In incident response, if you wipe systems first and ask questions later, you’re deleting the truth.

In this episode, host Anthony Hess sits down with Devon Ackerman, Global Head of Digital Forensics and Incident Response at Cybereason, to unpack what serious DFIR looks like when your audience is regulators, legal counsel, and insurance carriers and brokers. A former FBI Supervisory Special Agent and Senior Forensic Examiner, Devon explains why his team approaches every matter as if it could end up in court, and what that changes in practice.

He breaks down how to scope an incident from the first call, preserve evidence before “fixing” the environment, and pressure-test tool output instead of blindly trusting it. Anthony and Devon also dig into AI and automation in DFIR, the central role of timelines and logging in telling a credible breach story, and why third- and fourth-party access, zero trust, and contracts are now defining systemic cyber risk for boards and insurers alike.

You'll learn:

1. Why “defensible truth” is the real product in high-stakes incident response
2. How forensic-science DFIR changes scoping, evidence preservation, and decision-making
3. Where AI speeds up investigations and where it creates blind spots for junior teams
4. Why timelines and logging shape what carriers, regulators, and boards believe happened
5. How vendor access and contracts drive third- and fourth-party cyber risk at scale

___________

Get in touch with Devon Ackerman on LinkedIn: https://www.linkedin.com/in/devonackerman/

___________

About the host Anthony Hess:
Anthony is passionate about cyber insurance. He is the CEO of Asceris, which supports clients to respond to cyber incidents quickly and effectively. Originally from the US, Anthony now lives in Europe with his wife and two children.

Get in touch with Anthony on LinkedIn: https://www.linkedin.com/in/anthonyhess/ or email: ahess@asceris.com.

___________

Thanks to our friends at SAWOO for producing this episode with us!