System and method for identifying cybersecurity threats

A method for identifying one or more cybersecurity threats, the method comprising:

• obtaining targeted data from at least one client computer using a self-executable file;
• encrypting the targeted data;
• receiving the encrypted targeted data;
• decrypting the encrypted targeted data;
• processing the decrypted data;
• and
• generating one or more reports based on the processing wherein results from the processing are normalized for consistency.

A computer-implemented system for automatic collection, analysis and reporting of a cybersecurity event, the system comprising:

• a memory;
• and
• a computer processor that is programmed to:
• provide a graphical user interface through which an executable can be configured and automatically generated, wherein the graphical user interface is designed to receive artifact options and data source designations;
• transmit the executable to a client to enable execution of the executable on one or more systems of the client to automatically collect forensic data;
• receive from the client an encrypted data package, wherein the encrypted data package includes the forensic data automatically collected by the executable;
• decrypt the encrypted data package to produce decrypted forensic data;
• use a forensic toolset to automatically analyze the decrypted forensic data, wherein the forensic toolset comprises a set of forensic tools that output analysis results;
• present through the graphical user interface an option to select one or more of at least two types of output reports, wherein the output reports are designed for different types of readers at the client;
• receive from the client a selection of one or more of the at least two types of output reports;
• input the analysis results into an automatic report generator to automatically generate the types of output reports selected by the client;
• and
• electronically transmit the output reports selected by the client to the client.