About

Built by the people
who kept arriving too late.

Excavate runs insider threat investigations as a service. We preserve the evidence, examine what happens, and deliver signed conclusions an organization can act on.

Why this
company exists.

A career of being called in after the fact, and finding the answer had already been thrown away.

The founders are practitioners: red teaming, incident response, digital forensics and intelligence, on consulting engagements that ran across many countries and more than one continent.

Nearly all of that work started the same way. Something had already happened. We were called in afterward and asked to reconstruct it from whatever evidence had survived.

Usually not enough of it had. The laptop was wiped, the logs had rolled, the account was gone. The answer existed for a while and then it did not, and nobody noticed until the moment it was needed.

That is the whole reason this company exists. Excavate keeps a tamper-evident record that stays until you choose to delete it, so the question can still be answered when it finally gets asked.

DisciplinesRed teaming, incident response, digital forensics, intelligence

FoundersTechnical, still hands on the evidence

ReachEngagements across many countries and continents

Before ExcavateConsulting for enterprises and law firms

What we decided,
and why.

Four decisions that shape everything else, each one taken because of a case that went badly for want of it.

Preservation beats reconstruction

Every hard case we ever worked had the same root problem: the evidence that would have answered the question was gone before anyone asked it. Coverage exists so the record is already there before it is needed.

The work should be ours

Insider risk products are sold to teams that already have analysts to run them. Most companies do not, and never will. We deliver the outcome instead of the software.

Defensible or it does not count

A conclusion that cannot be shown to counsel, a works council or a court is not a conclusion. Everything we produce carries its cause, its evidence and its chain of custody.

Open to scrutiny

Everyone is covered equally, the same rules apply to everyone, and every access to the record is logged. We support your proportionality assessment and DPIA, and give counsel and your works council the documentation in full.