ANALYST · DOSSIER
Aoife McDermott
Senior Analyst · Incident Forensics
Eight years on incident response teams at three Fortune 100 firms. Built and led the forensic methodology toolkit used internally. The analyst clients ask for when the breach is already in the news.
- Mandiant · Principal IR
- Fortune 100 · IR Team Lead
Aoife McDermott has spent eight years on incident response teams at three of the largest Fortune 100 companies. She was the analyst called when the breach was already in the news and the question was no longer whether to respond but how quickly and how credibly.
She built and led the forensic methodology toolkit used internally at two of those organizations, a toolkit whose core principles were later published in a 2025 DFRWS conference paper that has since become standard reading in incident response training programs. The paper introduced what she called the "72-Hour Triage Standard," a structured framework for the first three days of a public incident.
At SCRYER, Aoife leads the Incident Forensics practice. She is the analyst clients ask for when the stakes are highest. Her manner in a crisis is notable for its precision and its absence of panic, a quality that, in the circumstances she typically operates in, is genuinely rare.
“The 72-hour window after a breach is everything. What you do in that window determines whether you contain it or explain it on television.”
RECENT BRIEFINGS
Selected work by this analyst.
OTHER ANALYSTS
