Incident Response and Litigation Support

Kroll’s elite security leaders deliver rapid responses for over 3,000 incidents per year and have the resources and expertise to support the entire incident lifecycle, including litigation demands. Gain peace of mind in a crisis.

Explore Cyber Risk

Cyber Insights

Cyber Case Studies

Cyber Awards

Kroll is the largest global incident response provider with unrivalled expertise and frontline threat intel to protect, detect, and respond against cyberattacks.

No matter the type of data loss or cybercrime, Kroll has the experience and resources (human and technology) to move quickly, to discern, isolate and secure valuable relevant data and investigate the digital trail, wherever it may lead. For example, in the case of malicious insiders, we can combine computer forensic expertise with traditional investigative methodology, including interviews and surveillance, to retrace the behavior of people who may have had access to protected or proprietary information.

In the event of digital attacks, such as malware, ransomware or an email account compromise, Kroll’s cyber investigation teams can collect and examine physical and digital evidence to uncover important information, such as where, when and how an incident occurred—and if systems are still at risk. We will determine what data was compromised and whether digital evidence was erased or modified. We will also work with your teams to recover data, whenever possible, and recreate events and exchanges so that you have an accurate diagnosis to develop an effective recovery plan.

With the rising concerns of ransomware and intrusions that leverage data exfiltration, Kroll’s incident response teams have not only the experience to properly investigate the many aspects of risk to data, but also the technical understanding of how to properly contain the threat and eject active actors from compromised networks.

– Devon Ackerman, Managing Director, Global Head of Digital Forensics and Incident Response

Case Study – Insider Threat Investigation

Watch Michael Quinn, a managing director in our practice, recount an insider threat investigation his team conducted.

Case Study – Insider Threat Investigation

A global software company based in Europe received an email from an anonymous source stating the sender had access to personally identifiable information, confidential financial data and IP source code for one of its subsidiaries. The sender gave Kroll’s client two weeks to pay a ransom of one million euros in bitcoin before it was leaked. Kroll's forensic investigators ascertained that an insider threat was the source of the infiltration, identified the individual responsible and provided the necessary evidence to assist with a prosecution.

For more details, read the full case study.

Trial-Tested Litigation Support Services

Kroll’s litigation support services team works in tandem with our incident responders to optimize the investigation process, expedite data collection either remotely or onsite, perform eDiscovery and deliver case-changing insights.

Unique Threat Intelligence Expertise

Kroll experts have unique experience from international intelligence agencies including the FBI, DOJ, GCHQ and Europol. Our cadre of experts also hold more than 100 types of industry certifications.

Flexible Incident Response Retainers

Kroll incident response retainers are designed to provide peace of mind and offer maximum flexibility. Get access to elite digital forensics and incident response capabilities, alongside an array of proactive services that ensure you get tangible value.

Cyber Insurance Preferred Partner

Kroll has a dedicated team for insurance and legal channels, with extensive relationships with 50+ cyber insurance brokers and carriers worldwide and exclusive benefits to insureds.

Enabling Diligent, Seamless Response Worldwide

Elite DFIR	Litigation Support	Intelligence Platform
300+ experts worldwide, familiar with legal holds and evidence preservation Streamlined artifact collection and parsing with proprietary tool KAPE Extensive cloud, IoT, IT/OT/ICS response capabilities	Deep experience through entire litigation lifecycle handling complex data Relativity Certified Partner with best-in-class Relativity certifications Forrester-recognized eDiscovery specialist	Proprietary database leveraging hundreds of sources enriched with frontline intelligence from 3000+ incidents handled per year.

Communication	Remediation and Recovery	Notification
Strategic and crisis communications expertise Communications support pre, during and post incident	Incident recovery and remediation services Extensive monitoring capabilities supported by skilled investigators Multi-lingual consultative call center capabilities	Legal and regulatory experience in DFIR and Notification teams Infinitely scalable – handled over 300M records worldwide

Kroll’s cybercrime investigation experts reflect our multidisciplinary team approach to problem-solving and leadership. In the event of litigation or regulatory action, we can work closely with general counsel, senior executives, audit committees or outside counsel at each stage to explicate forensics data and assure your objectives are met. If requested, we can assemble a case file for a referral to a regulator or law enforcement agency or serve as expert witnesses.

Kroll Cyber Incident Response and Litigation Support

Below are a select few of our services available to support incident response, eDiscovery and cyber investigations:

24x7 Incident Response
Whether your incident is the result of a malicious hacker or accidental exposure by an employee, Kroll can help. Our global network of certified security and digital forensic experts can deploy remote solutions quickly and/or be onsite within hours to help you contain the situation and determine next steps.
Digital Forensics
Kroll’s computer forensics experts help ensure no digital evidence is overlooked and assist at any stage of a digital forensics investigation or litigation, regardless of the number or location of data sources.
Cyber Litigation Support
If you need to respond to an investigatory matter, forensic discovery demand or information security incident, Kroll’s forensic engineers can help you win cases and mitigate losses. Many of our experts have considerable expert testimony experience in presenting findings to judges, juries and arbitrators, with many having served as special masters at the court’s appointment.
Global eDiscovery Solutions
Kroll's eDiscovery specialists can provide support throughout the entire eDiscovery lifecycle for a wide arrange of matters.
PCI Forensic Investigator
Kroll’s PCI forensic investigators (PFIs) will help determine if, when and/or how cardholder data compromise may have occurred, using proven investigative methodologies and tools. Our PFI investigators can also conduct PCI Security Standard Council-mandated investigations.

Data Recovery and Forensic Analysis
Our experienced experts use advanced forensic software and protocols to collect and preserve data collection from every aspect of your digital environment—servers to laptops to smartphones. We handle evidence with proven, forensically sound methodology, using data recovery tools and processes that are supported by case law.
Malware and Advanced Persistent Threat Detection
Kroll’s specially trained information security consultants and network forensic analysts perform live system memory and forensic analysis on continually evolving malware. We are also experienced in determining the scope and intent of advanced persistent threats so you can launch a more targeted and effective response.
Incident Response Threat Simulations
Kroll follows a seven-step process refined by our experience leading hundreds of cyber tabletop exercises (TTX) for client organizations of various sizes, complexity and industry sectors. Participating in a Kroll TTX helps your team clarify and rehearse their roles and develop greater confidence to perform effectively in the event of an incident.
Incident Recovery and Remediation
Expedite system recovery and minimize business disruption, with services including device and server reimaging, active directory rebuilding, network segmentation, hardware upgrades or replacements, patch management and network hardening.

Many more solutions are available, use the links on this page to explore them further or speak to a Kroll expert today via our 24x7 cyber incident hotlines or our contact page.

Key Areas

Increased Cyber Resilience with a Cyber Risk Retainer

Kroll delivers more than a typical incident response retainer—secure a true cyber risk retainer with elite digital forensics and incident response capabilities and maximum flexibility for proactive and notification services.

Connect With Us

Devon Ackerman

Global Head of Incident Response

Cyber Risk

New York

+1 201 463 6897 Devon Ackerman

Joel Bowers

Global Head of Litigation Support

Cyber Risk

Toronto

+1 416 361 6742 Joel Bowers

Colin Sheppard

Managing Director, EMEA Head of Incident Response

Cyber Risk

London

+44 2070295072 Colin Sheppard

Stay Ahead with Kroll

Data Collection and Preservation

Improve investigations and reduce your potential for litigation and fines with the strict chain-of-custody protocol our experts follow at every stage of the data collection process.

Data Collection and Preservation

Computer Forensics

Kroll's computer forensics experts ensure that no digital evidence is overlooked and assist at any stage of an investigation or litigation, regardless of the number or location of data sources.

Computer Forensics

24x7 Incident Response

Kroll is the largest global IR provider with experienced responders who can handle the entire security incident lifecycle.

24x7 Incident Response

Office 365 Security, Forensics and Incident Response

Digital forensic experts investigate hundreds of Office 365 incidents per year and help strengthen your security.

Office 365 Security, Forensics and Incident Response

Malware Analysis and Reverse Engineering

Kroll’s Malware Analysis and Reverse Engineering team draws from decades of private and public-sector experience, across all industries, to deliver actionable findings through in-depth technical analysis of benign and malicious code.

Malware Analysis and Reverse Engineering

Malware and Advanced Persistent Threat Detection

Our expertise allows us to identify and analyze the scope and intent of advanced persistent threats to launch a targeted and effective response.

Malware and Advanced Persistent Threat Detection

Business Email Compromise (BEC) Response and Investigation

In a business email compromise (BEC) attack, fast and decisive response can make a tremendous difference in limiting financial, reputational and litigation risk. With decades of experience investigating BEC scams across a variety of platforms and proprietary forensic tools, Kroll is your ultimate BEC response partner.

Business Email Compromise (BEC) Response and Investigation

Global eDiscovery Services

Award winning, Forrester-recognized eDiscovery specialist trusted by clients year after year with experienced professionals who provide support throughout the entire eDiscovery lifecycle.

Global eDiscovery Services

Cyber Litigation Support

Whether responding to an investigatory matter, forensic discovery demand, or information security incident, Kroll’s forensic engineers have extensive experience providing litigation support and global eDiscovery services to help clients win cases and mitigate losses.

Cyber Litigation Support

Explore Insights

PasskeyScanner: A Kroll BurpSuite Extension for Passkeys

Cyber