About SleuthX

The practice behind the agent

Quinnlan Varcoe is Founder and CEO. She holds a Bachelor of Science in cybersecurity from SANS Technology Institute and 9 active certifications across GIAC, including GCIH, GCIA, and GSEC. She designed the forensic methodology that the SleuthX agent encodes and trains on.

How the work splits

Quinn owns the product, the methodology and case judgment. She designed the forensic process the agent encodes. Alex brings the offensive-security discipline and takes investigations, field operations, and the agency build-out going forward.

Alex Riffenburgh is Co-Founder and OSCP-certified, with experience across red teaming, penetration testing, digital forensics, and AI security. She holds a Bachelor of Science in Computer Science from Western Governors University. Active CTF competitor, DEFCON and BSides regular, contributor to non-profit OSINT projects.

The agent (SleuthX) scales the procedural work that previously consumed senior-analyst hours, under the methodology Quinn designed.

Verifying the 9 active certifications

Quinn's credential mix is listed here so you can check it yourself. Every certification is active and verifiable directly with the issuing body. Lapsed certifications are not shown. The full registry is published in the certifications section below.

All 9 GIAC certifications are publicly verifiable in the GIAC Certified Professional directory (Analyst ID 201058).

How the report is built

Evidence is preserved using forensically sound acquisition methods. Chain of custody is documented. Methodology aligns with FRE 901 and FRCP 26. Reports are written for non-technical decision-makers but defensible under technical scrutiny in deposition or trial. SleuthX, the AI agent, operates inside that same methodology under principal review.

Building toward a licensed PI agency

Digital forensics and incident response are not regulated under PI licensure. That's a different regulatory regime. SleuthX runs DFIR and credentialed-examiner work in-house today. Where a case calls for licensed private-investigator work (surveillance, fieldwork, certain pre-employment investigations, particular evidentiary chains), we coordinate that work through our licensed-investigator partner network. Where an engagement's purpose is to develop evidence for litigation, that work runs under the retaining attorney's direction, and any licensed private-investigator component is coordinated through that same network.

Quinn qualifies as principal applicant under Florida's Class C PI license rules in the company's founding jurisdiction. The longer-term company plan is multi-state PI agency licensure, starting with Florida and building out via reciprocity, qualifying-manager hires, and targeted acquisition of existing licensed practices. SleuthX is not currently a licensed PI agency; every claim about licensure on this site is forward-looking. When that status changes, the language on this page changes.

Expert-witness work

Expert witness engagements cover family law, commercial litigation, IP disputes, breach-causation matters, and arbitration. Available for deposition, hearing, and trial. Available for rebuttal of opposing-counsel forensic reports. Engagements are structured under the retaining attorney's privilege.

How an engagement begins

1. Confidential consultation. NDA-protected. 30 to 60 minutes. Direct conversation with Quinn. No sales process.
2. Scoped engagement. Written proposal with defined deliverables and pricing. Per-case, hourly with milestone caps, or subscription depending on what fits.
3. Investigation, review, and findings. A written report with the hash values, the method, the tools and their versions, and the exhibits, reviewed and signed off by Quinn.

What this means for you

• Written scope before any work. You see a written scope covering deliverables, timeline, and price, and you approve it before we begin. You are never billed for work you did not authorize.
• We commit to findings, not outcomes. We tell you up front what the evidence can and cannot establish. Recovery, attribution, and prosecution are decided by banks, platforms, insurers, and courts. We produce the record they act on, and we put that distinction in writing.
• Every case is investigated, not just scanned. A credentialed examiner reviews every case before findings leave the practice. You get a documented investigation with the hashes, method and tool versions recorded, not a single automated scan and a one-line answer.
• We will tell you if you do not need us. If a free or simpler step would resolve your situation, whether a police report, an IC3 filing, or a platform's own recovery flow, we point you there first.

Why this work matters

Cellebrite and Belkasoft licensing costs $10,000 to $30,000 per year per analyst, which forces traditional forensic services to charge $5,000 to $15,000 per case. The people who need help most get priced out. SleuthX, the AI agent layered on this practice, extends court-grade methodology to consumer pricing tiers, and that is what makes personal cybersecurity services for individuals and families affordable for real people. Quinn still owns case judgment.