FEDERICA BERTONIAI Risk · Cyber Intelligence · Digital Evidence Review

From threat to decision

Strategic Cyber Threat Intelligence, cyber geopolitics, and AI Risk for boards and organizations making decisions in complex, dynamic, and highly uncertain environments.

Explore our services
COMMISSIONED WORK

Analysis, scenarios, and reviews for complex decisions.

Decision briefs, crisis scenarios, and independent assessments.
Each engagement defines who will use the analysis, which decision it must support, and which materials will be available. It may address a specific need or include periodic updates.
Request a consultation

Strategic Cyber Threat Intelligence and Cyber Geopolitics

Engagements connect threat actors, geopolitical context, and the organization’s dependencies.

Decision Integrity and AI Risk complement the analysis by examining the information underpinning decisions and the limits of automation.

Assess the foundations of a decision

This review is useful when a consequential decision depends on information that is incomplete, contradictory, or not yet verified. It examines sources, assumptions, and alternatives before the decision, or reconstructs afterward the information available at the time.
Deliverables:
  • Information matrix: verified facts, sources, assumptions, gaps, and confidence levels for the assessments.
  • Options matrix: plausible consequences, constraints, and conditions that require the decision to be reconsidered.
  • Decision memo: priority checks, open questions, and a framework for documenting the rationale for the decision and the information considered.

Prepare the board to decide under uncertainty

The board needs to prepare for a crisis in which the information picture changes and the time available to decide shrinks. The practice designs the analytical component of cyber, geopolitical, and AI exercises, starting with the organization’s exposures.
Deliverables:
  • Scenario dossier: context, dependencies, exercise objectives, and decision points.
  • Sequence of updates: new events, conflicting information, and prompts that require assessment or escalation.
  • Observation and debriefing materials: observation criteria, a decision log template, and questions for the final review.
The engagement covers scenarios and analytical materials, including for exercises on the client’s platforms. Facilitation is defined within the project; observation and debriefing of the session are included only if agreed. Software development and technical management of the platform are excluded.

Understand which threats change priorities

The engagement assesses how geopolitical developments or cyber campaigns affect the organization’s exposure in a country, sector, or supply chain. The analysis identifies the implications relevant to the client, distinguishing observed signals from plausible scenarios.
Deliverables:
  • Executive brief: exposures, scenarios, and implications for the organization’s priorities.
  • GeoCyber dossier: relevant threat actors, campaigns, and dependencies, with sources and attribution limitations.
  • Warning framework: indicators to monitor and conditions for updating assessments.
The engagement may include cyber and AI contributions to geopolitical reports and commissioned interdisciplinary research.

Examine delegated authority, not just outputs

This service addresses AI agents authorized to access data, use tools, or take action within business processes. The assessment uses documentation and scenarios to examine delegated authority, documented controls, and the conditions for human intervention.
Deliverables:
  • Map of delegated authority: authorizations, dependencies, approval steps, and responsibilities.
  • Risk scenarios: errors, information manipulation, and actions inconsistent with the mandate.
  • Priority controls memo: operating limits, required records, stop criteria, and escalation.
Any technical verification of systems must be agreed separately.
SECOND SPECIALIST AREA

Digital evidence strategy

Does a law firm or business need to understand which examinations to request, whether the available materials are sufficient, or what supports a technical conclusion?

Drawing on its principal’s more than twenty years of experience, the practice may accept engagements, solely as a secondary and supporting activity, to guide examinations and critically review evidence, without conflating the existence of a data item with what it can establish.
Careful examination of documents and devices for digital evidence assessment.
Documents, notes, and an optical lens on a desk: evidence to verify before a decision.

(1)
Case framing and technical questions

Preliminary analysis of the case file and the available information to define the scope of the examination, formulate alternative hypotheses, and turn disputed issues into verifiable technical questions, distinguishing observable facts, inferences, assumptions, and actual limits to knowledge.
An analytical workflow organized around sources, hypotheses, and synthesis documents.

(2)
Evidence plan

A structured mapping of relevant digital sources to identify available, missing, or perishable evidence, establish preservation and acquisition priorities, and define the checks needed on provenance, integrity, completeness, temporal correlations, and continuity of the information trail.
Research materials undergoing comparison and methodological verification.

 (3)
Critical review

Methodological review of reports by court-appointed technical consultants (CTU) and party-appointed technical consultants (CTP), expert reports, formal records, forensic tool reports, and other digital artifacts to assess the soundness of the methodology, the traceability of inferences, consistency between data and conclusions, alternative hypotheses, analytical limitations, and the actual technical and evidentiary robustness of the findings.

You stay in control

Your preferences

The site does not include advertising, browsing analytics, or profiling. You can choose whether to remember your accessibility settings for subsequent pages and visits.

Technical functions

Always necessary

Once you make a choice, the browser stores it for 6 months so it can be respected without displaying the notice on every page. This record contains no personal identifiers and is not sent to the site.

Stores text size, contrast, link underlining, and reduced motion settings on your device. Settings are not sent to the Data Controller or to third parties. Without this option, you can adjust them on the current page.

These settings expire when your choice expires: no later than 6 months. If you reject or disable this option, saved settings are deleted; active settings remain available on the current page.

This choice does not authorize future tools or services. For full details, including any technical security tools used by the hosting provider, read the cookie and preferences policy.