Engage with us
How an engagement begins.
Every engagement starts with a confidential conversation with a senior investigator, not a salesperson. Here is what happens next, what to prepare and how quickly we move.
The process
From first conversation to kickoff.
Most engagements move from introduction to active collection within three business days. Urgent matters involving a threat to someone's safety move faster.
-
01 / Introduction
A confidential introduction
Most new clients reach us through their counsel, insurer, an existing client or a trusted partner, who arranges an introduction to our intake team. Discretion begins before the first call.
-
02 / Scoping
A scoping call with an investigator
Within one business day, a senior investigator discusses the problem with you, asks the questions that will shape the work and tells you candidly what open sources can and cannot establish.
-
03 / Screening
Ethics and conflict checks
We verify the client, check for conflicts of interest and screen the request against our standards. This usually takes less than 48 hours, and a few hours when the matter is urgent.
-
04 / Proposal
A fixed-fee proposal
Within two business days of the scoping call, you receive a written proposal setting out the intelligence requirements, method, team, deliverables, timeline and a fixed fee. There are no hourly surprises.
-
05 / Kickoff
Kickoff and collection
Once the engagement letter is signed, your named lead investigator assembles the team and collection begins, usually the same day.
-
06 / Updates
Regular, honest updates
You hear from your lead investigator at agreed intervals, and immediately if we find something that changes the risk picture or the plan.
Before the scoping call
What to prepare.
You do not need a perfectly formed question. You do need to tell us what decision our work will inform.
Share only what you are comfortable sharing before a confidentiality agreement is in place. We will tell you what we need, and when.
- The decision or action the answer will inform
- What you already know, and how you know it
- Any identifiers you hold: names, accounts, domains, companies, wallets
- Deadlines that matter, such as a hearing, a closing date or an event
- Who else is involved: counsel, insurers, law enforcement or regulators
- Any constraints on how the work must be conducted or reported
Engagement models
Four ways to work with us.
Single investigation
A defined question, a fixed fee and a finished report with an evidence bundle and debrief.
Retained program
A reserved team and priority tasking for organizations with a steady flow of questions.
Monitoring subscription
Continuous, analyst-verified coverage of the threats that matter to you, with 24/7 escalation.
Training
Tradecraft courses for your own investigators, delivered by the people who run our live cases.
Response times
How quickly we move.
These are commitments, not aspirations. Timelines for each engagement are confirmed in writing in the proposal.
| Situation | First response | Typical delivery |
|---|---|---|
| Threat to someone's safety | Same day, 24/7 | Initial threat triage within 4 hours |
| Breach or extortion claim | Same day, 24/7 | Verified assessment usually within 48 hours |
| Crisis affecting your people or sites | Same day, 24/7 | First verified situation report within 2 hours |
| Urgent investigation | Within one business day | First assessment within 24 hours of kickoff |
| Standard investigation | Within one business day | Median of 11 days to finished report |
| Due diligence | Within one business day | Red-flag screen in 48 hours; 5 to 15 business days in full |
| Screening and vetting | Within one business day | Identity check in 24 hours; 3 to 5 business days in full |
| Supply chain mapping | Within one business day | 3 to 6 weeks per product line, priority findings as confirmed |
| Monitoring program | Within one business day | Live within 10 business days of kickoff |
| Training | Within two business days | Scheduled to suit your team |
Confidentiality
Discretion from the first conversation.
Confidentiality agreements
We sign a mutual confidentiality agreement before you share sensitive details, and we never disclose who our clients are.
Working under privilege
Where appropriate, we are engaged through your outside counsel so that our work product can be protected by legal privilege. See how we work with counsel and other advisers.
Secure channels
Once engaged, all communication and file exchange moves to an encrypted channel assigned to your case and named in your engagement letter.
Existing clients should continue to use the secure channel named in their engagement letter. For your protection, we will never ask you to send sensitive material through an unverified channel.
Common questions
Before you begin.
How much does an investigation cost?
Every engagement is priced as a fixed fee agreed at scoping, based on the question, the sources involved, the languages required and the deadline. You will know the full cost before any work begins.
What if open sources cannot answer my question?
We will tell you during scoping. If our early assessment suggests the answer is unlikely to be found lawfully, we say so rather than sell you an investigation that cannot succeed.
Will the subject know we are looking?
No. All research runs through managed, non-attributable infrastructure, and we never contact or engage the subject of an investigation.
Can you work alongside law enforcement or regulators?
Yes. Many of our findings are prepared specifically for referral, and we regularly coordinate with authorities at the client's direction. See our full FAQ for more.
While you prepare
See how we work before we speak.
Most clients read a case study or two before the scoping call. It makes the first conversation faster and more useful.