When your AI referral traffic changes unexpectedly, we diagnose root cause with legal-grade audit trail within four business hours. Evidence your counsel can actually use.
Observatory watches. Valve enforces. Forensics is the capability you call when something unexpected happens to your AI visibility — a traffic collapse, a regulatory subpoena, an M&A diligence request, a public accusation about what you did or didn't let a model train on. We run the investigation, produce the audit trail, and stand behind the report.
Over 14 days a single auto-malicious-IP rule on dugganusa.com swept up 78 unique Bingbot IPs. ChatGPT referrals (which fetch through Bing's index) collapsed 86%. Google organic was untouched. Gemini was untouched. Claude was untouched. We had no idea — we were looking at content saturation, competitor activity, and OpenAI re-ranking. The actual cause was one missing clause in one firewall rule.
and not cf.client.bot exemption.We did this to ourselves. We documented it in public. We turned it into a patent filing and a product. That's the methodology we apply to your incident.
Each Forensics incident concludes with a signed report scoped to the regulatory frameworks you live under. We speak these fluently:
Evidence class: continuous-monitoring control, change-management trail, third-party-data-access log. Fits Trust Services Criteria CC7.x and CC8.x.
"Right to be forgotten" — attesting that content was or was not exposed to a given AI training crawler during a specific window. The exact evidence DPAs ask for.
Training-data-exclusion attestations for general-purpose AI model obligations. We package the audit trail in a form compatible with Article 53 transparency requirements.
MAP, MEASURE, MANAGE categories — specifically the data-provenance and access-logging subcategories that auditors focus on.
Most incidents are boring. Ours was a four-word fix. What you're paying $4,999/mo for is having us on retainer — credentials staged, runbooks loaded, reverse-DNS tooling warm — so the diagnosis starts inside the hour instead of inside the week. If you have a mature incident response team internally and just want the evidence format, Valve plus your own IR is probably enough. Forensics is for the organizations where "just have someone on call who does this for a living" is the cheapest part of the compliance program.
Forensics is contract-based with a brief scoping call. We want to understand your CDN, your compliance frameworks, and the incident shape you're worried about before quoting specifics.