Patched Is Not Clean: Why Edge-Device Exploits Need a Compromise Assessment
A compromise assessment after patching checks whether attackers got into a VPN, ADC or firewall before the fix and are still there. Simply Data provides compromise assessment and DFIR services and holds NACSA managed SOC monitoring licence 20007-01 and penetration testing licence 20007-02. It applies to any Malaysian organisation that patched an exploited edge device.
Patching closes the vulnerability. It does not tell you what happened while the device was exposed. Many teams install a fix on a NetScaler, Ivanti gateway or firewall and then move on. A compromise assessment after patching checks what happened during that exposure.
Why doesn’t patching remove an attacker who is already in?
A patch fixes vulnerable code, but applying it does not establish whether attacker-created files, accounts, stolen sessions or configuration changes remain. If exploitation happened before the update, an attacker’s foothold may survive.
Citrix NetScaler shows this clearly. CISA describes how CVE-2023-4966, known as Citrix Bleed, let attackers bypass passwords and multi-factor authentication and hijack legitimate user sessions. Its joint advisory on Citrix Bleed exploitation pairs the update with hunting for malicious activity, not the update alone.
Ivanti Connect Secure is the second lesson. In its advisory on Ivanti gateway exploitation, CISA reported that the vendor’s Integrity Checker Tool did not detect compromise in some cases. It also warned that a sophisticated actor may be able to keep root-level persistence despite a factory reset.
That is why a compromise assessment after patching treats the patched device as possible evidence, not a finished job. The question changes from ‘Are we vulnerable?’ to ‘Were we breached, and is anyone still here?’
Which edge devices have been exploited in 2026?
On 5 October 2026, Malaysia’s National Cyber Coordination and Command Centre issued NC4 alert NC4-ALR-2026-000007, warning Malaysian organisations of active NetScaler exploitation. If you run NetScaler ADC or Gateway, take it as a reason to look for earlier access, not only to confirm the version number.
CISA’s Known Exploited Vulnerabilities catalogue lists vulnerabilities with confirmed exploitation in the wild. Use it alongside national advisories to prioritise checks on exposed systems.
Don’t rely on a single alert. Check every internet-facing device you own against the KEV catalogue and national advisories. Any device that was exposed and unpatched while exploitation was public needs a compromise assessment after patching.
You can only do that if you know what you expose. Attack surface management keeps an up-to-date inventory of internet-facing systems, so forgotten gateways and test appliances aren’t missed when the next alert lands.
What does a compromise assessment after patching check on a VPN, ADC or firewall?
A compromise assessment looks for evidence of past or current intrusion. On edge devices, it combines forensics on the appliance itself with a review of the internal systems that the device can reach.
| Area | What is checked | Why it matters |
|---|---|---|
| File system integrity | Files compared with known-good vendor releases; unexpected scripts and binaries | Web shells and modified binaries can survive a patch |
| Accounts and configuration | Local administrators, new users, SSH keys, changed policies and routes | Added access can look legitimate |
| Sessions and credentials | Active sessions, stored secrets, certificates and service accounts | Stolen sessions and secrets can outlive the vulnerability |
| Logs and telemetry | Device, authentication and firewall logs before and after the patch | Shows first access, attacker actions and missing records |
| Downstream systems | Domain controllers, servers and endpoints reachable from the device | The device may have been a route into the network |
Logs decide how far back you can look. For financial institutions, Bank Negara Malaysia’s Risk Management in Technology policy document (S 10.42) requires relevant network device logs to be kept for investigations and forensics for at least three years. Every organisation should check its own retention settings before an incident.
The output is a written record of findings, evidence and recommended actions. Our guide to what a compromise assessment report contains explains each section.
Simply Data Sdn. Bhd. operates a 24×7 Security Operations Centre. Its analysts also carry out threat hunting, which is the core skill a compromise assessment relies on.
What are the signs of a web shell or persistence after patching?
A web shell is a small script placed on a web-facing system. It lets an attacker run commands through ordinary web requests. The NSA and Australian Signals Directorate guidance on web shells notes they can be hard to detect because attackers easily modify, encode and obfuscate them.
Web shell detection is harder on an appliance than on a normal server, because you often can’t install monitoring agents on it. Look for these signs:
- Files in web-accessible directories that don’t match the vendor release
- Files with normal-looking timestamps but unexpected contents (timestamps can be altered)
- Requests to unusual URLs on the appliance, especially POST requests with odd responses
- New local accounts, SSH keys or scheduled tasks
- Outbound connections from the appliance to unfamiliar addresses
- Logging turned off, rotated early or missing for the exposure window
- Logins by known users at odd hours or from new locations after the patch date
None of these signs proves a compromise by itself. Together, they show where to dig deeper. That is why a compromise assessment after patching should cover both the appliance and the network behind it.
For example, a NetScaler compromise check should use vendor and national indicators and also review sessions, accounts and logs. A single file scan isn’t enough.
When should you call incident response instead?
Move from assessment to incident response as soon as you find evidence of active access. Examples include a confirmed web shell, an unknown administrator account, data leaving the network or signs of movement to internal servers. The priority then becomes containment, eradication and recovery.
Digital forensics and incident response (DFIR) preserves evidence while removing the attacker. Typical steps include isolating or rebuilding the appliance from a trusted image, revoking sessions, rotating credentials and certificates, and hunting for the same attacker on internal systems.
A confirmed compromise can also trigger reporting duties. Each regime has its own trigger and deadline, so treat them separately.
Under the PDPA, a data controller must notify the Personal Data Protection Commissioner of a personal data breach that causes or is likely to cause significant harm as soon as practicable and no later than 72 hours from the occurrence of the breach; the Commissioner’s Data Breach Notification Guideline explains that the clock starts when the controller is informed of, detects or confirms the breach.
Where the breach results in or is likely to result in significant harm to them, affected data subjects must be notified without unnecessary delay and no later than seven days after the notification to the Commissioner (same guideline).
An NCII entity must notify NACSA and its NCII sector lead immediately once a cyber security incident becomes known, provide the prescribed particulars within six hours, and submit supplementary information within 14 days of the initial notification, under the Cyber Security (Notification of Cyber Security Incident) Regulations 2024.
Bank Negara Malaysia reporting depends on the policy document. Institutions subject to the Business Continuity Management policy notify BNM within two hours upon confirmation of a cyber incident disruption. Under the Operational Risk Reporting policy, cyber incidents and events, including near misses, are reportable within 14 calendar days of event confirmation, with any earlier applicable deadline taking precedence.
Running a compromise assessment after patching early gives your legal and compliance teams the facts they need to decide which of these duties, if any, apply.
Frequently asked questions
If I patched my NetScaler, am I still compromised?
Not necessarily, but patching doesn’t prove you are clean. If the appliance was exposed while exploitation was active, attackers may have stolen sessions, created accounts or planted web shells before the fix. A compromise assessment checks the device and connected systems for that evidence.
What is a compromise assessment?
A compromise assessment is a review that looks for evidence of past or ongoing intrusion across devices, servers, endpoints and logs. It answers whether an attacker has been, or still is, in your environment. If it finds them, it recommends containment and remediation steps.
How long does a compromise assessment take?
It depends on scope: the number of edge devices, how much log history is available, and how many internal systems need review. Agreeing the devices and the exposure window at the start keeps the assessment focused.
How do you detect a web shell on a VPN appliance?
Compare files in web-accessible directories with known-good vendor releases and apply vendor and national indicators. Then review web and login logs for unusual requests, and check for new accounts and unexpected outbound connections. Don’t rely on file timestamps or a single integrity tool.
Who does compromise assessments in Malaysia?
Simply Data provides compromise assessment and DFIR services in Malaysia. It holds NACSA managed SOC monitoring licence 20007-01 and penetration testing licence 20007-02 under the Cyber Security Act 2024, and is ISO/IEC 27001:2022 certified and CREST-accredited.
What is the difference between a compromise assessment and a penetration test?
A penetration test asks whether an attacker could get in, by safely exploiting weaknesses. A compromise assessment asks whether an attacker already got in, by looking for evidence of intrusion. After an edge-device exploit, do the assessment first and the test second.
How do you arrange a compromise assessment in Malaysia?
Start a compromise assessment after patching with three things: a list of your patched edge devices, the dates each one was exposed and patched, and the logs you still have. That scope tells the team which systems and time window to focus on. Cost and duration depend on the number of devices, how many logs are available and how many internal systems need review.
Simply Data is ISO/IEC 27001:2022 certified, CREST-accredited and a CyberSecurity Malaysia PTSP certified provider. It also holds Singapore CSRO licences for penetration testing and managed SOC monitoring.
After investigating possible compromise and addressing the findings, test whether exploitable weaknesses remain. You can request a penetration testing scope for your VPN, ADC and firewall estate to validate remediation and identify additional weaknesses.
If you have patched an exploited edge device and aren’t sure it is clean, arrange a compromise assessment after patching or contact Simply Data to agree the scope.
