The DFIR reporting study

How does the client report actually get written?

Eight questions, about four minutes. I'm trying to find out how client- and insurer-facing incident reports really get produced — how long they take, what gets reused, and what the client actually reads. Not what the methodology says. What people do.

What you get back
  • The aggregate results, free, published in full — you get them before they go public.
  • Your numbers benchmarked. Hours per report, reports per quarter, what people reuse — so you can see whether your four hours is normal or whether you're the outlier.
  • Published whatever it says, including if the finding is that nobody minds writing these.

Anonymous unless you choose to give an email at the end. Answers go to my own database — no form service, no analytics, no tracking. Nothing is published with your name or firm attached, and named quotes only ever happen with written permission.

Question 1

Which best describes you?

Question 2

In the last three months, how many client- or insurer-facing incident reports did you produce?

The actual last three months, not a typical quarter. A rough count is fine.

Question 3

Think of the most recent one. Roughly how many hours went into the document?

Just the writing and assembly — from the point the investigation was effectively done to the point it went out. Not the investigation itself.

Question 4

What do you reuse between reports?

Select all that apply.

Question 5

Where do your notes live during an investigation?

Select all that apply. Where they actually live, not where they're supposed to.

Question 6

Do you run a case-management platform?

And if you do — does it produce the report you send?

Question 7

Where does the work come from?

Select all that apply.

Question 8

What's the worst part of producing the document?

Whatever comes to mind first is usually the right answer — a sentence is plenty. And if there's a part you'd never hand off to anyone else, junior analyst or otherwise, say which.

Want the results?

Optional. If you leave an email you'll get the aggregate findings — with your own answers benchmarked against everyone else's — before they're published anywhere. Used for that and nothing else, and no list.

Full disclosure so it isn't a surprise later: I'm a developer building a tool in this space (benchnotes.io). That's why I care about the answers. The study is being published free regardless of what it finds, and there's no pricing question anywhere on this page on purpose.

Skip anything you'd rather not answer — a partial response is fine.

Thank you — that's genuinely useful.

If you'd like something concrete in return right now, benchnotes.io/tools is a free IOC and timeline appendix builder — paste your notes, get the Word tables. No signup, and it runs entirely in your browser.