Why is a retained DFIR firm hired through outside counsel, and what changes in how you write findings?

## The report is the most dangerous document in the incident When an intrusion is declared, the artefact that most often surfaces years later is not a log file. It is the written analysis: a narrative saying an adversary was inside from this date, reached these systems, and got in through a control that should have stopped them. That document is invaluable for fixing the organisation and awkward for defending it. The engagement structure is the mechanism organisations use to manage that tension. ### What engaging through counsel actually does Legal systems protect two related things: confidential communications between a client and its lawyers seeking or giving legal advice, and material prepared in anticipation of litigation or to support that advice. The names differ by jurisdiction, US attorney-client privilege and work-product doctrine, legal advice privilege and litigation privilege in England and Wales, and the strength varies widely, but the structural logic is the same. If outside counsel engages the forensic firm and directs its work so counsel can advise the organisation, the firm's analysis is more plausibly part of that advice-giving. If the security team signs the statement of work under a pre-existing operational retainer and the firm reports into the security organisation, the same analysis looks like routine business. ### It is a structure, not a magic word This is the part candidates get wrong. Two failures recur: 1. **Labelling as a substitute for substance.** Typing *privileged and confidential* on an email does not make it so. What the courts look at is who directed the work, why it was done, who received it and whether an equivalent report would have been produced anyway. Where the work matched a firm's existing incident-response retainer, its scope and its ordinary distribution, US courts have ordered production despite counsel being nominally involved. 2. **Believing facts become secret.** Protection can cover advice and the work product created to support it. It never covers the underlying facts or the evidence. The Windows event logs, the SaaS audit trail, the disk image, the alert that fired, the dates the adversary was present: all of that is what happened, and what happened is discoverable. You cannot make a log privileged by emailing it to a lawyer, and you should never tell an engineer you can. ### Waiver Protection can be lost by sharing. Circulating the report to an auditor, a customer, an insurer's non-legal staff or a wide internal distribution list can waive it in whole or in part. This is why counsel usually controls the report's distribution and why a technical summary intended for engineers to act on is often written as a separate, deliberately factual document. ### What it changes for you day to day - **Write facts, not verdicts.** *At 02:14 UTC the HR platform's audit trail records 4,102 employee records exported by account j.doe from IP x* is a fact. *We clearly should have had alerting on bulk export* is an opinion about fault; it belongs in a remediation discussion counsel is part of, not in the case notes. - **Do not editorialise about blame or legal conclusions.** Whether this constitutes a reportable breach is a legal determination. Writing *this is a breach* in an incident ticket pre-empts counsel and can be quoted back at the organisation. - **Keep to the channel you were told to use.** Cross-posting the analysis into a wide chat channel expands the circle and risks waiver. - **Mark and route as instructed.** If counsel asks for a marking or wants the report addressed to them, do it, and understand it is the direction of the work, not the marking, that carries the weight. - **Do not let it slow remediation.** Facts and fixes flow normally. Engineers still get told which patch to apply and which credential to rotate. If a privilege posture is stopping defenders from defending, the posture is being applied wrongly. ### Where the boundary sits Counsel owning the legal posture does not make counsel the investigator. The security team still decides what to collect, in what order, and what the artefacts support. What changes is the audience of the written product and the discipline of its language. A candidate who can say *facts and evidence are never protected, the analysis and advice may be, and the structure has to be real* has the whole thing.