For counsel, insurers and brokers
How we work when breach counsel directs the investigation, what our reports give adjusters, and how brokers can help clients prepare before the next renewal.
IT Rapid Support (ITRS) provides incident response and digital forensics to breach counsel, cyber insurers and brokers for clients in Toronto, the GTA and across Ontario, working under counsel's direction when counsel is retained. For an active matter call the 24/7 incident line at (289) 582-9930; we carry CA$2M in cyber liability insurance and also take expert-witness work.
Engagements directed by counsel
When a client's lawyer retains us, we work for counsel on the client's behalf. Counsel sets the questions, receives our findings, and decides what is written down, when, and for whom. We do not send findings directly to the client, insurer or anyone else without counsel's instruction.
Whether privilege attaches to our work is a legal question for counsel, and it depends on the facts of each engagement. Our part is to make the structure easy to maintain: a separate engagement letter with counsel, communications routed through counsel, draft reports marked as counsel instructs, and technical working notes kept apart from the client's operational IT records.
If the client also needs remediation work, we can scope that separately so the operational work and the investigation are not mixed in one file.
What adjusters and insurers usually need from forensics
Each insurer and policy is different, but forensic questions on a cyber claim tend to fall into the same groups. We write reports so each can be answered with evidence or clearly marked as not determinable.
- Root cause: how the threat actor got in, and when
- Dwell time and timeline of attacker activity
- Systems, accounts and data affected
- Whether personal or confidential information was accessed or exfiltrated, and the basis for that conclusion
- Containment and eradication steps taken, with dates
- Whether the controls stated in the insurance application were in place at the time
- Time and cost records for the forensic work itself
Reports: preliminary findings versus final report
Early decisions such as notification, business interruption estimates and whether to engage further vendors cannot wait for a final report. We therefore distinguish two kinds of output, and label them clearly.
| Item | Preliminary findings | Final report |
|---|---|---|
Purpose | Support urgent decisions | Complete record of the investigation |
Form | Usually verbal briefing or short memo to counsel | Written report with timeline, evidence references and limitations |
Certainty | Working conclusions, expressly subject to change | Conclusions with the evidence that supports each one |
Distribution | As counsel directs | As counsel directs |
For brokers: readiness for clients before renewal
Underwriting questionnaires now ask detailed questions about MFA, backups, endpoint protection and privileged access, and an inaccurate answer can cause trouble at claim time. Brokers can help clients by getting the facts checked before the application is signed.
For clients on Microsoft 365, our Microsoft 365 security assessment reviews the settings that questionnaires ask about, such as MFA, admin accounts, mailbox protection and audit logging. Clients receive their own findings; we do not share them with the insurer unless the client asks us to.
Confidentiality and evidence handling
Evidence handling follows the approach described in ISO/IEC 27037 (identification, collection, acquisition and preservation of digital evidence) and NIST guidance for forensics in incident response:
- Every item collected is recorded on a chain-of-custody log: what, from where, when, by whom
- Forensic images and exports are hash-verified at collection and again before analysis
- Evidence is stored encrypted, with access limited to the people working the matter
- Retention and return or destruction of evidence follow the engagement letter
- Where the matter may lead to litigation, our methodology is written up so it can be explained to a court, in line with the Sedona Canada Principles' emphasis on reasonable, good-faith preservation
How to refer a matter
For an active incident (ransomware, business email compromise or a suspected breach), call our 24/7 incident line at (289) 582-9930. Tell us who you are, who the client is, and whether counsel is already involved; if you are counsel, we will open the engagement in your name. For non-urgent referrals, readiness work or a conflict check, use the contact form.
IT Rapid Support has operated since 2018 from Vaughan (head office) and Vancouver, and carries $2 million in cyber liability insurance. We also provide expert-witness services where a matter proceeds to litigation.
The first hour of a referral
Call, do not email the client's mailbox
If the incident is email-related, the attacker may be reading the client's mail. Give us a phone contact.
Tell us who directs the work
Counsel, the insurer, or the client directly. That decides who we report to.
Containment instructions go out first
We give the client or their IT provider containment steps that preserve evidence, while the engagement letter is prepared.
Evidence is preserved before cleanup
Logs, mailboxes and affected devices are collected and hashed before anything is rebuilt.
Data you can cite
For brokers and underwriters looking at email risk in the region, our Q4 2026 GTA email security study tracks DMARC enforcement across a fixed panel of about 500 GTA business domains: 20.7% of 482 mail-enabled domains enforced DMARC on October 31, 2026, against 20.6% in August. It is published under CC BY 4.0 and may be quoted with attribution.
FAQ for referrers
Yes. We usually need their help with access and history. We ask them to preserve rather than clean up, and we keep investigation findings within the counsel-directed engagement.
We can discuss the situation and the likely scope on the first call. Findings come only after evidence has been reviewed under an engagement.
No. We provide the forensic facts those vendors and counsel rely on, and coordinate with them as counsel directs.
Our offices are in Ontario and British Columbia. Cloud investigations can be carried out remotely for clients elsewhere in Canada.
Related.
- PracticeCyber Forensics & AssuranceIncident response, digital forensics, penetration testing and independent attestation.
- GuideWorking with your cyber insurer after an incidentYou have had an incident and you have cyber insurance. This guide covers what to check in the policy, how vendor choice works, what evidence the claim will need, and the…
- GuideWhat a post-incident attestation letter can and can't sayAfter an incident, clients, partners and insurers often ask for a letter confirming you are safe.
- ServiceDigital forensics expert witnessIndependent analysis of electronic evidence, written up as an expert report that meets the court's requirements and explained clearly under cross-examination.
- PageCredentials and assuranceThe facts about who we are, where we work, how we are insured and how we handle evidence and confidential information, stated plainly so you can check them.
- ArticleGTA Business Email Security, Q4 2026: Three Months On, DMARC Enforcement Has Not MovedWe re-scanned the public DNS of the same 500 Greater Toronto Area business domains we measured in August 2026.
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.