Expertise · Digital evidence
Cybersecurity and Data-Breach Expert Witness
A useful breach opinion reconstructs what happened, what controls existed, what information was available, and whether a proposed alternative would actually have prevented or reduced the loss.
Core questions
- How did the actor obtain access and move through the environment?
- Which systems, credentials and data were affected?
- Were authentication, authorization and logging controls reasonably designed?
- Did patching, vendor management and incident response affect the outcome?
Evidence reviewed
- Authentication, endpoint, application and network logs
- Cloud and identity-provider records
- Vulnerability, patch and configuration history
- Incident-response timelines and forensic reports
- Policies, vendor contracts and access-control matrices
From chronology to causation
The work moves beyond a timeline. It tests whether the alleged control failure caused the event, whether competing causes fit the evidence, and whether hindsight claims were operationally realistic at the time.
Public sources
Engagement-specific evidence is reviewed under appropriate confidentiality and scope controls.
For counsel
Discuss the technical record.
Engagements are subject to conflicts and scope review. Initial enquiries are treated as confidential.
Contact Leo Herps ↗