Cyber stalking, extortion, a stolen account, online fraud or a business under attack can become overwhelming fast. I investigate what happened, preserve evidence, reduce the immediate risk and give you a clear route forward — without drowning you in technical jargon.
Most visitors do not need to know whether their case is OSINT, forensics, threat intelligence or incident response. They need to know whether the situation can be investigated and what to do next.
Identify patterns, preserve evidence, map accounts and reduce exposure.
Contain the compromise, document access paths and build a recovery plan.
Trace flows, preserve transaction evidence and support legal or exchange escalation.
Contain the incident, protect evidence, establish scope and coordinate recovery.
Validate identities, infrastructure and money trails before more damage is done.
Investigate exposure, impersonation, insider concerns and targeted threats.
Determine what is exposed, where it is circulating and what action is proportionate.
Structure digital findings, timelines and technical evidence for counsel or litigation.
A calm, discreet investigation focused on safety, evidence and practical next steps — not a corporate security lecture.
Fast containment and investigation for executives, security teams, law firms and organisations that need senior-level cyber support.
High-trust cyber work should be backed by a public professional record. These links point to independent profiles, coverage or published interviews.
Independent Dutch profile describing cybersecurity leadership work, including Accenture and NATO-related experience.
Open sourcePublic profile showing roles including Accenture Security and Verizon, plus professional recommendations.
Open profilePublished interview about the Vatican Cyber Volunteers and continuous threat monitoring.
Read interviewCoverage naming Joseph Shenouda in connection with the volunteer cyber initiative established in 2022.
Read coverage“I would hire Joe again without hesitation…”Bjørn Dijkstra · recommendation visible on Joseph Shenouda’s LinkedIn profile
A confidential 30-minute call to understand what happened, urgency and what evidence already exists.
You receive a concise plan with objective, deliverables, timing and the agreed fee before billable work starts.
Evidence preservation, OSINT, forensic review, tracing, takedown or containment — only what the case actually needs.
A practical close-out: findings, preserved evidence, recovery actions and recommendations for legal or security follow-up.
Cyber cases vary too much for a credible one-price-fits-all tariff. The commitment is simple: triage first, scope second, agreed fee third, work fourth.
A 30-minute confidential assessment to determine whether I can help and what should happen next.
After triage, you receive a written scope and fee for the defined investigation. No billable work begins until you approve it.
Ransomware, intrusions and multi-day investigations are priced according to urgency, technical scope and required availability.
Representative outcomes from anonymised engagements. Identifying details are withheld to protect clients; the examples show the type of work performed and the outcomes achieved.
An eight-month pattern of anonymous threats across multiple platforms was investigated using OSINT and account-linkage techniques.
A ransomware incident affecting a European manufacturer's ERP environment was contained and moved into structured recovery.
Transaction paths were traced through multiple chains and mixers and documented for legal follow-up.
Technical buyers, CISOs and counsel can still see the full capability set. It simply no longer dominates the experience for a distressed private client.
Identity, abuse, fraud and account-related investigations.
Targeted investigation and risk work for organisations and leadership.
Underground monitoring, attribution and threat intelligence.
Containment, evidence, recovery and post-incident hardening.
If your question is not covered, use the intake form. You do not need to know which technical service to request.
Yes. The initial 30-minute triage is free. Its purpose is to understand the situation, urgency and whether I am the right person to help.
Yes. After triage, billable work starts only after the scope and commercial terms have been agreed. Emergency incidents may require a retainer or rapid-response arrangement.
Yes. The service is designed for both private individuals and organisations. Personal cases are handled in plain language and with an emphasis on discretion and practical next steps.
No credible investigator can guarantee a specific investigative outcome in advance. I can assess the available evidence, explain what is realistically traceable and document findings for technical, legal or law-enforcement follow-up.
Cases are treated as confidential. An NDA can be arranged on request. Do not send passwords, seed phrases or other authentication secrets through the website form.
Keep original messages, emails, transaction IDs, URLs, usernames, dates and screenshots. Avoid deleting accounts or wiping devices before evidence has been assessed unless doing so is necessary for immediate safety.
Yes, where the work can be performed lawfully and remotely or with appropriate local support. Joseph Shenouda is based in the Netherlands.
You do not need to diagnose the incident yourself. Give me the timeline, what changed, what you have already tried and what outcome matters most.