agency: The "Breach Bunker"

Portable, Sovereign Forensics for Incident Response and Compromise Assessment

Date: December 2025 Prepared For: IR Practice Leaders, CISOs, and Breach Counsel

1. Executive Summary

When a sophisticated adversary breaches a network, the Incident Response (IR) team faces a paradox: The "Toxic Data" Dilemma.

To determine the blast radius—specifically, *what* intellectual property or PII/PHI was exfiltrated—analysts must index and search terabytes of unstructured data (File Shares, Email PSTs, SharePoint). However, the client's network is compromised ("Dirty"), and uploading this sensitive evidence to a cloud-based review platform creates unacceptable liability and Chain of Custody risks.

Current tools (Nuix, Magnet) are powerful but heavy, expensive, and lack the semantic reasoning required to connect the dots quickly.

Agency introduces The Breach Bunker.

Agency is a Zero-Knowledge Knowledge Base designed for rapid deployment on "Fly Away Kits" (high-performance field laptops/servers). It ingests, graphs, and analyzes compromised data locally, allowing IR teams to map lateral movement, identify exfiltrated assets, and scope regulatory notification obligations—all without the evidence ever leaving the secure forensic workstation.

2. The 2025 Industry Challenge

2.1 The "Dirty Network" & Cloud Risk

You cannot trust the client's infrastructure.

• The Risk: The attacker may still be persistent. Uploading evidence to the cloud (e.g., an S3 bucket or SaaS Review Platform) while on a compromised network invites interception.
• The Liability: IR firms are hesitant to host client PII/PHI on their own cloud tenants due to GDPR/CCPA data processor liabilities. They want to analyze the data *where it sits*, or on an air-gapped device.

2.2 The Unstructured Blind Spot

SIEMs (Splunk, Sentinel) and EDRs (CrowdStrike) are excellent at tracking Logs and Processes. They are terrible at tracking Content.

• The Gap: The EDR says: *"User X copied Project_Falcon.zip to a USB drive."*
• The Unanswered Question: *"What was inside Project_Falcon.zip? Was it the cafeteria menu, or the source code?"* Answering this requires indexing and searching the *content* of that zip file immediately.

2.3 The Speed of Ransomware

Ransomware groups now double-extort. They don't just lock data; they threaten to leak it.

• The Clock: Counsel has 72 hours (under GDPR/NYDFS) to determine if PII was accessed. Legacy indexing takes days. Agency takes hours.

3. The Agency Solution: Rapid, Portable Forensics

Agency brings the "Lab" to the "Crime Scene."

3.1 The "Fly Away Kit" Deployment

Agency runs natively on high-performance hardware (e.g., Incident Response laptops with NVIDIA GPUs).

• Ingest: Connect to the compromised file share or mount the forensic image (E01). Agency ingests PSTs, PDFs, Office Docs, and Slack exports at high speed.
• Analyze: The analyst works on the air-gapped machine. No data goes to the cloud.
• Graph: Agency automatically builds a Knowledge Graph, connecting Users, Files, and Entities.

3.2 Visual Architecture (C4 Model)

This diagram illustrates the Air-Gapped / Read-Only nature of the deployment.

4. Operational Capabilities: The "Kill Shot"

4.1 Graphing Lateral Movement

Attackers leave trails across different data silos.

• The Agency Play: Ingest the AD exports, File Server logs, and key Email boxes.
• The Graph Query: *"Show me all paths between 'Compromised_User_A' and files tagged as 'Confidential' or 'Source Code'."*
• Result: Agency visualizes the path: *User A* -> *accessed Admin Share* -> *opened 'Pass_List.xlsx'* -> *accessed 'Source_Code_Repo'.*

4.2 Automated PII Scoping (The "Notification List")

• The Scenario: A folder named "HR_Backup" was exfiltrated.
• The Agency Play: Ingest the folder. Agency's NER (Named Entity Recognition) automatically identifies SSNs, Credit Card Numbers, and Driver's Licenses.
• The Output: A "Hit Report" for Breach Counsel. *"The exfiltrated folder contains 452 unique SSNs. Here is the CSV list for notification."*
• Value: Prevents over-notification (saving millions in credit monitoring fees) and under-notification (avoiding fines).

4.3 Semantic Timeline Reconstruction

• The Scenario: You have thousands of emails from the week of the breach.
• The Agency Play: Use RAG Chat. *"Construct a timeline of all communications regarding 'System Updates' or 'Password Resets' between IT Admin and User X from Feb 12-14."*
• Result: Agency reconstructs the social engineering attack timeline instantly.

5. Economic Impact & ROI

In IR, time is money, and accuracy is survival.

Scenario: Ransomware attack on a mid-sized healthcare provider.

6. Security & Forensics Standards

6.1 Zero-Knowledge Chain of Custody

Agency maintains a cryptographically signed audit log of every action taken by the analyst.

• Defensibility: If opposing counsel asks, *"How did you determine these files were relevant?"*, the analyst produces the signed log showing the exact search terms and graph queries used.

6.2 Write-Blocking Compatibility

Agency is designed to respect "Read-Only" mounts. It does not attempt to modify metadata, write temp files, or alter the "Last Accessed" timestamps of the source evidence, preserving the integrity of the crime scene.

Find about more by visiting the Security Deep-dive document.

7. Comparative Landscape

Strategic Fit: Agency does not replace EDR (CrowdStrike). It replaces the painful manual review of the *files* that the EDR told you were stolen.

8. Conclusion

When the "Red Phone" rings, IR teams need tools that are fast, fearless, and forensic.

Agency provides the Breach Bunker: a sovereign, AI-powered analysis environment that can be dropped into the dirtiest networks to find the truth fast. It protects the client's data, the IR firm's liability, and the integrity of the investigation.

Agency: The first responder for unstructured data.