Dave Smith

I lead technical delivery across the full lifecycle of major cyber incidents - threat actor eviction and containment, rapid response, ransomware recovery, and post-incident resiliency - on some of the UK's largest and most complex engagements, including global manufacturing environments spanning over 1000+ sites, 10K+ impacted hosts and 150,000+ users, alongside numerous other enterprise-scale incidents.

My work sits at the intersection of deep technical recovery - Active Directory Sanitization and rebuild, ESXi/vSphere remediation at scale, forensic evidence handling - and engagement leadership: coordinating closely with cyber insurance carriers, legal counsel, and external DFIR firms on incident response, commercial scope, and delivery. I regularly own complex board-level reporting and respond to formal legal findings requests during live incidents.

I've also played a role in growing Fenix24's reach beyond individual engagements - brokering post-engagement improvement work, developing strategic partnerships, and supporting client introductions.

Beyond client engagements, I've spoken internationally across Europe and the US on ransomware recovery and enterprise resilience and have worked alongside law enforcement and government bodies on some of the largest engagements in the EMEA & US.

I also build the systems that make recovery repeatable: internal engagement planning frameworks, training labs, and tooling used to develop reduction on impact and improve restoration response across the business.

Open to connecting with others in DFIR, ransomware recovery, legal, governmental and enterprise resilience.