Special Situations · Digital Forensics & Incident Response · Victorino LLC
When the breach is serious, strange, or headed for scrutiny.
Principal-led incident response and forensics for nation-state intrusions, ransomware and extortion, and post-breach investigations that will face regulators, litigation, insurers or public disclosure. Any industry, any country, unfamiliar technology. In English, Spanish and Russian; working Italian and Japanese.
More than a decade on the front line of enterprise compromise: nation-state intrusions, ransomware and advanced persistent threats for Microsoft customers worldwide at Microsoft DART; high-severity breach investigations for Fortune 100 clients at IBM X-Force IRIS; cloud control-plane investigation at CrowdStrike; forensics and acquisition-related technical examination at NCC Group. GCFA, GNFA, GCFE, GREM, GCIH, GCIA, GASF and CISSP. Former employers are not clients or endorsers of this practice.
Active incident: email URGENT
What I handle
- Nation-state and APT intrusions. Long-dwell espionage across identity, endpoint and cloud: scoping, hunting, eviction planning and attribution assessment with stated confidence.
- Ransomware and extortion. Containment and recovery decisions under pressure, including hypervisor and ESXi encryption, data-theft scoping and the evidence your counsel and insurer will ask for.
- Cloud and identity compromise. Entra ID, Active Directory, Azure and AWS control-plane investigations: forged tokens, rogue applications, persistence in identity and the blast radius of a stolen administrator.
- Business email compromise and payment fraud. Mailbox and tenant forensics, fraudulent payment changes, the timeline your bank and insurer need, and closing the door that was used.
- Malware and unusual technology. Reverse engineering of custom implants, memory forensics, smartphone forensics and systems nobody on your team has seen before. If it runs code, it leaves evidence.
- Cross-border and sensitive matters. Incidents that span countries, languages and legal systems; insider and data-theft investigations; technical evidence for counsel, boards and expert-witness work.
Engagements
Fees are for principal-led work. Travel, specialist partners, forensic hardware and third-party tooling are quoted separately. Every matter starts with written authorization and confirmed capacity.
01
Emergency Incident Response
An active incident, led personally from the first call.
Up to ten business days of principal-led response: triage, containment advice, evidence preservation, scoping across identity, endpoint and cloud, and the first decisions on recovery, notification and law enforcement. Continues at $5,000 per day where needed.
$50,000 initial engagement
Scope & terms
Engagement letter before technical work, directed by your counsel where privilege matters. Notify your cyber insurer first if you have one; panel requirements may apply. Paid at engagement.
What you receive
A daily situation brief, a preserved evidence set with chain of custody, a scoped incident timeline and a written containment and recovery plan.
02
Incident Response Retainer
Terms, access and a plan agreed before the worst day.
Pre-signed terms so response starts on the first call, an onboarding review of your logging, evidence sources and escalation paths, and a prepaid balance applied to incident response or readiness work during the year.
$50,000/year
Scope & terms
Annual, paid in advance. Unused balance can fund a compromise assessment, tabletop exercise or readiness work within the term. Priority within confirmed capacity; not a 24/7 monitoring service.
What you receive
Signed response terms, a readiness report naming the evidence you would be missing today, and a one-page call tree for your leadership and counsel.
03
Compromise Assessment
An answer to one question: is an adversary already inside?
Hypothesis-driven hunting across authentication, endpoints, cloud control planes and email for persistence, lateral movement and data staging. Common before an acquisition, after a suspicious event or when a regulator asks.
$75,000 flat
Scope & terms
One organization and agreed environments, three to four weeks. Read access to your telemetry and tools; I can work inside your existing CrowdStrike Falcon or Microsoft Defender deployment. Any live intrusion found converts to incident response under written terms.
What you receive
A signed findings report: what was examined, what was found, what could not be examined and why, and the hardening actions ranked by risk.
04
APT Attribution & Intelligence Assessment
Who did this, how sure we are, and what they will do next.
Malware reverse engineering, infrastructure analysis and tradecraft comparison against published threat intelligence to assess the likely actor, their objectives and the chance they return.
From $100,000
Scope & terms
Conclusions carry explicit confidence levels and alternative hypotheses. Attribution supports decisions; it is not a legal finding. Law-enforcement and government engagement is coordinated with your counsel.
What you receive
An intelligence assessment written for executives and counsel, a technical annex with indicators and reverse-engineering notes, and detection content for your tools.
05
Post-Breach Forensic Investigation
The investigation that has to survive regulators, litigation and disclosure.
A complete reconstruction of what happened, what data was accessed or taken and when, built to the evidentiary standard required for regulatory notification, insurance claims, litigation and public statements.
From $150,000
Scope & terms
Counsel-directed under privilege where appropriate. Scope, milestones and fees agreed in writing. Expert-witness and testimony support quoted separately.
What you receive
A forensic report with timeline, data-exposure determination, root cause, and evidence chain of custody, plus an executive summary for the board and regulators.
06
Eradication & Recovery Program
Getting a determined adversary out and keeping them out.
A coordinated eviction across identity, endpoints and cloud, rebuild and hardening of the systems the adversary controlled, and verification that the access paths are closed. Large and multi-site programs scale with vetted specialist teams under one accountable lead.
From $250,000
Scope & terms
Phased statement of work with defined milestones and a change process. Specialist and partner costs are disclosed and approved before they are incurred.
What you receive
An executed eviction plan, hardened identity and endpoint controls, an incident closure review stating what is known, unknown and still at risk, and a written record another team can operate from.
How a matter runs
- Authorize: engagement letter, conflicts check, counsel and privilege, insurer notification, and who may make which decisions.
- Stabilize and preserve: stop the bleeding without destroying the evidence you will need later.
- Scope and hunt: establish the entry point, every foothold and the data at risk.
- Analyze and attribute: reverse engineer what was used, reconstruct the timeline and assess the actor with stated confidence.
- Eradicate and recover: evict in one coordinated move, rebuild what was controlled and verify the doors are closed.
- Close and report: an incident closure review and a report that holds up in front of regulators, courts and boards.
Straight about scale
One principal leads and signs every matter, from the first call to the closure review. There is no 24/7 bench of hundreds and no proprietary global intelligence platform. When an incident needs more hands, I bring in vetted specialists and work alongside your insurer's panel firm, counsel and law enforcement, with one accountable lead. I take one major incident at a time and confirm capacity before accepting.
Boundaries
Authorized work only. No hack-back, unauthorized access, surveillance or intimidation. Ransom payment decisions belong to you, your counsel and your insurer, with sanctions screening; I provide the technical facts. No government affiliation or authority is claimed. Initial triage is not a guarantee of recovery.
Active incident?
Email with URGENT in the subject line and a callback number. Do not send credentials or evidence by email; we agree a protected channel first.
joey@victori.no (subject: URGENT)
Confidential first conversation
Under attack, or about to be scrutinized?
Tell me what happened, when you noticed, who else is involved, and what decision you face. If I cannot take the matter, I will say so quickly.
