Digital Forensics & Incident Response (DFIR)

Investigates security incidents and supports recovery after a breach. Includes digital forensics to examine compromised systems and determine attacker access methods, malware analysis to identify behavior and origin of malicious code, compromise assessment to check for existing breaches, incident investigation, and evidence collection and analysis for legal, regulatory, or insurance purposes.