Insider threat
investigations, as a service.
We keep the forensic record before anything happens. When someone leaves with data, the evidence is already preserved, and an examiner writes the answer instead of queuing it for you.
Or explore the live portal first, no login needed →In the two weeks before his last day, Daniel Brooks staged and removed company data through three channels: a USB device, a personal Gmail account, and a full Salesforce export. The USB copy and the deleted staging archive were recovered from his laptop, which IT held and collected on his last day. Examiner-signed, with the complete file inventory as an appendix.
An alert is not
an answer.
Data leaves with the people who leave, and it often starts before anyone hands in a notice. Your tools raise flags. A flag is not an answer, and turning one into a conclusion takes time nobody has.
Data exfiltration runs 720% above normal in the 24 hours before a layoff. And when you try to look, the evidence is often already gone.
Proofpoint, Voice of the CISO 2026 · Cyberhaven, Insider Risk Report Q1 2024Investigating one person means reconstructing months of activity across many systems that do not communicate with each other.
Prophet Security, AI SOC survey 2026 · 250 security leaderssign-ins goneday 67
contained
By then the sign-in logs have rolled, the mailbox may be purged and the laptop wiped and reissued. Insider risk costs the organizations studied $19.5M a year on average.
Ponemon Institute for DTEX, 2026 · Microsoft Entra log retentionExcavate is forensics as infrastructure.
Always on, already preserved, already examined. The forensic record is running before the question exists, and it stays until you choose to delete it, ready for the day you need it.
We keep the record.
We do the investigating.
Read-only into the systems your people already work in. Every event preserved continuously, every detection read against the whole record, and every trigger worked by our AI agent and our examiners together, not by you.
See the portal →
Every offboarding ends
in a written conclusion.
Data often moves before anyone resigns. By the time HR tells you, the activity that matters may be weeks old, so the review runs against the record you already hold, and it opens by itself.
How offboarding runs →
The resignation lands in your HR system and the review starts. The one thing we ask: IT holds the laptop until it closes.
Watching, reviewing, done. It runs during the offboarding process and ends in writing.
Every departure gets a dedicated review. When an examiner finds something suspicious, it becomes a full forensic case, and your IT collects the laptop with our tool.
Every case ends
in writing.
Every trigger opens a review. Our AI agent works it and recommends, a person decides, and each one closes with a written cause on your record. Only an examiner can escalate. When something turns out to be real it becomes a forensic investigation, which is the only thing that ends in a report like this.
Nothing arrives as a question for you to work.
Covered in days.
Nothing to install, no schema to design, no queue to staff. The connections are read-only and the record starts filling the same afternoon.
Thirty minutes. We scope which systems you run, and what you are worried about.
Read-only, nothing deployed. First events inside the hour, backfill running behind them.
We read whatever history your sources still keep and tell you what was already in it, and anything worth a closer look.
You are covered from the moment you connect, and your week-one baseline report shows what was already in your history.
Priced per person.
One subscription covers the whole organization. Your number comes on the first call.
See it for yourself.
Open the portal. Read the record. Inspect the departures. Ask it a question.
thirty minutes · we will tell you what coverage would have shown