What Witness does
Witness brings enterprise and legal-grade methodology direct to consumers. Same court-admissible work the enterprise and law firms get from senior IR firms,Belkasoft, and Cellebrite-licensed shops. Quality, not budget. We are not competing with NordVPN, LifeLock, or basic antivirus tools. We are bringing enterprise-grade digital forensics into a tier consumers can actually pay for.
Coverage spans stalkerware detection on iPhone and Android, hacked-account forensic audit and recovery, romance scam attribution and documentation, identity theft forensic investigation, deleted-text recovery for divorce, OSINT exposure mapping, and domestic-violence digital forensics under a safety plan. Each engagement is structured to be evidentiary, not just felt.
Who runs the practice
The structure is the same as a law firm partner's practice or a surgeon's practice: the principal sets the methodology and reviews every case; the senior practitioner team, led by the technical consultant, executes the work under that methodology. Quinnlan Varcoe is Founder and CEO. She owns case judgment and reviews every engagement. Alex Riffenburgh, Co-Founder & CTO, oversees the practitioner team executing the technical work.
Three tiers, one methodology
The funnel is simple. Start free. Subscribe when you need ongoing coverage. Engage the practice when you have a real case that requires expert work.
- Free Cyber Triage. $0. Download from getwitness.ai/witness, run on your situation, get a written AI diagnosis. Lead-gen. No subscription required. This is how most people meet Witness.
- Witness subscription. $995 per month. Free trial converts. Ongoing AI-augmented monitoring, diagnostic re-runs, and priority response. Built for users who need continuous coverage at the methodology level enterprise IR firms use with Fortune 50 clients.
- Forensic case engagement. $5,000 to $15,000, average $7,500. Court-grade investigation delivered by the practice at $550 per hour when triage or subscription identifies a real case requiring expert work. Sworn-declaration ready, attorney-coordinated, principal-reviewed.
Why $995 per month for the subscription
Premium positioning is deliberate. The subscription funds the practice time required to keep methodology current with the threat landscape, filters tire-kickers, and is comparable to enterprise retainer pricing per device covered. The methodology is the same one the enterprise gets from senior IR firms for $50,000 to $500,000 minimums. If you only need a one-time look at a specific incident, run the free triage and stop there. If you need continuous coverage, the subscription is built for you.
What we will not do
- Publish a finding Quinn has not reviewed.
- Promise outcomes we cannot prove.
- Run a single automated scan and call it forensics.
- Take cases where simpler steps (police report, IC3 filing, platform-native recovery) would resolve the situation. We will tell you and decline.
- Bill for work that was not scoped and approved in writing.
How it works
- Confidential consultation. NDA-protected. 30 to 60 minutes. Direct conversation with Quinn. No sales process.
- Scoped engagement. Written proposal with defined deliverables, pricing, and timeline. Triage, subscription, or forensic case engagement depending on what fits.
- Investigation, review, and findings. The agent runs the procedural forensic work. Quinn reviews every output. You receive a written report you can act on, structured for police, court, counsel, or your own decision-making.
What separates Witness from antivirus and identity-protection apps
Antivirus scans for known malware signatures. Identity-protection monitors public breach databases. Neither one investigates a specific incident on your devices or accounts. Neither one produces a court-admissible report. Neither one is reviewed by a certified forensic practitioner. Witness is forensic methodology, not signature matching. The comp set is enterprise IR firms and Cellebrite-licensed shops, not NordVPN or LifeLock.
Why enterprise and legal-grade methodology matters
Enterprise IR firms and Cellebrite-licensed shops charge $50,000 to $500,000 for enterprise incident response and $5,000 to $15,000 per consumer case. That quality of work was previously out of reach for individuals. Witness keeps the methodological rigor and brings it inside a tier a consumer can actually pay for, because the agent absorbs the procedural analyst time. Quinn still owns case judgment.
How Witness handles each of the consumer practices
- Stalkerware and spyware detection
Witness runs the iOS configuration-profile audit, MDM enrollment check, jailbreak detection, package-list reconciliation on Android, and known-stalkerware database matching. Quinn reviews findings before any removal step is recommended.
- Hacked-account forensic audit and recovery
Witness reconstructs login timelines, device-list audits, and access logs across email, social, banking, and cloud accounts. Recovery actions are sequenced so the attacker loses access before they can retaliate.
- Romance scam and catfish attribution
Witness traces account-creation patterns, image-reuse detection, and money-flow documentation. The deliverable is a written record structured for police, IC3, and counsel.
- Identity theft forensic investigation
Witness investigates how the exposure happened, surfaces ongoing access points, and documents evidence usable by police, banks, and counsel. Same-week response on active cases.
- Deleted-text recovery for divorce
Witness assists with court-admissible phone extraction. Deleted texts, hidden apps, photos, and chat history are preserved with documented chain of custody under principal review.
- Divorce and family-law digital forensics
Witness covers the broader forensic record across devices and accounts. Findings are structured for family court and coordinated with your attorney under privilege.
- OSINT exposure mapping
Witness maps your digital footprint, identifies who someone really is, traces anonymous harassers, and documents what is publicly available about you. Court-ready evidence collection.
- Domestic-violence digital forensics
Witness operates under a safety plan. Examination of cloned device images when alerting the abuser is a risk. Reporting structured for protective orders and shared with advocate or attorney as you direct.
- Privacy and exposure reduction
Witness assists with data-broker removal, account-hardening, and ongoing monitoring. Built for individuals and families who want a smaller digital footprint.
Why this work matters
Targeting AI digital forensics. Quinn holds 15 active certifications across GIAC, AWS, Splunk, CompTIA. Methodology trusted by Fortune 50 enterprises, defense contractors, and the attorneys who refer to us. The agent extends that methodology to people who could not previously afford it.
