Scott Steinberg · Consultant, Analyst and Business Strategist
Forensic experts establish how an intrusion happened. What that leaves open is whether the organization maintained the security program its peers maintained, whether the tools it bought did what the vendor said, and how it behaved once it knew. A top cybersecurity expert witness, keynote speaker and consultant to 3000+ organizations, Scott Steinberg addresses these and myriad other topics.
Expert reports, declarations, deposition and trial testimony on IT, AI, data breaches, online privacy, hacks, security program practice, vendor and product claims, procurement diligence, third-party risk management, organizational conduct before and after an incident and more.
We cover everything from AI and automation to hacks, data breaches and digital or online privacy. Analysts also hit on forensic investigation, malware analysis, intrusion reconstruction and attribution, among other areas.
Where reasonableness is at issue, the question is what security programs comparable organizations in that sector and period actually maintained: staffing, controls, assessment cycles and governance.
Testimony establishes that benchmark and characterizes the organization's program against it, distinguishing what was documented from what operated.
Security products are sold with detection and protection claims that buyers rarely have the means to verify, and disputes examine what was represented and what the product delivered.
Testimony addresses what a buyer would reasonably have understood a claim to promise and what substantiation practice expected behind it.
Disputes examine what diligence preceded a security purchase or a decision to rely on a provider, and whether it was proportionate to the exposure being accepted.
Testimony addresses procurement practice for commitments of that scale and where the process departed from it.
Organizations inherit exposure through vendors, processors and software components, raising questions about what oversight practice expected and what was actually performed.
Testimony addresses third-party risk management convention and what the organization knew or should have asked about its supply chain.
Where an incident began with a person, questions concern what training existed, how realistic it was and whether the organization tested rather than assumed effectiveness.
Testimony addresses awareness program practice in the sector and how this one compared.
Response matters examine decision-making and communication during an incident: escalation, resource commitment, customer communication and how the organization characterized events as they developed.
Testimony addresses response conduct practice, distinct from the forensic question of what technically occurred.
Organizations make security commitments in contracts, trust pages, certifications and sales materials that customers rely on when deciding to share data.
Testimony addresses what those representations conveyed and whether practice matched what was claimed.
Security expectations have risen sharply and unevenly across sectors, so conduct has to be assessed against the standard applicable at the time rather than today's.
Testimony establishes that baseline from published frameworks, sector guidance and what comparable organizations maintained in the same window.
Program evidence sits across security, IT, procurement and executive functions rather than in one place, so scoping the document set is substantial early work. Any party may instruct.
Written opinions on areas like program adequacy against sector practice, vendor claim substantiation and conduct.
Testimony on topics such as what security programs comparable organizations maintained and what this one actually had.
Responsive analysis of reasonableness assertions and characterizations of industry security practice.
Non-testifying program assessment, vendor documentation review and discovery scoping.
Scott Steinberg is an analyst, consultant and business trends expert with over 25 years of experience providing management and strategic consulting services to more than 3,000 businesses and brands ranging from startups to government agencies and Fortune 500 firms.
He has testified in sample areas including intellectual property — copyrights, trademarks and patents — patent infringement, marketing, branding, video games, mobile applications, consumer product development, and the growth and monetization of online distribution platforms.
He is the author of over 30 books and has published more than five thousand articles addressing areas including but not limited to marketing, technology, leadership, innovation, advertising, digital transformation, data privacy and social networks. He appears regularly on ABC, CBS, CNN and NBC, and has led seminars and training programs for organizations including Wells Fargo, the PGA Tour, Century 21, Ford, Dell and Procter & Gamble.
His consulting work has been broadly recognized. He has served as a thought leader for the American Bar Association and Corporate Counsel magazine, and has received honors from the International Association for Scholastic Excellence, Fortune, and the 21st Century Icon Awards, among others.
No, and the boundary is deliberate. That's a distinct technical specialty requiring those credentials. But as cybersecurity expert witnesses, we pair with other experts who do.
Forensics establishes what happened technically. It does not establish whether the program was reasonable for that sector, whether procurement diligence was proportionate, whether the security product performed as sold, or whether representations to customers matched reality. Those are the questions that usually determine liability.
Some might do so by benchmarking against what comparable organizations in the same sector and period actually maintained: control adoption, staffing, assessment cadence, third-party oversight and governance. The critical distinction is between a program that existed on paper and one that demonstrably operated.
Because security expectations have risen sharply and unevenly. Controls that are baseline now were uncommon a few years earlier in many sectors, and judging historical conduct against current practice is the most frequent analytical error in these matters.
It also addresses the security program and vendor conduct generally. The data breach practice concentrates on incident response, notification and post-breach conduct specifically. Matters involving both a program adequacy question and a response question use each.
Initial conversations about scope, timing and conflicts are without charge. Helpful detail includes the organization sector, the program or vendor at issue and the period involved, plus any expert disclosure deadline already set.
A conflicts check is run before any substantive discussion. An initial note listing the party names and a one-line description of the dispute is enough to start; please hold privileged or confidential material until the check clears.