Information is leaving. Find out how.

// 01

Eliminate the technical explanation first

Most internal leak investigations begin by looking at people. Access logs, email, who was in the room, who had motive. That is reasonable, and it is often where the answer is. But it is slow, corrosive to trust, and if the actual cause is a device in the ceiling, it never finds it.

A sweep is fast and definitive in one direction. If we find a device, the investigation changes completely and you have physical evidence. If we find nothing, you have excluded an entire category of explanation and can focus entirely on people and process, knowing the rooms are clean.

// 02

Scoping a leak sweep properly

The common mistake is sweeping the wrong rooms. People assume the boardroom, when the information was actually discussed in a manager's office, a car on the way to a site, or a meeting room nobody thinks of as sensitive.

We scope from the information itself. What exactly got out, where was it discussed, who was present, and over what period. That maps to a set of physical spaces, vehicles and devices, and those are what we sweep. It is a different and usually wider footprint than the assumed one.

// 03

Keeping the investigation confidential

If a leak investigation becomes known internally, the behaviour you are trying to observe changes immediately. Our attendance is planned so it does not signal anything: after hours where possible, unmarked, and presented as routine facilities or AV work if anyone asks.

Reporting goes only to the individuals you nominate. We do not copy in general security or facilities distribution lists, and we do not retain investigation detail beyond the engagement.

// FAQ

Common questions