Working With The FBI

Two FBI cyber agents from the Richmond field office explain what the Bureau does and how it engages with organizations that have been hit by an intrusion. They outline how the cyber division's strategy flows down from the national mission, how federal policy gives the FBI the lead investigative role alongside DHS and the Defense Department, and how task forces with state and local partners stretch a small agent workforce. A Cyber Action Team, a surge unit of specialists, is described as deploying to large incidents.

Business email compromise receives the most attention as a financial threat. The speakers note that most cases rely on social engineering rather than intrusion, and they urge accounts payable staff to verify payment changes through a pre-established phone number and to add approval layers. Quick reporting matters because an asset recovery team can often freeze transferred funds within a day or two. Ransomware is also covered, including a pipeline case in which seized wallet keys and infrastructure takedowns involved multiple agencies and foreign partners. Investigators target criminal ecosystems and use indictments to limit suspects' travel.

For practitioners, the advice centers on preparation. Build a relationship with the local field office before an incident, maintain a response plan that covers losing key systems, and keep network diagrams current so scope can be understood quickly. Most engagement happens by consent, so legal teams should decide in advance what evidence can be shared, and acceptable-use banners should make monitoring expectations clear. The agents stressed that the FBI does not recommend specific products, remediate networks, or publicize victims.