What Dfirlabs does

DFIRLABS (Pty) Ltd is a South Africa-based, privately held professional services firm providing independent digital forensics and incident response (DFIR) expertise to legal practitioners, law firms, and organizations experiencing cyber incidents. Founded in 2014 by Jason Jordaan — a former Head of the Cyber Forensic Laboratory at the Special Investigating Unit — the firm operates from Johannesburg and serves both domestic South African clients and selected international engagements. Co-director Veronica Schmitt, formerly in charge of the Free State Cyber Forensic Laboratory at the SIU, complements the leadership team alongside analyst Saskia Kuschke, with the practice sized at 1–10 employees (four team members as of mid-2017). The firm is bootstrapped and founder-owned, with no disclosed external investment.

The firm's offering spans four productized service lines: Digital Forensics (evidence identification, forensic imaging, examination, analysis, and expert witness testimony for criminal, civil, and administrative proceedings), Incident Response (preparation, detection, containment, eradication, recovery, and post-incident reporting for security breaches and cyber attacks), Electronic Discovery (collection, processing, review, and production of electronically stored information following the EDRM), and Cyber Security Assessments (vulnerability and posture evaluation). Its underlying technology stack is methodology-led rather than tool-led, built around compliance with ISO/IEC 27037, 27041, 27042, and 27043 and SWGDE standards, bit-stream forensic imaging (e.g., .E01), and cryptographic hash verification (MD5, SHA1). Revenue is generated entirely on a per-engagement professional services basis, with quote-based pricing, direct client engagement via website and email, and no productized software offering.

Name

Dfirlabs

Legal name

DFIRLABS (Pty) Ltd

Website

https://dfirlabs.com

Company type

Private

Founded year

2014

Operating status

Operating

Headcount range

1–10 employees

Short description

DFIRLABS is a South Africa-based, founder-owned professional services firm providing digital forensics, incident response, e-discovery, and cyber security assessment services to legal practitioners and organizations facing cyber incidents.

Ownership category

akta.pro rank

Product category

Digital Forensics Services

NAICS

Testing Laboratories and Services (54138), Testing Laboratories and Services (541380)

SIC

Services-Testing Laboratories (8734)

akta.pro primary industry

Endpoint Forensics & Incident Response (DFIR) (HDADAEAJ)

Keywords

• Digital forensics
• Incident response
• Electronic discovery
• Cyber security assessments
• Expert witness testimony

Headquarters

HQ city

Johannesburg

HQ country

South Africa

HQ region

Africa

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales

Revenue model

1. Digital Forensics Services: Professional services revenue generated from digital and multimedia forensic examination, evidence analysis, and expert witness testimony for legal proceedings in criminal courts, civil courts, and administrative hearings. Services include forensic imaging, examination, analysis, reporting, and court testimony.
2. Incident Response Services: Cybersecurity incident response services including preparation, detection, containment, eradication, recovery, and post-incident reporting. Evidence obtained is forensically sound for use in legal processes.
3. Electronic Discovery Services: E-discovery services for legal practitioners including identification, collection, processing, review, analysis, production, and presentation of electronically stored information for litigation support.
4. Cyber Security Assessments: Security assessment services to help organizations identify vulnerabilities and improve security posture.

Go-to-market motion1 record

Distribution channels1 record

Marketing channels4 records

Core offering

DFIRLABS is an independent professional services firm that identifies, preserves, examines, and analyses digital evidence for use in legal proceedings and cybersecurity investigations. The firm offers four core service lines: Digital Forensics (evidence identification, forensic imaging, examination, analysis, reporting, and expert witness testimony), Incident Response (preparation, detection, containment, eradication, recovery, and post-incident activity), Electronic Discovery (full Electronic Discovery Reference Model execution), and Cyber Security Assessments, all conducted under ISO/IEC 27037, 27041, 27042, 27043 and SWGDE standards.

Product overview

DFIRLABS is an independent Digital Forensics and Incident Response professional services firm based in South Africa. The company operates as a single unified offering combining four core service lines: Digital Forensics (covering identification, examination, analysis, and expert testimony for legal matters), Incident Response (covering preparation, detection, containment, and recovery from security incidents), Electronic Discovery (following the Electronic Discovery Reference Model for legal proceedings), and Cyber Security Assessments. The company also contributes to the discipline through research and publications, positioning itself as both consumers and creators of knowledge in the field.

Differentiator

Problem solved

Functional benefit

Products and services

• Digital Forensics An established forensic science discipline dealing with the identification, examination and analysis of digital evidence to prove or disprove matters for legal purposes. Services include evidence identification, legal authorisation, preservation, acquisition, forensic examination, analysis, reporting, and expert witness testimony, delivered for legal practitioners and law firms.
• Incident Response An organised approach to addressing and managing information security breaches or attacks, including preparation, detection, collection, analysis, containment, eradication, recovery, and post-incident reporting to identify weaknesses and mitigate future risks. Targeted at organisations experiencing security breaches, data compromises, or cyber attacks.
• Electronic Discovery The electronic aspect of identifying, collecting and producing electronically stored information (ESI) in response to legal requests. Follows the Electronic Discovery Reference Model covering information governance, identification, preservation, collection, processing, review, analysis, production, and presentation for legal practices involved in civil litigation or administrative proceedings.
• Cyber Security Assessments Cybersecurity assessment services to evaluate organisational security posture and identify vulnerabilities, helping organisations improve their security posture.

Quantifiable outcome

• Forensically sound evidence acceptable in South African High Court and lower courts
• +1 more outcomes

Segments3 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature3 records

Scale indicators2 records

Recent moves5 records

Expansion highlights4 records

Broad incumbents

• NCC Group: Global cyber security and incident response firm with significant DFIR practice. Comparable forensic and breach response capabilities but as part of a much broader cybersecurity portfolio.
• Stroz Friedberg (Aon Cyber Solutions): Specializes in digital forensics, incident response, and expert testimony for litigation. Most closely mirrors DFIRLABS' court-admissible forensics positioning but with a much larger US/international footprint.
• CrowdStrike Services: Provides incident response, forensic analysis, and threat hunting services alongside its endpoint security platform. Overlaps with DFIRLABS' incident response practice but at a much larger scale with proprietary tooling.
• Mandiant: Global leader in incident response and threat intelligence, now part of Google Cloud. Direct overlap with DFIRLABS' incident response offering but at vastly larger scale, with 24/7 SOC and global retainer capabilities.
• Kroll Cyber Risk: Provides digital forensics, incident response, and expert witness services globally. Comparable services across forensic imaging, e-discovery, and litigation support, but operating at a much larger enterprise scale.
• Unit 42 (Palo Alto Networks): Threat intelligence and incident response arm of Palo Alto Networks. Overlaps with DFIRLABS' IR and forensic services with global reach and proprietary threat intelligence feeds.

Regional players

• SensePost (Orange Cyberdefense): South African-origin cybersecurity firm now part of Orange Cyberdefense, with historical roots in penetration testing and security research. Adjacent to DFIRLABS' cyber assessment services and shares South African origin.

Emerging players

• Tetra Defense (Arctic Wolf): DFIR boutique acquired by Arctic Wolf, focused on incident response and digital forensics for mid-market enterprises. Comparable specialization at a slightly larger scale before acquisition.

Direct peers

• Cyanre: South African digital forensics and incident response firm offering similar computer, mobile, and network forensic services. Direct domestic competitor with comparable target market of legal and corporate clients in South Africa.
• Kivu Consulting: US-based DFIR boutique specializing in ransomware response and forensic investigations. Comparable mid-sized professional services firm with similar technical forensic focus and expert witness offerings.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat3 records

Key risks5 records

Key highlights5 records

Customer concentration

• Xx.com/dfirlabs
• Facebookfacebook.com/dfirlabs

Compliance4 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Dfirlabs