SleuthX · Investor Briefing · May 2026
Identity monitoring watches your credit. SleuthX investigates everything else. An AI agent built on a working DFIR methodology, layered on top of a captive practitioner team, with a licensed-PI agency build-out as the regulatory moat.
Two-founder team. Quinnlan Varcoe (Founder & CEO) built the methodology for court review, examines the files herself and writes the report. Alex Riffenburgh (Co-Founder) brings the offensive-security discipline and takes investigations, field operations, and the agency build-out going forward.
The Problem
The Scale
Roughly a third of Americans experienced identity theft in the last year. Tens of millions had accounts compromised, devices infected, or money stolen, and most never found out what actually happened.
The three options that don't work
Identity Monitoring ($10–25/mo)
Already bundled into most bank accounts. Tells you something might be wrong. Never tells you what.
Forensic Examiners ($300–500/hr)
Priced for litigation, not consumers. Weeks of waiting. Out of reach for the average victim.
Police
Rarely investigate consumer digital crime. Victims are left with no evidence, no answers, and no path forward.
The Gap
The entire device and account surface — where most consumer cybercrime actually happens — is invisible to the existing market. Monitoring services were built for credit fraud. Everything else falls through the cracks.
Monitoring services SEE
Monitoring services DON'T see
The gap isn't a feature gap. It's a category gap. No consumer product has ever addressed it.
The Category
Identity monitoring watches your credit.
SleuthX investigates everything else.
Forensic investigation, delivered as consumer software. Continuous surveillance of the surfaces monitoring services can't see, plus expert investigation when something happens. This isn't a better version of what exists. It's a different product in a category nobody owns.
Answers, Not Alerts
We tell users exactly what happened, not just that something might be wrong.
Evidence, Not Reports
Findings a lawyer can follow, check and take into a legal process. No monitoring product can produce them.
Investigation, Not Monitoring
Active forensic analysis across devices, accounts, and behavioral patterns.
Why Now
AI agents are finally capable
Running real forensic methodology on consumer data at consumer cost is now possible. Three years ago this required a $500/hr human. Today it doesn't.
Threat surface has expanded
Stalkerware deployments rising sharply. Romance scams hit $1.3B/year in US losses. SIM-swap incidents climbing. Crypto fraud at multi-billion scale.
Monitoring is commoditized
Free monitoring is bundled into nearly every bank account, credit card, breach settlement, and AAA membership. The category is racing to the bottom on price, not competing on capability.
Incumbents are stuck
Aura, LifeLock, and IdentityIQ have spent a decade optimizing the monitoring layer. Going deeper requires DFIR talent and methodology they simply don't have.
A Second Category Nobody Owns
$21B
Global PI market (2025)
$32.8B
Forecast by 2035
43,600
US private investigators, overwhelmingly solo operators
The vacuums we're filling
Consumer-facing PI brand at scale
Doesn't exist.
AI tooling for working PIs
Doesn't exist.
AI-native, multi-state licensed PI agency
Doesn't exist, and SleuthX is being built toward it.
The PI industry is a vacuum on both sides of the market. The largest player (Pinkerton/Securitas) is enterprise-only with no consumer brand. SleuthX is being built as an AI-native PI agency on a roadmap to 50-state licensure. This isn't software for PIs — we are building a PI agency, with software as the operating layer. Today, the founder qualifies as principal in Florida and licensed-investigator surveillance work is delivered through partner-network coordination while we build out captive licensure.
Go-to-Market
Consumers
Subscribe to the self-serve plan at $200 per month, billed monthly (includes $200 of usage credit each month), then prepaid token top-ups for self-serve forensic answers on their own digital life.
PI agencies
Subscribe via the Enterprise tier ($200 per seat per month, plus $5 per billable device per month, team billing), and use SleuthX as the AI co-pilot on their existing caseload.
Licensed PI casework
When cases escalate past self-serve, the workflow today routes through credentialed DFIR examiners in-house and licensed-investigator partners under chain-of-custody discipline. The build-out target is to bring that PI casework captive under our own multi-state licensure — documented from start to finish, owned end-to-end.
The closest model is Hims and Ro: vertically integrated, licensed in their regulated domain, with software as the operating layer. The licensing moat is what produced their multi-billion-dollar outcomes despite competing against pure-software incumbents.
The Structural Moat
Software companies serve adjacent markets. Licensed operators are the market. Four structural advantages a software-only competitor can't match, and won't be able to match within a venture-relevant timeframe.
Investigative work product
A licensed PI's findings can go to a court, the police, or an insurer for review. Aura and LifeLock produce monitoring data — not investigative work product. The same finding is worth ~10x more when it can be used in a divorce filing or protective-order petition.
Distribution channels closed to software
Family-law attorneys, insurance fraud teams, and victim-advocacy organizations refer to licensed investigators. Bar ethics rules block referrals to unlicensed software vendors. Pure-software competitors don't have a path in.
Peer-to-peer enterprise tier
Once SleuthX itself is operating to professional PI standards, agencies subscribed to the Enterprise tier at $200 per seat per month, plus $5 per billable device per month aren't buying vendor software. They're using tools built by another licensed agency. The trust dynamic, retention, and pricing power are fundamentally different.
Regulatory moat compounds every quarter
43 of 50 states require state-level PI licensing. A well-funded competitor needs 24–36 months minimum to replicate a 50-state footprint. Every state we add hardens the moat further.
Build-out Plan
The hard part is started
SleuthX is headquartered in Florida, where Quinn qualifies as principal applicant. The 50-state buildout proceeds via reciprocity where available, qualifying-manager hires in restrictive states, and targeted acquisition of existing licensed practices.
The moat doesn't erode. It hardens every quarter we add a state.
Licensing requirements by state
California
6,000 qualifying hours for the principal applicant, one of the most restrictive requirements in the country.
Florida
2-year Class C license requirement. SleuthX's home state and founding jurisdiction.
Texas, New York, New Jersey
Similarly hard licensing gates requiring state-level qualifying managers.
43 of 50 states
Require state-level PI licensing — creating a durable, capital-resistant barrier to entry.
The license stack is the hard part. The AI agent is the soft part. We're building both, but only one of them is unclonable by capital alone.
How It Works
Most cases resolve at the agent tier. For the rest, the agent surfaces exactly what needs human attention. Today, escalation routes to credentialed DFIR examiners in-house and a coordinated network of licensed-investigator partners. As licensure rolls out state by state, more of that escalation becomes captive.
01
Try It
Free 30-min consult or the self-serve plan at $200/mo
02
Agent Investigates
AI forensic analysis of accounts and devices
03
Agent Reports Back
Plain-language findings and recommended actions
04
Escalate If Needed
DFIR examiners in-house, licensed-investigator partners on field work
The Strategic Pattern
Try the software, hit a wall on complexity, click for human help, pay premium. The AI is both the product and the demand-generation engine.
Most consumer cyber companies face a chicken-and-egg problem: how do you know you need monitoring before something happens? We don't have that problem. People come to SleuthX when they already suspect something has happened. The agent confirms or denies, and routes them to the right next step.
An engine instead of an engagement
AI forensic analysis run by the engine, not on a consulting engagement timeline.
Answers instead of alerts
Structured findings in plain language, not a dashboard of amber warnings.
Self-discovery instead of sales pressure
Users self-qualify into higher tiers as their case complexity demands it.
Product
The full ladder from $200/mo platform access to $50K multi-actor forensic investigation. Customers self-select into the mode that matches their situation, and see the price before they sign.
Mode 1. Platform access
$200 per month, billed monthly with $200 of usage credit each month included, then prepaid token top-ups; SleuthX Enterprise at $200 per seat per month, plus $5 per billable device per month adds frontier reasoning, dedicated analyst escalation, and team billing.
Mode 2. Done-for-you
Device packages at $2,500 (1 device), $5,000 (2 to 3 devices), $7,000 (4 to 5 devices); $550/hr beyond, with complex and litigation cases at $15,000–$50,000.
Mode 3. Hourly
$550/hr rate across every service. Same rate Cellebrite-tier work commands at boutique DFIR firms, delivered at consumer accessibility.
Written scope before any billable work begins.
The Three-Rung Agent Ladder
| Tier | Price | Included | What it does |
|---|---|---|---|
| Self-serve plan | $200/mo, billed monthly | $200 of usage credit each month · every tool | A monthly subscription unlocks the full platform; usage beyond the monthly credit draws down a prepaid account balance (top-ups are high-margin consumption revenue). |
| Enterprise | $200 per seat per month, plus $5 per billable device per month | Team billing · frontier reasoning | Organizations and agencies get every Premium tool unlocked (OSINT, live VM, account recovery, escalate), dedicated analyst escalation channel. |
The Specialist Bench
At every escalation point, we capture the work with our own specialist team where licensure permits, and through chain-of-custody coordination with licensed-investigator partners where it doesn't, yet.
DFIR consultants
In-house · Live now
Deep technical forensics on devices, networks, and accounts. Account compromise, device infection, ransomware on personal devices.
TA negotiators
In-house · Live now
Communication and recovery negotiation with adversaries. Ransomware, sextortion, BEC recovery, romance-scam exit, executive sextortion.
Credentialed examiners
In-house · Live now
Expert-witness work, scoped per matter. Whether any expert may testify is the court's decision in each case.
Licensed PIs
Partner network now · Captive on the roadmap
Surveillance, attribution, fieldwork, and evidence collection. Active stalking, custody, harassment cases. Coordinated through licensed-investigator partners today; brought captive as state-by-state licensure comes online.
The Channel Thesis
Inbound referrals
Family-law, litigation, and divorce attorneys refer clients to us. Bar ethics rules require licensed investigators — not software vendors. Once SleuthX licensure is in place, pure-software competitors are structurally locked out of this channel entirely. Today, attorneys engage us for the DFIR / expert-witness side directly under attorney privilege.
Outbound referrals
We refer clients to attorney partners for the legal proceedings that follow our forensic findings: divorce filings, protective orders, civil litigation, and criminal referrals. Bidirectional flow creates a relationship economy that compounds with every case closed.
Aura can't run this play (no practitioners). Harvey can't (wrong vertical). Pinkerton can't (no software, no consumer surface). The combination is structurally ours to build.
Business Model
Same playbook the incumbents used to build the monitoring layer. We add the forensic layer they never built.
What we own (the moat)
Forensic AI agent
Trained on real case data. Compounds with every case closed.
Investigation methodology
DFIR practitioner depth built into the product layer.
Reporting built for court review
Chain-of-custody discipline embedded in every output.
DFIR practitioner team
Captive specialists in-house across DFIR, negotiation, and expert-witness work.
What we VAR (commodity layer)
Credit monitoring
Experian / Equifax APIs, the same data the incumbents use.
Dark-web exposure
SpyCloud, HaveIBeenPwned, best-in-class data feeds.
Data-broker removal
Optery / Kanary white-label for privacy protection.
ID-theft insurance
AIG / Chubb underwritten. Restoration via Sontiq / Generali.
Market
100M+
Americans affected
50–100M+ Americans experienced a digital incident in the last 12 months, the unaddressed sub-segment monitoring services don't serve.
$50B+
Consumer cyber TAM
Global consumer cybersecurity market. Identity-protection segment alone is $14B+ with double-digit growth.
$21B
PI services market
Global private-investigation services market today, projected $32.8B by 2035. Fragmented across 37,000+ solo US practitioners with no AI tooling.
Aura's $165M ARR at 50% YoY growth proves consumers will spend at premium ARPU on personal cyber. The PI category proves there's $20B+ of demand for investigation services with no consumer brand serving it, and 37,000+ practitioners with no AI tooling on the supply side. We monetize both sides simultaneously.
Competitive Landscape
| Product | Price | Watches credit | Investigates devices | Built for court review | Forensic AI |
|---|---|---|---|---|---|
| Aura / LifeLock / IdentityIQ | $10–25/mo | ✓ | — | — | — |
| Bank / AAA bundled monitoring | Free | ✓ | — | — | — |
| Mandiant / CrowdStrike (enterprise DFIR) | $500+/hr | — | ✓ | ✓ | Limited |
| SleuthX | $200/mo | ✓ (via partners) | ✓ | ✓ | ✓ |
We're not competing on monitoring breadth. We own the forensic layer, a column no incumbent has checked, and none can quickly acquire.
The Build vs Buy Asymmetry
Aura's moat
Brand awareness, ad spend, distribution channels, and partner relationships. Real — but replicable. These advantages erode when a better product exists.
Our moat
DFIR practitioner depth, forensic AI trained on real cases, a methodology built for court review, hybrid AI+human delivery, and PI licensure across multiple states (in build-out). Hard to replicate in under 3 years.
A monitoring company can't acquire DFIR capability overnight. They'd need to hire credentialed examiners (rare and expensive), build chain-of-custody discipline, train an AI on real case data they don't have, develop a methodology built for court review, and start the multi-year multi-state PI licensure process — all while their existing product roadmap competes for resources. We've already built the foundation. They haven't started.
The Comp Set
Consumer cyber benchmark
Aura. Proving consumer demand
Vertical AI benchmark
Harvey. Proving the multiple
Aura proves the demand. Harvey proves the multiple. SleuthX sits at the intersection: AI agents with credentialed human sign-off, in a legal-adjacent forensic vertical, sold to consumers and B2B partners.
The Vertical AI Playbook
Harvey, EvenUp, and Casetext established the pattern. SleuthX is executing it in a category none of them are in.
Choose Vertical
Deploy Agents
Human Sign-off
Premium Pricing
Compound Data
Sierra
$15.8B valuation · $150M ARR · ~105x ARR. Vertical AI for enterprise CX.
Harvey
$11B valuation · $190M ARR · ~58x ARR. Vertical AI for legal, and the closest analog.
EvenUp
$1B+ valuation. AI demand letters for personal-injury law. Same expert-bottlenecked, high-stakes pattern.
Casetext
$650M acquisition by Thomson Reuters. Legal research AI, proving vertical data compounds into M&A.
The vertical AI checklist
Why the Harvey multiple translates
Vertical AI multiples aren't earned by customer type. They're earned by the value dynamic of AI replacing expert-bottlenecked, high-stakes workflows that require credentialed human sign-off.
Harvey: replaces associate attorney; partner sign-off; litigation/M&A stakes.
EvenUp: replaces PI attorney; senior-attorney sign-off; settlement/court stakes.
SleuthX: replaces forensic examiner; credentialed-examiner sign-off; court / evidence / recovery stakes.
Practice Team
Founder & CEO
Founder & CEO
Founder and CEO. Bachelor of Science in cybersecurity from SANS Technology Institute. 9 active SANS GIAC certifications including GCIH, GCIA, and GSEC. Designed the forensic methodology that SleuthX encodes and trains on. Roughly a decade in incident response and threat intelligence for Fortune 50 enterprises and the defense industrial base before founding the company.
Designed the methodology SleuthX is built on.
Co-Founder
Co-Founder
OSCP-certified offensive security engineer with experience across red teaming, penetration testing, digital forensics, and AI security. Bachelor of Science in Computer Science from Western Governors University. In 2025 she shipped exploit proof-of-concepts and patches against AI training infrastructure as a contractor in the AI security space, the same threat surface SleuthX defends consumers from. Active CTF competitor, DEFCON and BSides regular, contributor to non-profit OSINT projects. At SleuthX she will take investigations, field operations, and agency licensing as that side of the practice comes online.
Takes investigations and field operations going forward.
Quinnlan designed the forensic methodology the agent is built on, owns case judgment, and examines the files herself. Alex brings the offensive-security discipline and takes investigations, field operations, and the agency build-out going forward. The company operates under SleuthX, Inc.
The Briefing
Why now
Capital, comp set, and consumer demand are aligned. Cybercrime losses, scam volume, and stalkerware deployment all compounded over the past five years. SleuthX sits where that demand crosses the affordability gap.
Request the full briefingMarket
$50B+ consumer cyber TAM with the forensic layer vacant. $21B PI services market with no consumer brand and no AI tooling. SleuthX monetizes both sides simultaneously.
Request the full briefingTeam
Quinn owns case judgment and the methodology, examines the files herself and writes the report. Alex takes investigations and field operations going forward. The product is the productized version of an already revenue-generating practice, not a cold-start.
Request the full briefingThe Ask
Round size and valuation cap are calibrated for AI/ML pre-seed. Use of funds covers product development on the agent, scaling the working SleuthX practice, and the state-by-state PI licensure build-out. Specific terms, including round size, valuation cap, SAFE structure, MRR, customer count, and the unit-economics table, are shared in the investor room after a first call.
Investor Room
Email quinn@sleuthx.ai. Response within one business day. NDA-protected from the first conversation. Specific terms in the call.
Also available
Founder bio, photos, and public press metrics live on the press kit. Investor-grade numbers live in the investor room.
Forward-looking statements. Multi-state PI licensure, captive licensed-investigator workforce, attorney-channel access, and 50-state regulatory moat are part of the company's stated build-out plan and use of funds. Today, SleuthX operates a DFIR practice in-house under a methodology built for court review, the founder qualifies as principal applicant in Florida, and surveillance / fieldwork is performed through a coordinated network of licensed-investigator partners. SleuthX makes no claim of current PI agency licensure. Comp-set valuations and revenue figures (Aura, Harvey, Sierra, Decagon, EvenUp, Casetext) are public-record. Specific buyer interest cannot be inferred from this page.
Ways to work with us
Self-serve tool
$200/mo billed monthly
Fully automated digital forensics you run yourself. SleuthX automates a digital investigation end to end, from collecting and analysing the evidence to a report with every finding cited.
See what's included →Done-for-you
Device packages for 1 to 5 devices. Fixed fee by number of devices. You see your exact price before you sign.
Call (239) 241-8095Enterprise
$200/seat/mo plus $5/device/mo
Team tier, with frontier reasoning, analyst escalation, and team billing.
See enterprise →Trusted by partners across the practice
