Incident analysis for litigators. cyber insurers. boards. general counsel. coverage counsel. class action defense. regulators. trustees.

Every breach looks negligent in hindsight. The question is whether the safeguards were reasonable before it — and everything else in the case sits downstream of the answer.

3areas
8subject areas
30days of logs, typically
How it works

An AI-first Institute

Stop trusting generic AI models for expensive answers.

Researchers That Never Sleep

Specialist research agents read the primary sources themselves — the advisories, the standards, and the filings — not summaries of them.

Get a Preliminary Read Now

Describe the incident. The Incident Concierge answers from the Institute’s own research, not from the open web.

Talk to an Expert

Some questions need a forensic examiner, not an article. Tell the Institute what you are facing.

begin here

What happened, and when did you learn of it?

Describe the incident to the Incident Concierge. It will help you see what is at risk of being lost, what a standard-of-care analysis would examine, and what expertise the matter needs. It does not assess a live incident, does not opine on whether any organization’s security was reasonable, and is not legal advice.

Incident Conciergeorientation, not a security opinion
Tell me roughly what happened and when it was discovered — and whether anything has been rebooted, reimaged or restored since. That last answer decides what evidence is still recoverable, so it is worth establishing first.
Advisory

When the question is bigger than one incident

Boards increasingly want the standard-of-care analysis before anyone is asking for it under oath, because the same review that would be run adversarially in litigation produces the documented risk decisions that make a position defensible. The Institute performs that review independently, for a fixed fee agreed in advance.

writing from the Institute

The uncomfortable parts, said plainly.

A breach does not prove the security was unreasonable. Following NIST does not settle it either. The most damaging document is usually a vulnerability report showing a known risk was raised and quietly deferred.

All insights
Two sets of keys hanging from adjacent hooks on a bare office wall
Standard of Care
When a vendor is breached, whose breach is it?
Legally, often both. In the three state statutes checked here, the duty to tell individuals falls on the company that owns or licenses the data; regulators put a separate oversight duty on that same company; and the vendor carries its own liability alongside — none of which the contract can reassign.
September 15, 2026
 A closed manila folder sealed with a red string tie resting on a conference table
Incident Response & Forensics
Is the forensic incident response report privileged?
Not by default, and not because a law firm signed the engagement letter. Four federal decisions ordered production, and the reports that stayed protected differed in ways that were set up before the investigation began.
September 15, 2026
 A wall clock above an empty boardroom table in early morning light
Standard of Care
What do the SEC cybersecurity disclosure rules require after an incident?
A Form 8-K within four business days of the materiality determination — not within four days of discovery — plus an annual account of the program itself. The gap between those two clocks is where most of the argument lives.
September 15, 2026
 An empty federal courtroom gallery photographed from the back row in flat morning light
Causation & Exposure
What injury does a data breach plaintiff have to show to get into federal court?
A concrete harm, and since TransUnion LLC v. Ramirez the mere risk of future harm will not by itself supply one in a damages suit. What counts as concrete after that is where the circuits have gone different ways.
September 15, 2026
 A wall-mounted analog clock above a rack of network switches in a dim equipment room
Incident Response & Forensics
What does dwell time prove about an incident?
It bounds what an intruder could have reached and it is evidence about detection. It is not by itself evidence of what was taken, and the number is usually a floor set by how long the logs survived.
September 15, 2026
 A bank lobby’s marble counter photographed early in the morning with no one standing at it
Causation & Exposure
Who bears the loss in a business email compromise wire fraud?
Usually the business that sent the money, because Uniform Commercial Code Article 4A is built to keep banks out of it. The arguments that move the loss are narrow, statutory, and different from the negligence case everyone expects to bring.
September 15, 2026
common questions

What people ask in the first hours.

These come before the analysis does. If you are dealing with a live incident, the first answer is the one that matters today.

We just discovered an incident. What should we do in the next hour?
Suspend log rotation, and do not reboot or reimage anything you have not imaged first. Those two steps take minutes, cost almost nothing, and are irreversible in the other direction — volatile memory is gone at reboot and rolled-over logs do not come back. Then issue a written litigation hold covering security telemetry, ticketing, chat and vendor records, not only email. Everything else, including who to engage and in what order, can be decided tomorrow. These cannot.
What does the Institute actually do?
It explains what the technical questions in a breach dispute are and what evidence they need: whether the safeguards were reasonable for the risk, whether the response was adequate, and whether the failure caused the exposure. It is a reference and a diagnostic. It does not assess live incidents, does not perform incident response, and does not opine on whether a particular organization was reasonable — that is the expert opinion this site helps you obtain rather than the one it supplies.
Does being breached mean our security was unreasonable?
No, and resisting that inference is much of what a defense analysis does. Competent, well-defended organizations are breached; sophisticated attackers succeed against reasonable safeguards. The legal standard asks whether the safeguards were reasonable beforehand, not whether they held. That said, the manner of the breach matters enormously — an intrusion through a year-old unpatched vulnerability with a published exploit is a very different fact pattern from a novel supply-chain compromise, and pretending otherwise helps nobody.
We follow NIST. Are we covered?
It is strong evidence and it does not end the question. Frameworks are risk-management structures rather than compliance floors, and every one of them expects the organization to decide which controls fit its circumstances. That decision is the substance of the standard. The defensible position is not "we followed NIST" but "we assessed our risk against NIST, made these decisions for these documented reasons, and here is the record" — which is a materially stronger place to be, and a rarer one.
How is the Institute paid?
The orientation and the reference material are free and require no account. Where an organization wants the standard-of-care review performed properly — independently, and ideally before anyone is demanding it — that is a private engagement billed as a fixed fee agreed in writing beforehand. Where a matter needs a retained testifying expert, the Institute helps identify the right one through its expert network.
Do you calculate what the breach cost?
No. This Institute covers the technical chain — whether the control failure produced the exposure. What the resulting loss is worth is a different discipline with its own methodologies and its own admissibility record, and it belongs to our Economic Damages Institute, which covers class-wide models and the measures of loss properly. Matters needing both are usually two engagements and often two experts, and it is better to know that early.

Preserve today. Analyze tomorrow.

Describe the incident. The Institute will help you triage what is at risk of being lost — with no incident-response service to sell you.

talk to the Institute
Incident Conciergeorientation, not a security opinion
Tell me roughly what happened and when it was discovered. If this is live or recent, the first thing worth knowing is whether anything has been rebooted, reimaged or restored — that decides what evidence is still recoverable.