For Cyber Insurance Carriers
When your insured calls, we answer. 24/7 incident response from court-qualified forensic examiners.
Sherlock Forensics is a cyber insurance approved vendor providing 24/7 incident response, digital forensics and breach notification support for insured organizations. Our court-qualified forensic examiners deliver court-admissible reporting with strict chain-of-custody protocols, PIPEDA and GDPR compliant documentation and expert witness testimony. We offer 1-hour acknowledgment, 4-hour initial response and 24-hour on-site or remote deployment SLAs.
Insurance carriers need a forensics vendor who picks up the phone at 2 AM, produces reports that hold up in court and communicates clearly with adjusters, counsel and the insured. That is what we do. Every engagement follows documented methodology, preserves chain of custody and produces deliverables designed for claims files and regulatory submissions.
What Insurers Need
Every investigation follows NIST SP 800-86 and ISO 27037 standards. Our methodology has been tested under cross-examination and accepted by courts in British Columbia and Newfoundland. Reports are written for judges, not just IT departments.
Forensic evidence is collected, documented and preserved using protocols that maintain admissibility from acquisition through testimony. Every evidence item is hash-verified, timestamped and tracked through a continuous chain of custody.
Reports address PIPEDA mandatory breach notification requirements, provincial privacy legislation and GDPR obligations for organizations with EU data subjects. Documentation maps directly to regulatory reporting templates.
We build forensic timelines that show exactly when the attacker entered, what they accessed, how they moved laterally and when data was exfiltrated. These timelines anchor claims decisions and regulatory notifications.
Every investigation identifies the initial attack vector, contributing security gaps and the complete kill chain. Root cause findings inform both the claims file and the insured's remediation requirements.
When a claim proceeds to litigation or subrogation, our principal examiner provides expert witness testimony. Court-qualified in digital forensics with experience in both civil and criminal proceedings across multiple Canadian jurisdictions.
Response SLAs
| Milestone | SLA | What Happens |
|---|---|---|
| Acknowledgment | 1 hour | Qualified examiner confirms receipt, gathers initial details from carrier or insured |
| Initial Response | 4 hours | Remote triage begins, containment guidance provided, evidence preservation initiated |
| On-site or Remote Deployment | 24 hours | Full forensic collection underway, either on-site or via remote acquisition tools |
| Preliminary Findings | 48-72 hours | Initial scope assessment, confirmed indicators of compromise and preliminary timeline delivered to carrier |
Policy Coverage
24/7 breach containment, threat actor eviction, credential rotation coordination and business continuity guidance. Covered under first-party incident response provisions.
Forensic imaging, log analysis, memory forensics, malware analysis and timeline reconstruction. Covered under forensic investigation provisions of most cyber policies.
Scope-of-compromise determination, affected records identification and regulatory notification documentation for PIPEDA, provincial legislation and GDPR. Covered under notification expense provisions.
Court-qualified testimony for coverage disputes, subrogation actions and regulatory proceedings. Covered under legal expense or defense cost provisions.
Post-incident hardening recommendations, control gap analysis and remediation verification. Often covered under crisis management or restoration expense provisions.
Vendor Panel
We provide all documentation required for vendor onboarding: proof of E&O insurance, certifications, methodology documentation, sample reports and references from existing carrier relationships. Most onboarding completes within two weeks.
Frequently Asked Questions
24/7 incident response from court-qualified forensic examiners. One call to activate. Reports designed for claims files and regulatory submissions.
Call 604.229.1994