A cybersecurity firm built for accountable reviews.
Independent audits, testing and third-party reviews for large organizations. Based in Canada. Work delivered internationally.
Forensic Five reviews systems that other people have to rely on.
We are a cybersecurity firm. Clients engage us when they need an independent opinion on technology, security or the AI now attached to both — and a written record that counsel, insurers, boards or a counterparty can read without translation.
The firm is small on purpose. Work is not handed to an anonymous queue. A named analyst is accountable for the findings. Scope and fee are written before anything runs. If we are not the right firm for the work, we say so.
We do not require you to purchase hosting, tools, cameras or a monthly retainer to receive the report. Affiliated companies, if any, are not a condition of the engagement.
What we are
A cybersecurity practice
Audits, authorized testing, security reporting and third-party reviews. The same standards whether the target is a public website, an internal application, a vendor stack or a model with real permissions.
Who we serve
Large organizations
Companies, professional firms and operators that already have counsel, insurers or counterparties asking for evidence. We also work with teams that cannot staff a full-time security function and still need a defensible answer.
How far
International clients
Headquartered in St. Albert, Alberta. Engagements have been delivered across North and South America, and as far as Ireland, Singapore and the Cayman Islands.
Clients internationally, one standard of work.
A number of our clients sit outside Canada. The engagement model does not change with the time zone. Targets are named in writing. Findings are written to the same standard. Remote review is the default; on-site work is scoped when the property, the hosting or the evidence requires it.
North America
Canada and the United States. Headquarters and the majority of written reporting sit here.
South America
Reviews for organizations and vendors operating in the region, under the same authorization rules.
Ireland
Work for European-facing operations that need an independent technical opinion, not a local sales office.
Singapore & Cayman Islands
Engagements as far as Singapore and the Cayman Islands — typically vendor, hosting or due-diligence reviews.
Five practice areas, used as the brief requires.
Most clients begin with an introductory meeting, then an audit. Testing, reporting or an enterprise review is added when the findings or the counterparty require it. Each can be engaged on its own.
Audits
Independent assessment of the technology environment, including AI systems connected to it. Automated analysis, analyst validated, written up with coverage and limits.
Reporting
Findings, policies and briefing materials prepared for operators, counsel, insurers and directors. Method and limitations stated plainly.
Testing
Authorized attack simulation against only the systems you name — web, server, application and, where scoped, AI agents. Retesting on request.
Enterprise
Third-party reviews for large organizations: vendors, hosting, cloud architecture and due diligence ahead of acquisition or renewal.
Context
Security practices for teams that train, tune and supply data to large language models — retrieval, memory, credentials and staff briefing included.
The same terms, wherever the client sits.
An introductory meeting comes first. We discuss the project and your concerns — what is in scope, what is not, and whether a written engagement is warranted. There is no fee for that conversation, and no work begins afterward unless you approve it.
Typical cyber work is a scoped review of a website, application or server; a written report with prioritized findings; and a review call. Site security is a property walk. Backup work is recoverability: what is copied, who can wipe it, and the last proven restore.
International work is usually remote: access, logs and interviews by appointment. Where a walk of a site or a hosting facility is required, that is written into the scope before travel is arranged.
Engagement standards
- Written scope and fixed fee before work begins
- A named analyst accountable for the findings
- Confidential reporting; your NDA executed on request
- Method, coverage and limitations stated in every report
- Client material is never used to train or tune a model
Confidentiality
Findings, scores and client names are not used in marketing. We will execute your NDA before access is granted or testing begins.
Independence
Recommendations are not tied to a product we sell. If a control is good enough, we say so. If we did not test something, the report says that too.
Authorization
We only test systems you own or are authorized to have tested. Rules of engagement are written down. Production impact is agreed in advance.
Prior work that shows up in the report.
We do not publish a client list. The work itself has included finance, government and aerospace environments with formal control requirements, and commercial operators that needed an outside opinion for counsel, an insurer or a counterparty.
That experience shows up in how reports are written: evidence, priority, and a clear statement of what was out of scope. You will know who is on the engagement.
Mathew Potter
Founder · Security Analyst
Mathew leads Forensic Five assessments and consulting. His background is Linux systems, networks and application infrastructure — the stack most client websites and internal tools actually run on.
Prior work includes environments with formal control requirements in finance, government and aerospace. He is the named analyst on most paid engagements and the person who reviews findings before they leave the firm.
Thomas Bereckzy
Systems & Security Engineer
Thomas focuses on system design and the security of applications that handle financial or otherwise sensitive transactions. He reviews architecture and implementation, not only scanner output.
He is brought in when an assessment needs a second technical reader: scaling, identity, or how a system will behave once it is in production.
Set up one introductory meeting
We will discuss the project and your concerns, then tell you whether an audit, a test, a third-party review or a short consult is the right first step — including when we are not the right firm.