Cybersecurity Incident Response

CRA assists companies and their counsel in independently investigating and responding to complex cybercrime and data breach incidents. We have worked on thousands of such matters, including many covered by the media. We are noted for deploying cross-trained teams of professionals who are experienced at working under privilege to help clients establish facts and gain deeper insights more quickly. This enables clients to assess exposure and take defensible, corrective action to get back to business as usual.

Our professionals include information security experts, incident responders, former IT auditors, former law enforcement officers, eDiscovery professionals, and computer forensics experts with deep technical and analytical skills, and decades of investigative and cybersecurity experience. We bring a pragmatic and practical approach to addressing threats and incidents to limit disruption.


Our methodology begins with conducting a Situation Assessment to document initial context, scope, and objectives. From the Situation Assessment, we pivot to the following:

  • The Collection process including the identification and forensic preservation of relevant evidence that supports the foundation for the investigation.
  • The Analysis stage focusing on conducting interviews and analyzing critical information to understand the relevant issues, which includes the timing of key events, understanding the impacted data, identifying if information was breached, and who may be impacted.
  • Reporting includes regular updates to counsel and management, and if necessary, assisting in regulatory and law enforcement responses and notification efforts.
  • Remediation includes providing practical insights and observations to mitigate future incidents.



  • 01
    Cybersecurity incident response - Fortune 100 company
    CRA was retained to investigate a cyber event at a Fortune 100 financial institution.
    View engagement
  • 02
    Cybersecurity incident response
    CRA identifies hidden application data flows inserted by a hacker.
    View engagement
  • 03
    Cybersecurity incident response
    CRA is retained to investigate a cyber-gang attack.
    View engagement

Subscribe to receive our latest Insights.