Ask a defined question about signs of compromise
Active Threat Sweep is an assessment enquiry within the Fortra vulnerability-management lineage. Confirm its current scope and supported collection methods before commissioning work. The project should state the systems and threat question being assessed, rather than promising that a short sweep can establish the complete absence of compromise.
Identify the authorised asset owner, the information that may be collected and the team that will review results. Assessment evidence can include sensitive system context, so access, transfer and retention should be approved before collection. A suspected finding requires investigation and should not be presented as a final incident conclusion without validation.
Prepare escalation before collecting evidence
Obtain current product or service documentation for the offered assessment. Agree permitted windows, access prerequisites and operational constraints. Use a bounded evaluation to confirm the quality and interpretation of results, including any unsupported or inaccessible systems.
The delivery plan should define what happens if a serious concern appears: who is contacted, who may authorise further investigation and who can change systems. Keep immediate containment and forensic work separate unless they are explicitly contracted. Handover should record assessed scope, methods, limitations and actionable findings with named owners. Where no concern is identified, report that result within the assessment boundary rather than claiming the whole environment is clean.
Evidence to request for this scope
- Confirm current Active Threat Sweep availability, supported targets and assessment method.
- Approve evidence access, handling and the operational collection boundary.
- Establish incident escalation and further-investigation authority before work begins.