Da Vinci Forensics & Cybersecurity investigates fraud, cybercrime and security incidents for Johannesburg businesses, law firms and private clients. We are headquartered in Cape Town and deliver most engagements for Gauteng clients remotely, with on-site attendance arranged for evidence collection, incident response and board or legal proceedings that require us in the room.
We are upfront about that model because it works in your favour. Penetration testing, dark web monitoring, OSINT investigations and most forensic analysis are location-independent, which means Johannesburg clients get the same certified investigators without travel costs built into the invoice.
Johannesburg’s threat landscape is the toughest in the country
As South Africa’s commercial capital, Johannesburg carries the highest concentration of the crimes we investigate. Corporates and mid-sized firms in Gauteng face business email compromise and payroll redirection fraud at a scale the rest of the country does not, driven by the sheer volume of high-value payment instructions moving through Sandton, Rosebank and the mining and logistics corridors every day.
The matters Gauteng clients bring to us most often include invoice and supplier payment fraud, insider threats and employee data theft, ransomware against manufacturing and logistics operations, investment and cryptocurrency fraud, and impersonation schemes where criminals clone a legitimate company’s identity to defraud its customers. Under the Cybercrimes Act 19 of 2020 these are prosecutable offences, but successful prosecution and civil recovery both depend on evidence being preserved correctly from day one. That is where we come in.
Fraud and forensic investigations for Gauteng businesses
Investigation work is the core of what Johannesburg clients hire us for. Our practice covers:
- Corporate fraud investigation: tracing invoice redirection, procurement fraud and payment diversion through email header forensics, banking timelines and domain analysis.
- Employee misconduct forensics: forensically sound imaging and analysis of company devices and accounts in disciplinary and civil matters, with chain of custody intact.
- Cryptocurrency tracing: on-chain analysis of stolen or misappropriated funds across wallets, exchanges and mixers, packaged for recovery proceedings.
- Litigation support: exhibit-ready chronological evidence bundles and expert witness testimony for matters before the Gauteng Division courts.
Our investigators hold recognised certifications including Certified CyberCrime Investigator (CCCI), and our reports are prepared for admissibility in South African courts.
Cybersecurity services delivered remotely to Johannesburg
Prevention work needs no flights. We deliver the following to Gauteng clients entirely remotely:
- Penetration testing of networks, web applications and cloud environments, with prioritised findings and board-ready reporting.
- Digital threat monitoring: ongoing dark web scanning, brand impersonation detection and attack surface monitoring on a monthly subscription.
- Phishing simulation and awareness testing for staff.
- Governance, risk and compliance advisory: POPIA alignment, board-level cyber reporting and AI security and governance frameworks.
Because there is no travel component, remote engagements are quoted on scope alone. You are not paying for anyone’s plane ticket.
How engagement works from anywhere in Gauteng
Every engagement starts with a confidential scoping call, followed by a written proposal with pricing before any work begins. For forensic matters that require device imaging, we use a documented secure courier procedure with chain of custody maintained end to end, or we attend on site in Johannesburg for collection where the matter warrants it. Urgent incidents, such as funds transferred this morning or an executive account hijacked today, are prioritised for same-day first response: evidence preservation, containment guidance and initial triage.
Frequently asked questions — Johannesburg
Q1. Do you have an office in Johannesburg? No. We are headquartered in Cape Town and serve Johannesburg through remote delivery and scheduled on-site attendance. Most of our services are location-independent, and we attend in person for evidence collection, incident response and court matters. We do however have an investigator in Gauteng.
Q2. Can you image devices without us couriering them to Cape Town? Yes. We can attend on site in Gauteng for forensic imaging, or guide a supervised collection using our documented procedure. Where courier transfer is used, chain of custody is maintained and documented end to end.
Q3. Do you testify in Gauteng courts? Yes. We provide expert witness testimony and exhibit-ready forensic reports for matters before the Gauteng Division and other South African courts.
Q4. What does a fraud investigation cost? Investigative work is billed hourly at a standard rate, with a written estimate provided after a scoping call. Many matters begin with a fixed-fee preliminary assessment so you know what you are dealing with before committing to a full investigation.
Q5. How quickly can you start? Scoping calls are usually available within one business day. For active incidents, first-response work such as evidence preservation and containment guidance can typically begin the same day.
Talk to a cybercrime investigator about your Johannesburg matter
Confidential, no-obligation scoping call. Describe the incident or the exposure you want tested and we will tell you exactly how we would approach it.
Da Vinci Forensics also serves businesses in Cape Town , Nelspruit and Pretoria.
