Cybersecurity Expert Witness: Consulting and Testifying Roles
A cybersecurity expert witness is a security or digital forensics practitioner who gives opinions in litigation about what happened in a cyber incident and whether a party's security met the standard the law requires. Counsel retains the expert in one of two roles. A consulting expert works behind the scenes, and Federal Rule of Civil Procedure 26(b)(4)(D) generally shields that expert's facts and opinions from discovery. A testifying expert signs a written report under Rule 26(a)(2)(B), sits for a deposition, and must satisfy Federal Rule of Evidence 702, which since December 1, 2023 has required the proponent to show the court that it is more likely than not that the opinion meets each of the rule's reliability requirements. Many cases need the first role early and the second only if the case goes forward.
What does a cybersecurity expert witness do?
A cybersecurity expert answers technical questions a judge or jury cannot answer alone. In a breach case the questions are how the attacker got in, when, what systems and data they reached, whether data left the network, and whether the defendant's controls were reasonable for the data it held. In a trade secret case they become whether files were copied, when, to where, and whether anyone used them. The expert works from evidence: forensic images, memory captures, cloud audit logs, endpoint telemetry, firewall and VPN records, and the company's policies, risk assessments, and audit reports.
Both sides retain cyber experts. A plaintiff's expert explains what went wrong and why it mattered. A defendant's expert shows what the company did, what the evidence supports, and where the other side's theory goes beyond the logs. In insurance and contract disputes, the expert establishes the timeline and the technical facts the policy or contract language turns on. Our guide to cyber forensics covers how the underlying investigation runs.
What is the difference between a consulting expert and a testifying expert?
The difference is disclosure. Under Federal Rule of Civil Procedure 26, a consulting expert retained in anticipation of litigation and not expected to testify is ordinarily beyond the other side's reach, while a testifying expert's opinions, basis, and the facts behind them are disclosed and tested.
| Dimension | Consulting expert | Testifying expert |
|---|---|---|
| Discovery of facts and opinions | Ordinarily barred by Rule 26(b)(4)(D), except as provided in Rule 35(b) or on a showing of exceptional circumstances | Opinions, basis, and the facts or data considered are disclosed under Rule 26(a)(2)(B) |
| Written report | None required | Signed report with opinions and reasons, facts or data considered, exhibits, qualifications and 10 years of publications, 4 years of prior testimony, and compensation |
| Drafts and attorney communications | Covered by the Rule 26(b)(4)(D) bar while the expert stays non-testifying | Drafts protected by Rule 26(b)(4)(B); attorney communications protected by Rule 26(b)(4)(C), except on compensation, facts or data counsel provided, and assumptions the expert relied on |
| Deposition | Not ordinarily available to the other side | Allowed after the report is served, with the deposing party paying a reasonable fee under Rule 26(b)(4)(E) |
| Typical timing | From the first call, often before suit is filed | Disclosure at least 90 days before trial unless the court sets another date; rebuttal within 30 days of the other side's disclosure |
The roles can change. A consulting expert whom counsel later designates to testify takes on the testifying expert's disclosure duties, including the facts or data considered in forming the opinions, so counsel should decide early what the consulting work will touch. Some trial teams keep the consulting expert separate from the testifying expert so exploratory analysis stays protected. When counsel retains a forensic firm after a breach, the engagement letter matters for the same reasons it matters to privilege, which our Kovel agreement guide explains.
What does Rule 702 require after the 2023 amendment?
Federal Rule of Evidence 702 lets a qualified expert testify only "if the proponent demonstrates to the court that it is more likely than not" that four conditions hold: the expertise will help the trier of fact, "the testimony is based on sufficient facts or data," "the testimony is the product of reliable principles and methods," and "the expert's opinion reflects a reliable application of the principles and methods to the facts of the case." The amendment that took effect December 1, 2023 wrote the preponderance standard into the text and rewrote the last condition. Its committee note says courts that treated the sufficiency of an expert's basis as a question of weight made "an incorrect application of Rules 702 and 104(a)," and that each opinion "must stay within the bounds of what can be concluded from a reliable application" of the expert's basis and methodology.
The rule rests on Daubert v. Merrell Dow Pharmaceuticals, decided June 28, 1993, which made the trial judge a gatekeeper responsible for ensuring that expert testimony is relevant and reliable. The Court listed factors a judge may weigh: whether the method can be and has been tested, peer review and publication, the known or potential error rate and the standards controlling the technique, and general acceptance. Kumho Tire Co. v. Carmichael (1999) extended the gatekeeping duty to technical and other specialized knowledge and called the inquiry "a flexible one."
For a cyber expert, that translates into four habits. Follow a recognized process, such as the collection, examination, analysis, and reporting phases in NIST SP 800-86, and work on verified copies whose hash values match the originals. Validate the tools and versions used against known data and record them. State the limits of each artifact: a sign-in from an IP address shows a session, and it does not by itself show who was at the keyboard. Stay inside the expertise, leaving damages to economists and legal conclusions to the court.
Which cases need a cybersecurity expert, and what do they answer?
| Case type | Questions the expert answers | Typical evidence |
|---|---|---|
| Data breach class action | How the attacker got in; what data was accessed or taken; whether security was reasonable; whether the breach could have caused the claimed harm | Forensic images, logs, the forensic report if produced, policies, risk assessments, audit reports |
| Trade secret theft | Whether files were copied, when, to where, and whether they were used | Laptop images, USB and cloud sync artifacts, email and audit logs |
| Insurance coverage dispute | What happened and when; which systems were affected; whether the facts an exclusion depends on are present | Incident timeline, forensic findings, policy period records |
| Contract dispute over security commitments | Whether the controls a vendor promised existed and operated | Contracts, configuration evidence, tickets, audit reports |
| Regulatory inquiry | Whether controls met a stated standard; when the company detected and reported the incident | Policies, logs, notification records |
Statutes frame several of these questions. In California, Civil Code 1798.150 lets a consumer sue when nonencrypted and nonredacted personal information is subject to unauthorized access and exfiltration, theft, or disclosure "as a result of the business' violation of the duty to implement and maintain reasonable security procedures and practices." The statute sets statutory damages of $100 to $750 per consumer per incident, adjusted under section 1798.199.95(d), or actual damages if greater, requires 30 days' written notice before a claim for statutory damages, and says security adopted after a breach is not a cure. Whether the security was reasonable is the expert's question.
Trade secret cases have their own frame. The Defend Trade Secrets Act, 18 U.S.C. 1836, gives the owner of a misappropriated trade secret a federal civil action, with injunctions, damages, and up to twice the damages for willful and malicious misappropriation. The forensic record of what was copied, when, and where it went is the factual core of that claim, and our guide to departing employee data theft covers the artifacts that prove it.
How do experts measure reasonable security?
Experts measure reasonable security against recognized frameworks and the company's own risk analysis, and four reference points come up in that work. The NIST Cybersecurity Framework 2.0, released February 26, 2024, organizes outcomes under six functions, Govern, Identify, Protect, Detect, Respond, and Recover, for organizations of every size and sector. The CIS Critical Security Controls, now version 8.1, give a prioritized list of safeguards, and the California Attorney General's February 2016 data breach report said the CIS Controls set "a minimum level of information security" and that failing to implement the ones that apply "constitutes a lack of reasonable security." ISO/IEC 27001:2022 sets requirements for an information security management system, and our comparison of ISO 27001 and NIST explains how the two relate.
The fourth is state safe harbor law. Ohio Revised Code 1354.02, effective November 2, 2018, gives a covered entity an affirmative defense to tort claims alleging that a failure to implement reasonable security controls caused a data breach, if the entity maintains a written cybersecurity program that reasonably conforms to a framework listed in section 1354.03, such as the NIST Cybersecurity Framework, NIST SP 800-171, the CIS Controls, or the ISO/IEC 27000 family, and updates to a revised framework within one year. An expert's opinion holds up best when it ties each claimed failure to a specific control in one of these frameworks and to evidence that the control was or was not operating. Our NIST compliance consulting team builds security programs against the same frameworks.
How does the expert's work run across a case?
The work follows the case. Early case assessment comes first: the expert reviews what evidence exists, what it can prove, and what is missing, which shapes the pleadings and the settlement posture. Preservation advice follows, because the expert knows which logs expire first, as our litigation hold guide describes. In discovery, the expert helps counsel write the ESI protocol and the requests for the right systems, formats, and fields, then reviews the other side's production. Analysis builds the timeline from images and logs.
If the expert will testify, the Rule 26(a)(2)(B) report comes at the court's deadline, followed by rebuttal reports, the deposition, motions under Rule 702, and trial. Absent a stipulation or court order, Rule 26(a)(2)(D) puts expert disclosures at least 90 days before trial and rebuttal disclosures within 30 days after the other side's disclosure.
How much does a cybersecurity expert witness cost?
A testifying expert's fees become part of the record. Rule 26(a)(2)(B)(vi) requires the report to state the compensation for the study and testimony, and Rule 26(b)(4)(E) generally requires the party taking an expert's deposition to pay a reasonable fee for the time spent responding. The figures here are BD Emerson planning ranges as of October 2026. An early case assessment of an existing forensic report and evidence set runs $10,000 to $30,000. A consulting expert engagement through discovery, including analysis of images and logs, runs $30,000 to $120,000. A testifying engagement through report, rebuttal, and deposition adds $50,000 to $200,000, and trial preparation and testimony are scoped and billed separately. Practitioner rates run $300 to $600 an hour depending on role. The volume of evidence, the number of systems and custodians, whether events must be reconstructed or systems tested, and how far the case goes move each range.
How do you choose a cybersecurity expert witness?
Start with the questions the case needs answered and find someone who has done that work on the systems involved, such as Microsoft 365 tenants, AWS accounts, Windows endpoints, or mobile devices. Ask the expert to walk through the method they would use and the tools they would validate. Read the publications from the past 10 years and the testimony from the past four years, which a Rule 26(a)(2)(B) report will disclose anyway, and look for earlier positions that cut against your case. Ask whether a court has ever limited or excluded the expert's opinions. Check conflicts, including whether the expert's firm has done security work for any party. Then test whether the expert can explain a log entry to a jury in plain language.
How BD Emerson supports litigation as a consulting or testifying expert
Our practitioners have testified as expert witnesses in court. We take testifying engagements selectively; most of our litigation work is as consulting experts retained through counsel. That work starts under an engagement with counsel, and it draws on the same security practice that runs incident response, penetration testing, and compliance programs, so our opinions about logs and controls come from people who configure and test those systems. Before we accept a testifying role, we check for conflicts, including any security work we have done for a party, and we tell counsel early what the evidence can and cannot support. Our digital forensics services page describes the collection and analysis behind that work.
Frequently asked questions
What does a cybersecurity expert witness do? A cybersecurity expert witness analyzes the technical evidence in a case and gives opinions on questions a judge or jury cannot answer alone, such as how an attacker got in, what data was accessed or taken, when it happened, and whether a company's security was reasonable for the data it held. The expert works from forensic images, logs, cloud audit records, and the company's policies and assessments, and either advises counsel privately or testifies.
What is the difference between a consulting expert and a testifying expert? A consulting expert is retained in anticipation of litigation and not expected to testify, so Federal Rule of Civil Procedure 26(b)(4)(D) ordinarily bars the other side from discovering that expert's facts and opinions. A testifying expert is disclosed, signs a written report under Rule 26(a)(2)(B) covering opinions, basis, facts or data considered, qualifications, prior testimony, and compensation, and can be deposed. Counsel often retains a consulting expert first and decides later whether anyone will testify.
Can a consulting expert be deposed by the other side? Ordinarily, the other side cannot discover a consulting expert's facts or opinions by interrogatory or deposition. Rule 26(b)(4)(D) allows it only as provided in Rule 35(b) or on a showing of exceptional circumstances that make it impracticable to obtain the same facts or opinions by other means. If counsel later designates the consulting expert to testify, the testifying expert rules apply instead, including the written report and the deposition.
Are drafts of an expert report discoverable? Drafts of a testifying expert's report are protected under Rule 26(b)(4)(B), which extends work product protection to drafts in any form. Communications between counsel and an expert who must write a report are also protected under Rule 26(b)(4)(C), except communications about compensation, facts or data counsel provided that the expert considered, and assumptions counsel provided that the expert relied on. Those three categories are discoverable, so counsel should share facts in a form it is comfortable producing.
What changed in Federal Rule of Evidence 702 in 2023? The amendment that took effect December 1, 2023 states that the proponent must show the court it is more likely than not that the testimony meets each requirement: helpful expertise, sufficient facts or data, reliable principles and methods, and an opinion that reflects a reliable application of those methods to the case. The committee note says courts that treated the sufficiency of an expert's basis as a jury question misapplied the rule. Each cyber opinion has to stay within what the evidence and method support.
How much does a cybersecurity expert witness cost? Cost depends on the volume of evidence, the number of systems and custodians, whether events must be reconstructed or systems tested, and whether the case reaches a report, deposition, and trial. BD Emerson planning ranges as of October 2026 run from $10,000 to $30,000 for an early case assessment to $50,000 to $200,000 or more for a testifying engagement through deposition. A testifying expert's report must state the compensation under Rule 26(a)(2)(B)(vi).
If you need a consulting expert to test the evidence early or a testifying expert to carry an opinion through deposition, our digital forensics team can review the record with counsel and tell you what the logs and images can support.
About the author
