Independent technical practice
Independent forensics for carriers and counsel
Independent findings for carriers, breach coaches and coverage counsel. We apply the same standard of proof whether the claim is paid or contested.
For carriers, brokers and claims teams
The work we do for this sector
Grouped by matter type. Each link opens a service page with the scope, evidence sources, deliverables and limits.
Incident response & retainers
Retainer scope, activation, included hours, travel and response commitments are agreed in the contract. Use the 24/7 hotline for an active incident.
Claim investigation
Independent technical fact development for coverage and subrogation decisions.
Portfolio and diligence
Cyber due diligence and executive risk briefings for portfolio companies.
Exposure
What the claim record must prove
Cyber claims depend on records that can be lost or overwritten. Initial access vector, dwell time, data actually accessed and the state of controls at the time of loss all have to be established from logs and images that are often incomplete by the time a claim is noticed, which is why the first days of an investigation determine what can be proven later.
Coverage frequently depends on what the insured represented at underwriting: multi-factor authentication, backup posture, segmentation and patch discipline. Whether those controls existed in practice and worked on the date of loss is a forensic question, not a questionnaire question.
Fraudulent and inflated claims sit alongside genuine ones, and social-engineering and funds-transfer claims increasingly involve synthetic voice or video, so authentication of the instruction itself has become part of routine claim examination.
Scoping
Questions the engagement must answer
- What is the factual basis for the claimed loss, and what is inferred from it?
- Which artifacts establish the timeline of the incident and the insured’s response?
- Are the technical controls represented in the application consistent with what is observed?
- Which findings are relevant to coverage, and which are simply interesting?
- What documentation will the file need if the claim is later disputed?
Services
How we help
-
Digital Forensics & Expert Witness
Claim investigation, evidence preservation and testimony for coverage and subrogation disputes.
-
AI & Deepfake Analysis
Authentication of disputed audio, video and documents in funds-transfer and identity claims.
-
Incident Response & Retainer Programs
Response and evidence support subject to the engagement, available qualified personnel and any insurer or panel authorization required.
-
Cyber Due Diligence
Pre-bind and portfolio risk review of an insured’s actual security posture.
Context
Claims and coverage context
- Claims forensics
- Findings are documented to be readable by an adjuster, defensible to counsel and usable in a proceeding without being rewritten.
- Policyholder duties
- Cooperation, notice and preservation obligations shape what evidence should exist, and we advise on preservation so a coverage question is not decided by avoidable data loss.
- Panel and breach-coach work
- Engagements are routinely structured through breach counsel so the analysis sits inside privilege where the carrier and insured both intend it to.
- Subrogation support
- Where recovery against a vendor or third party is in view, evidence is collected from the outset in a form that supports the later claim.
We work as the independent technical examiner; coverage decisions remain with the carrier and its counsel.
Related case study
Massive Financial Fraud
Multi-entity financial fraud investigation supported by digital evidence.
Financial Fraud
Identify the client and the loss question
Confirm whether the engagement is for the carrier, insured or counsel, who can instruct the examiner, and who may receive the report. Document conflicts, coverage questions left to the carrier and privileged work directed by counsel.
- Provide the event range, claimed loss, systems involved, original records, previous response work and the insurer's authorization requirements.
- An illustrative loss chronology separates the reported incident, observed access, restoration costs and documentary support for each cost.
- A control matrix records the policy or configuration examined, the test performed, its result and the visibility limit; it does not by itself decide coverage.
- A response plan identifies authorized containment, evidence priorities, operating owners and contractual deployment arrangements.
A forensic report does not establish that an insured loss is covered, that a retainer is panel approved or that on-site personnel can arrive within a particular time.
Talk with an examiner
Talk with the team that works your industry
Tell us the matter, sector and deadline. We can discuss relevant experience and the technical scope.
Since 1992 · 24/7 dispatch · Court-tested experts
Talk with an examiner
Discuss the matter and the next step.
Call to discuss timing, scope and the safest way to share information. Do not send evidence or credentials by email.
24/7 hotline: 1-800-868-8189