Approach

Leadership

Leadership is role-disclosed, identity-restricted. We reduce exposure while maintaining accountability through decision rights, separation of duties, and privilege-aware routing where applicable. Credential matrices, redacted case studies, and references are available in diligence packets under NDA.

Leadership Team

Clients receive named points-of-contact and engagement accountability. Public pages disclose roles, not identities, to limit threat surface and protect client confidentiality. Experience spans high-consequence work across North America, Europe, the Middle East, and parts of Africa and Asia-Pacific.

Executive Security Lead (FCSO)

15+ yrs • executive risk posture • incident authority • global travel/event approvals (US/UK/EU/MENA)

Decides: risk posture, incident authority, high-risk travel and event approvals.

Interfaces: C-suite, board, outside counsel.

Director, Protective Intelligence

10+ yrs • threat triage & escalation • monitoring priorities • executive EP integration (US/EU)

Decides: signal triage, escalation level, monitoring priorities.

Interfaces: EP/physical security, legal, comms.

Case Director, Litigation & Corporate

12+ yrs • privilege-aware investigations • disclosure readiness • cross-border matters (US/Canada/UK)

Decides: investigative scope, privilege routing, disclosure readiness.

Interfaces: trial teams, GC, outside counsel.

OSINT Fusion & Analytics Lead

10+ yrs • collection plans • entity resolution • confidence scoring (US/EU/APAC)

Decides: collection plans, entity resolution, confidence scoring.

Interfaces: PI director, platform engineering.

HUMINT & Source Handling Lead

10+ yrs • source vetting • deconfliction • controlled contact strategy (North America/Europe)

Decides: source vetting, contact strategy, deconfliction & payments.

Interfaces: counsel liaison, case directors.

Red-Team & Adversarial Testing Lead

10+ yrs • test design • success criteria • remediation priorities (corporate/HNW environments)

Decides: test design, success criteria, remediation priorities.

Interfaces: FCSO, facility/IT owners.

Platform & Security Engineering Lead (Knox)

10+ yrs • access controls • audit trails • retention/redaction (regulated & enterprise environments)

Decides: access controls, audit trails, data retention & redaction.

Interfaces: analytics, compliance, client IT.

Risk, Compliance & Counsel Liaison

10+ yrs • policy alignment • legal holds • discovery posture (US/EU privacy + governance contexts)

Decides: policy alignment, legal holds, discovery posture.

Interfaces: GC, privacy, regulators.

Crisis Response Coordinator

10+ yrs • activation & war-room cadence • cross-team comms • high-tempo incidents

Decides: activation, war-room cadence, cross-team comms.

Interfaces: FCSO, comms, external partners.

How We Run Sensitive Work

  • Privilege-aware routing Counsel-first on matters likely to face discovery.
  • Separation of duties Collection ≠ analysis ≠ approval.
  • Dual-control Elevated access and sensitive source operations.
  • Auditability Actions, edits, and decision points in Knox.
  • Need-to-know partitioning Minimization and redaction by default.

Escalation & Decision Rights

Trigger Owner SLO
Credible threat signalProtective Intelligence Director≤ 60 min triage
High-risk travel/event changeFCSOSame-day
Legal hold / disclosure questionCounsel Liaison≤ 24 h
Access exception / data requestPlatform & SecEng Lead≤ 8 h
Public-facing incident commsCrisis Coordinator + CounselWar-room

Diligence Available (Under NDA)

  • Credential matrix by role (certifications, years-in-discipline, operating environments).
  • Redacted case studies (problem → method → outcome; sourcing & confidence included).
  • Client references (where permitted) and engagement accountability details.
  • Security posture summary (data handling, retention, access controls, incident process).
  • Insurance/licensing documentation as applicable to scope and jurisdiction.

Guardrails

  • No covert activity without documented legal basis and client authorization.
  • No pretexting for protected data; no scraping behind authentication without consent.
  • All briefs include provenance, assumptions, and confidence—not just conclusions.