AI Investigator · Personal Cybersecurity

SleuthX
The forensic layer credit-monitoring services can’t reach.

The personal cybersecurity stack built around what monitoring services miss: an AI investigator that examines accounts and devices end-to-end, with a credentialed examiner signing off on findings you may need to take to court, the police, or an insurer. It speaks plain language for non-technical users, so you describe what's happening and it walks you through. Investigator-grade depth on demand. Identity monitoring, dark-web monitoring, restoration concierge, and identity-theft coverage layer in as the suite ships.

Try SleuthX now How it works

How SleuthX Works

Input. Agent. Output.

SleuthX ingests data from your accounts and devices, analyzes it with an AI agent built on a working forensics methodology, and escalates to senior human examiners when the case demands it.

Input

Ingest data from accounts and devices

Account logs (email, cloud, banking, social)
Device artifacts and screenshots
Phone, computer, and forensic captures

Agent

Analyze with the AI agent

Classify what's a real compromise vs benign
Reconstruct the timeline of activity
Surface the root cause hypothesis

Output

Deliver a structured report

Compromise classification + severity
Clear next steps you can act on
A written report your lawyer can use when you need one

When a case needs human judgment, SleuthX escalates to the practitioner team of Quinn and Alex, who oversee every output before it leaves the system.

Explore the platform →See what's live on the roadmap →

Deliverables

What you get

Every SleuthX engagement produces the same five deliverables. No mystery, no scope creep.

Compromise classification
Real vs benign, with severity. Tells you whether something actually happened or whether the alarm was noise.
Timeline of activity
What happened, in what order, on which device or account. Reconstructed from logs, artifacts, and forensic captures.
Root cause hypothesis
How the compromise started, whether phishing, SIM swap, reused password, OAuth grant, malicious app, or insider access. Evidence-backed.
Clear next steps
What to do this hour, this week, and this quarter. Specific to your situation, not a generic checklist.
Structured report (legal-ready optional)
Written for non-technical decision-makers. When you need it for litigation, insurance, or law enforcement, it is in a form your lawyer can follow and check.

What SleuthX does

SleuthX brings enterprise and legal-grade methodology direct to consumers.

Same forensic work the enterprise and law firms get from senior IR firms, Belkasoft, and Cellebrite-licensed shops.

Quality, not budget.

We are not competing with NordVPN, LifeLock, or basic antivirus tools.

We are bringing enterprise-grade digital forensics into a tier consumers can actually pay for.

Coverage spans stalkerware detection on iPhone and Android, hacked-account forensic audit and recovery, romance scam attribution and documentation, identity theft forensic investigation, deleted-text recovery for divorce, OSINT exposure mapping, and domestic-violence digital forensics under a safety plan.

Each engagement is structured to be evidentiary, not just felt.

Who builds SleuthX

Quinnlan Varcoe, Founder and CEO, sets the methodology and reviews edge cases where the agent's output is challenged.

Alex Riffenburgh, Co-Founder, brings the offensive-security discipline and takes investigations, field operations, and the agency build-out going forward.

The agent itself absorbs the procedural analysis that previously required senior-analyst hours; the cases run through it serve as both production output and training data.

Three ways to work with SleuthX

Pick the one that matches what you need.

The agent is the throughline across all three. What changes is whether you run it yourself, hand it to our team, or run a whole team on it.

The self-serve tool costs $200/mo, billed monthly, and unlocks every tool. It is a personal cybersecurity service that investigates, not just alerts: a full case-management platform that automates the investigation end to end, from collection and analysis to cited reports and chain of custody. The plan includes $200 of usage credit each month; beyond that, usage draws down a prepaid account balance as tools run, so you top up anytime and pay only for what you use. SleuthX Enterprise at $200 per seat per month, plus $5 per billable device per month is the team tier, adding frontier reasoning, a dedicated analyst escalation channel, and team billing.
Done-for-you forensics comes in device packages for 1 device, 2 to 3 devices, or 4 to 5 devices. Fixed fee by number of devices. You see your exact price before you sign. Scoped in writing before any retainer is collected. Hire an examiner and see done-for-you →
One hourly rate covers everything else. The same standardized rate for additional devices, divorce work, hacked-account recovery, OSINT, breach-counsel support, and every bracket of expert-witness work (case review, deposition prep, deposition, trial testimony). The largest complex and litigation cases are scoped per case and priced in writing before any work starts. 4-hour-per-session minimum without a retainer.

Why these prices

Premium positioning is deliberate.

The pricing funds the senior-practitioner time required to keep methodology current with the threat landscape and is comparable to enterprise retainer pricing per device covered.

The methodology is the same one the enterprise gets from senior IR firms for $50,000 to $500,000 minimums.

If you want to run it yourself, the self-serve tool is $200 per month, billed monthly.

If you want us to do the work, done-for-you device packages are a fixed fee by number of devices, and you see your exact price before you sign.

If you need open-ended senior time, one hourly rate applies across the board.

Call (239) 241-8095

What this means for you

Written scope before any work. You see a written scope covering deliverables, timeline, and price, and you approve it before we begin. You are never billed for work you did not authorize.
We commit to findings, not outcomes. We tell you up front what the evidence can and cannot establish. Recovery, attribution, and prosecution are decided by banks, platforms, insurers, and courts. We produce the record they act on, and we put that distinction in writing.
Every case is investigated, not just scanned. A credentialed examiner reviews every case before findings leave the practice. You get a documented investigation with the hashes, method and tool versions recorded, not a single automated scan and a one-line answer.
We will tell you if you do not need us. If a free or simpler step would resolve your situation, whether a police report, an IC3 filing, or a platform's own recovery flow, we point you there first.

How it works

Confidential consultation. NDA-protected. 30 to 60 minutes. Direct conversation with Quinn. No sales process.
Scoped engagement. Written proposal with defined deliverables, pricing, and timeline. Triage, subscription, or forensic case engagement depending on what fits.
Investigation, review, and findings. The agent runs the procedural forensic work. Quinn reviews every output. You receive a written report you can act on, structured for police, court, counsel, or your own decision-making.

What separates SleuthX from antivirus and identity-protection apps

Monitoring tells you that you might be at risk.

SleuthX tells you what actually happened — investigated end-to-end and reviewed by a credentialed examiner.

Antivirus scans for known malware signatures; identity-protection monitors public breach databases.

Neither one investigates a specific incident on your devices or accounts, produces a forensic report, or is reviewed by a certified forensic practitioner.

SleuthX is forensic methodology, not signature matching.

The comp set is enterprise IR firms and Cellebrite-licensed shops, not NordVPN or LifeLock.

It is not a substitute for a full forensic examination of every device in a matter, or for contested-litigation expert testimony, which we arrange separately.

Why enterprise and legal-grade methodology matters

Enterprise IR firms and Cellebrite-licensed shops charge $50,000 to $500,000 for enterprise incident response and $5,000 to $15,000 per consumer case.

That quality of work was previously out of reach for individuals.

SleuthX keeps the methodological rigor and brings it inside a tier a consumer can actually pay for, because the agent absorbs the procedural analyst time.

Quinn still owns case judgment.

How SleuthX handles each of the consumer practices

Stalkerware and spyware detection
SleuthX runs the iOS configuration-profile audit, MDM enrollment check, jailbreak detection, package-list reconciliation on Android, and known-stalkerware database matching. Quinn reviews findings before any removal step is recommended.
Hacked-account forensic audit and recovery
SleuthX reconstructs login timelines, device-list audits, and access logs across email, social, banking, and cloud accounts. Recovery actions are sequenced so the attacker loses access before they can retaliate.
Romance scam and catfish attribution
SleuthX traces account-creation patterns, image-reuse detection, and money-flow documentation. The deliverable is a written record structured for police, IC3, and counsel.
Identity theft forensic investigation
SleuthX investigates how the exposure happened, surfaces ongoing access points, and documents evidence usable by police, banks, and counsel.
Deleted-text recovery for divorce
SleuthX assists with forensic phone extraction. Deleted texts, hidden apps, photos, and chat history are preserved with documented chain of custody under principal review.
Divorce and family-law digital forensics
SleuthX covers the broader forensic record across devices and accounts. Findings are structured for family court and coordinated with your attorney under privilege.
OSINT exposure mapping
SleuthX maps your digital footprint, identifies who someone really is, traces anonymous harassers, and documents what is publicly available about you. Evidence collection your lawyer can check.
Domestic-violence digital forensics
SleuthX operates under a safety plan. Examination of cloned device images when alerting the abuser is a risk. Reporting structured for protective orders and shared with advocate or attorney as you direct.
Privacy and exposure reduction
SleuthX assists with data-broker removal, account-hardening, and ongoing monitoring. Built for individuals and families who want a smaller digital footprint.

Why this work matters

Built for personal cybersecurity at evidentiary grade.

Quinn holds 9 active certifications across GIAC.

Methodology trusted by Fortune 50 enterprises, defense contractors, and the attorneys who refer to us.

The agent extends that methodology to people who could not previously afford it.

How We Work

A confidential, structured engagement.

Confidential Consultation

A direct conversation with Quinn, the founder and CEO who oversees every engagement. NDA-protected. No sales process.

Scoped Engagement

A clear written proposal with defined deliverables, timeline, and pricing. No hidden costs.

Investigation and Findings

Forensic work your lawyer can follow and check, with regular updates and a written summary you can act on.

Frequently asked about SleuthX

What is SleuthX, in one sentence?

SleuthX brings enterprise and legal-grade methodology direct to consumers. Same forensic work the enterprise gets from enterprise IR firms, BelkaSoft, and Cellebrite-licensed shops, delivered in a tier individuals can actually pay for.

How is this different from antivirus or identity-protection apps?

SleuthX is not competing with NordVPN, LifeLock, or basic antivirus tools. Antivirus scans for known malware signatures. Identity-protection monitors public databases for breach exposure. Neither one runs forensic methodology, neither one produces a forensic report your lawyer can check, and neither one investigates a specific incident on your devices or accounts. SleuthX does. The agent scales the procedural work that previously required senior-analyst hours, and Quinn (Founder and CEO) reviews every output before it leaves the practice.

Do I need to be technical to use it?

No. The default flow is plain language: describe what's happening ("my email got hacked," "someone's tracking my phone," "I keep getting messages from numbers I don't recognize") and the agent walks you through. It asks the next right question, tells you which device or account to grant access to, and explains what it found in plain English. Most users finish triage without ever touching a forensic term. If you want to go deeper, the agent supports that too. You can pick a specific investigation, drill into device/account/timeline/artifact-level analysis, run targeted forensic tasks, and export evidence in a specific format. The same tool works for someone who's never heard of DFIR and for a senior investigator running a multi-device case. Easy floor, deep ceiling.

How is SleuthX priced?

Three ways to work with SleuthX. (1) The self-serve tool is $200 per month, billed monthly, with every tool unlocked. It is a full case-management platform that automates a digital investigation end to end, from collection and analysis to cited reports and chain of custody. The plan includes $200 of usage credit each month, which resets each billing month; beyond that, usage is metered from a prepaid account balance deducted as tools run, so you only pay for what the investigation actually uses. Teams that need frontier reasoning, dedicated analyst escalation, and team billing subscribe to SleuthX Enterprise at $200 per seat per month, plus $5 per billable device per month. (2) Done-for-you forensics comes in three device packages, for 1 device, 2 to 3 devices, or 4 to 5 devices. Fixed fee by number of devices. You see your exact price before you sign. (3) An hourly rate covers anything beyond that, including additional devices, complex multi-actor cases, litigation, and expert-witness work, priced in writing before it starts. All standard payment methods are accepted via Stripe, with bank transfer (ACH or wire) preferred for larger engagements.

What does the monthly plan include?

Everything. The plan is $200 per month, billed monthly. It unlocks case management, AI triage, automated collection and analysis, link analysis, the evidence vault with its chain of custody, reporting with every finding cited, and every forensic tool, and it includes $200 of usage credit each month. The credit resets at the start of each billing month and does not carry over. Usage beyond it draws down a prepaid balance as tools run; top it up whenever you need more, and top-ups never expire. SleuthX Enterprise is the team offering, a subscription at $200 per seat per month, plus $5 per billable device per month that adds frontier reasoning, a dedicated analyst escalation channel, and team billing.

Who reviews the work? Is this just an AI?

Quinnlan Varcoe (Founder and CEO, BS cybersecurity from SANS Technology Institute, 9 active GIAC certifications, a methodology built around how courts evaluate digital evidence) designed the methodology SleuthX is built on. Alex Riffenburgh, Co-Founder, brings the offensive-security discipline and takes investigations and field operations going forward. The agent scales the procedural work that used to require senior-analyst hours; the judgment, methodology, and final report carry Quinn's name.

Will a court accept the report?

We build the work to support admissibility through a methodology designed to support the Federal Rules of Evidence, a documented chain of custody, and forensically sound (NIST/SWGDE-aligned) handling. Admissibility itself is always the court's decision, case by case; no examiner can promise a specific ruling in advance. Quinn examines the work herself; expert testimony is arranged separately for your matter. If a case has a legal dimension and you have an attorney, we structure the engagement under privilege at your attorney's request.

What kinds of cases does SleuthX handle?

Stalkerware detection on iPhone and Android. Recovery and forensic audit after an account compromise (email, social, banking, iCloud). Romance-scam attribution and documentation. Identity-theft forensic investigation. Deleted-text and chat-history recovery for divorce. OSINT exposure mapping. Domestic-violence digital forensics under a safety plan. Each of these has a dedicated practice page with the methodology detail.