAM data) that forensic experts need to understand the attack.

Step 2: Reset Critical Passwords

Reset passwords for all Administrator accounts immediately. Use a pristine (clean) device to do this.

Step 3: Call the Experts (Incident Response)

Do not try to "hack back." Do not try to clean the malware yourself unless you are trained. You might alert the attacker, causing them to trigger a "kill switch" and destroy data.

Who to Call? You need a professional Incident Response (IR) team.

Cyberlord Secure Services: We provide 24/7 emergency response. We can deploy our agents to contain the threat, evict the attacker, and restore your operations legally and safely.

Prevention is Cheaper than recovery

The cost of an Incident Response retainer is a fraction of a million-dollar ransom demand. If you are unsure about your network's health, book a Compromise Assessment with us today. We will hunt for these signs so you can sleep soundly tonight.

The First 24 Hours: A Containment Sequence

Order matters more than speed. Teams that rebuild inside the first hour routinely destroy the logs and memory artefacts that would have shown how far the intruder travelled. Work the sequence below, and record the time, the decision and the person who approved it — that running log becomes the backbone of every later report to insurers, regulators and clients.

Assign Three Roles Before Anyone Unplugs a Cable

Incident lead — owns the timeline, approves each disruptive action, and speaks for the company to staff and suppliers.
Evidence custodian — controls who touches an affected machine and keeps a written chain-of-custody sheet for every device, disk image and memory capture.
Business owner — accepts the trade-off between containment and lost revenue, and signs off when a service goes dark.

If nobody in-house can credibly hold the incident lead seat, that gap is exactly what a retainer fills. Our incident response plan template for small businesses covers the paperwork you will be asked to produce afterwards.

Hours 0-2: Contain the Bleeding

Isolate hosts by disabling switch ports or moving them to a quarantine VLAN. Pulling the power plug stays a last resort, because it erases the volatile memory a responder needs.
Revoke active sessions and refresh authentication tokens for suspect accounts; a password reset on its own leaves stolen session cookies working.
Pause mass-deletion jobs, backup rotation and cleanup scripts so nothing overwrites the attacker's traces or your own recovery points.
Give staff one short instruction: report suspicious mail instead of deleting it. If files are already being encrypted across shared drives, a ransomware response checklist for small businesses sets out the immediate ordering.

Hours 2-12: Capture Evidence Before You Rebuild

A wipe feels like progress and frequently is not.

Volatile state — running processes, live network connections, logged-in sessions and memory images from the hosts showing the clearest symptoms.
Identity artefacts — authentication logs, freshly created accounts, group membership changes and privileged role assignments.
Persistence — scheduled tasks, service registrations, startup entries, and remote-monitoring software installed with no matching change ticket.
Mailbox data — rules, forwarding addresses and sent items from any compromised mail account.

A targeted intrusion rarely reveals its full scope on day one. What you capture now is what lets an investigation answer the only two questions that really matter: which records were read, and which credentials are still trusted.

Targeted Intrusion or Commodity Malware?

The answer changes your budget and your timeline, so make the call early and revise it as facts arrive.

Commodity malware is opportunistic and noisy — one payload hash across many endpoints, generic ransom notes, spraying aimed at every account in the directory, and no sign of interest in your org chart or finance team.
A human-driven intrusion is quiet and deliberate — a handful of machines touched in a considered order, reconnaissance typed at odd hours, lateral movement through legitimate administration tools, mailbox rules that quietly forward invoices, and the erasure of precisely the logs a responder would want.

Three or more of the human-driven traits together justify treating the event as targeted, which normally means a longer investigation, a wider credential reset and a more cautious rebuild.

The Notification Clock After Confirmed Exposure

Reporting duties attach to the moment exposure is confirmed, not to the moment clean-up finishes.

Under the EU GDPR, a personal-data breach that risks people's rights must generally reach the supervisory authority within 72 hours of the organisation becoming aware. Other jurisdictions set different windows, and some set none.
Contracts are often stricter than statute. Client agreements, payment-provider terms and cyber-insurance policies can demand notice within hours, and an insurer may want to approve your choice of responder before costs are incurred.
The audience is plural. Affected individuals, sector regulators, law enforcement and sometimes the public each sit on a separate schedule.

Two working rules: pin the moment "awareness" began to concrete evidence, since an email header is worth more than a recollection; and put every notification decision in writing alongside the legal advice that informed it. Your solicitor or data-protection adviser owns this clock — the technical team supplies the facts that start it.

What an Incident Response Engagement Costs

Budgeting gets easier with honest ranges. Figures move with country, sector and the size of the estate, so read these as indicative rather than quoted.

Retainer — smaller organisations typically pay a modest annual fee for priority access to a responder; what you are buying is the response commitment in the contract, not a block of hours.
Emergency response — consultant day rates commonly sit in the low four figures, and a single-host case can close within days.
Full investigation and rebuild — a multi-server intrusion with data theft on a mid-sized estate usually runs into tens of thousands, and can reach six figures once legal costs, notification, downtime and lost business are counted.
Ransom demands — demands frequently land in the six-figure region, with no promise that the decryption tool will work or that stolen data will be deleted. That makes payment a business and legal decision rather than a technical one.

top 10 signs company compromised guide overview

Key decisions, risks, and implementation actions for top 10 signs company compromised guide.