Special Situations · Investigations
When the normal process stops producing clarity.
Independent technical investigation for executives and counsel when an incident, dispute, failure, or unusual claim has become material.
01 · Incident Closure Review
The incident is contained. That is not the same as closed.
Typically $20,000–$30,000+ depending on scope · scoped after intake
After a serious incident, leadership is asked to accept a conclusion: contained, eradicated, closed. That conclusion usually comes from the same people, internal or vendor, who ran the response. Before the board accepts it, before regulators or customers are told, before the insurance narrative hardens, an independent review tests whether the evidence actually supports it.
I examine the investigation record, the containment and eradication evidence, the scoping decisions, and what was not looked at. The deliverable is an independent written conclusion: the closure holds, it holds only with named conditions, or it does not hold and here is what remains open.
Know a board or GC being asked to sign off on an incident right now? Send them this page.
02 · Other Special Situations
Problems that fit no service catalog.
Two credible teams with technically conflicting explanations for the same failure.
A vendor dispute where the technical facts decide the commercial outcome.
A failed implementation, and disagreement about why.
Evidence that needs to be reconstructed before anyone can say what happened.
A technical question arising in litigation that needs an answer that will hold up.
A disputed remediation plan, and a large invoice that depends on it.
A consequential technical claim nobody has independently tested.
03 · The Stance
What the evidence supports, and where it stops.
I do not advocate for a predetermined technical conclusion. I determine what the available evidence supports and where the evidence stops. Fact is separated from inference, assumptions from evidence, and material unknowns from noise.
The background for this work is high-severity incident response and investigation: technically ambiguous environments, contested explanations, and conclusions that had to hold up in front of executives. That is the discipline these situations get.
The output is a defensible conclusion. Where the evidence is not sufficient to support one, that finding is the conclusion, along with what it would take to know.
Scoped after intake · expedited timelines available