GAVIN LUJAN BRIEF // 25 AUG 2026 // INCIDENT RESPONSE + DIGITAL FORENSICS
Black Diamond: Response Defined by the Objective
When the incident becomes consequential, activity is not the metric. Clarity is.
Black Diamond is a specialized noir incident-response and digital-forensics capability built around a simple operating principle: define the objective, establish authority, preserve evidence, determine what happened and convert findings into decisions.
The operating model
Traditional consulting can reward elapsed time. Black Diamond instead frames work around explicit objectives and completion criteria. An engagement might seek to determine whether privileged identity was compromised, establish the timeline of unauthorized access, preserve a defensible forensic image, validate eradication, or provide leadership with an evidence-backed incident picture.
Contain. Determine. Prove.
Response begins by protecting mission continuity and evidence. Investigation then reconstructs the event across endpoint, identity, cloud and network sources. Findings distinguish observed fact from analytic judgment and unresolved uncertainty. The final objective is not a dramatic report. It is a defensible path forward.
Human authority remains central
Automation and AI may accelerate correlation, search and analysis, but evidence handling, investigative judgment, material decisions and final conclusions remain accountable human responsibilities.
The Black Diamond sequence
OBJECTIVE → SCOPE → CONTAIN → INVESTIGATE → EVIDENCE → FINDINGS → HARDEN
Every engagement should begin with documented authorization and boundaries. For matters involving litigation, regulatory reporting, criminal investigation or formal e-discovery, evidence procedures should be coordinated with qualified counsel and appropriate authorities.