Home/About
About the firm

Federal investigative depth. Private-sector pace.

CyberD20 Intelligence Group is a boutique cyber intelligence and investigations consultancy. The firm combines operational investigative experience, cybersecurity expertise, and AI-assisted security operations — for organizations that need defensible work, not marketing.

Corey Hubbert, Founder & Principal — CyberD20 Intelligence Group
COREY HUBBERT · FOUNDER & PRINCIPAL
Founder & Principal

Corey Hubbert

An experienced cyber investigations and intelligence professional focused on bringing operationally grounded cybersecurity and investigative services to the private sector. Corey founded CyberD20 to serve businesses, attorneys, and organizations that need work performed at an investigative standard and reported in language executives, counsel, and courts can act on.

Corey is a retired Federal Bureau of Investigation Special Agent with more than 20 years of federal service, where he focused on cyber investigations and cellular analysis & geolocation — work that included Call Detail Record examination, Historical CSLI interpretation, cell-site and sector analysis, and movement reconstruction in support of federal investigations. That same tradecraft now underpins CyberD20's expert-witness practice and litigation-support engagements.

His broader career spans cyber-enabled fraud and network-intrusion investigations, hands-on cybersecurity operations, and instruction. In parallel, he has built and tuned security operations programs — including SIEM engineering and the AI-assisted SOC tooling that powers Hermes.

Engagements are led personally and, when scope requires, supplemented by a small, vetted bench of practitioners — never handed off to junior associates.

Background
  • — Retired FBI Special Agent · 20+ years federal service
  • — Former FBI · cyber investigations
  • — Former FBI · cellular analysis & geolocation
  • — Cybersecurity instruction & curriculum
  • — Investigations & intelligence tradecraft
  • — Cybersecurity operations leadership
  • — SIEM engineering (Wazuh)
  • — AI-assisted SOC development (Hermes)
Practice focus
  • — Cyber investigations & OSINT
  • — Insider threat & cyber-enabled fraud
  • — Cellular records & expert witness work
  • — Detection engineering & SOC build-out
  • — Executive cyber risk assessments
  • — Tabletop exercises & readiness
The Idaho practice

Rooted in Idaho.
Built for the Mountain West.

N 1 2 SERVICE AREA · IDAHO
01Eastern Idaho · Idaho Falls · Pocatello · Rexburg · INL corridor · HQ
02Magic Valley · Twin Falls · Jerome

CyberD20 is an Idaho firm by design. Headquartered in Eastern Idaho — the INL corridor — and serving clients across the Magic Valley and the rest of the state. Mountain West engagements (Montana, Wyoming, Utah, Nevada, Oregon, Washington) are accepted on a case-by-case basis through counsel referrals and prior relationships.

The footprint is intentional. Eastern Idaho's mix of critical-infrastructure adjacency, agriculture, dairy, food processing, and rural healthcare produces a threat surface most cookie-cutter SOC providers don't understand. The Magic Valley's growing healthcare, ag-tech, and processing sector needs HIPAA-grade and OT-aware operators on call. The firm was built to serve these economies first.

Established Idaho law-enforcement and prosecutor relationships mean engagements move at the right speed when an investigation, subpoena, or expert designation is on the line. Court-facing work is venue-comfortable across Idaho state courts, the U.S. District Court for the District of Idaho, the Ninth Circuit, and tribal courts where appropriate.

Sectors served · Idaho
  • — Healthcare systems & rural clinics (HIPAA)
  • — Agriculture, dairy & food processing (OT/ICS)
  • — K-12 districts & universities (FERPA)
  • — State/local government & special districts
  • — Financial services & credit unions
  • — Construction, manufacturing & logistics
  • — Tech / professional services (statewide)
  • — Critical infrastructure / INL-adjacent (CUI/CMMC)
  • — Tribal nations & gaming, where appropriate
Engagement model · geographic
  • Idaho · primary. Direct engagement statewide; on-site within drive-time across Eastern Idaho and the Magic Valley.
  • Mountain West · case-by-case. Counsel referrals, prior relationships, and conflict-checked matters in MT, WY, UT, NV, OR, WA.
  • Beyond · referral. Out-of-region matters declined or referred to vetted partner firms unless a preexisting relationship applies.
Operating principles

How the firm conducts itself.

01 · Discretion

Quiet by default

Engagements are confidential. References on request, not on the website.

02 · Defensibility

Findings that hold up

Documented to a standard that survives counsel, regulators, and cross-examination.

03 · Restraint

No overstated certainty

Methodology, assumptions, and limitations stated alongside every conclusion.

04 · Independence

No government affiliation

CyberD20 is a private-sector firm. No agency endorsement is implied or claimed.

05 · Operator-led

Founder runs the matter

Engagements are led personally — not handed off to associates the client never met.

06 · Calm

No theatrics

No hooded-hacker stock photos, no FUD, no marketing hype. Just operationally grounded work.

Engage directly

Initial calls go to the founder, not a sales line.