Eight integrated practice areas — built around the way real investigations and security operations are actually run. Engage one capability or pair them across an investigation, a litigation matter, or an ongoing managed program.
Insider threat, fraud, attribution, and digital investigations — evidence-focused and legally defensible.
Learn more 02Call Detail Records (CDR), Historical CSLI, Cell Site analysis (tower, sector, call activations, timing advance), movement reconstruction, and litigation-ready expert testimony.
Learn more 03Analyst augmentation, alert enrichment, MITRE mapping, and orchestrated workflows on top of Wazuh.
Learn more 04Right-sized security operations, executive risk reviews, and managed visibility for SMB & mid-market.
Learn more 05Containment, forensic triage, and recovery — coordinated with counsel, insurers, and executive leadership.
Learn more 06Targeted collection, attribution analysis, and finished intelligence products for executive decisions.
Learn more 07Discreet, evidence-led inquiries into data exfiltration, policy violations, and trust compromises.
Learn more 08Executive-grade scenario rehearsals — ransomware, insider misuse, third-party compromise, and more.
Learn moreHermes augments your security operations. It triages alerts, enriches context with MITRE ATT&CK and threat intelligence, and orchestrates investigation workflows across Wazuh, Slack, and Telegram. Human analysts stay in the loop — and in command.
Confidential intake call, scope definition, and rules of engagement. Counsel and executive sponsors aligned before any technical work begins.
Forensically sound acquisition of digital evidence, telemetry, and carrier records — with chain-of-custody documentation.
Hermes-assisted triage, MITRE ATT&CK mapping, OSINT pivots, attribution analysis, and litigation-grade documentation.
Executive briefings, written findings, and — when applicable — deposition support and expert witness testimony.
CyberD20 was founded by an experienced cyber investigations and intelligence professional bringing former federal investigative experience, cybersecurity instruction, and SIEM engineering into private-sector security operations.
Engagements are led by the founder personally — not handed off to junior associates — and supplemented by a vetted network of practitioners across forensics, cellular analysis, and detection engineering.