TRACE Team Biographies

Steve Sandford

Partner, Digital Forensics and Incident Response

steves@cyxcel.com

020 7227 6657

Steve serves as CyXcel’s Partner of Digital Forensics & Incident Response, bringing nearly two decades of experience responding to and advising on complex cyber incidents and forensic investigations across multiple jurisdictions. 

He leads CyXcel’s global response operations, supporting clients through ransomware attacks, business email compromise, and large-scale data breaches. Steve provides strategic guidance throughout the incident lifecycle, aligning technical, legal, and insurance considerations to ensure effective, coordinated outcomes. 

With deep expertise in digital forensics, investigative methodology and threat intelligence, Steve helps organisations manage fast-moving investigations whilst protecting critical business interests. His work includes investigating threat actor activity, assessing data exposure, and identifying attack vectors to support informed response and recovery decisions 

He regularly advises on ransom negotiation strategies, payment considerations, and associated legal and regulatory implications by working closely with legal counsel, insurers, and breach response teams. 

Steve also has experience working in close partnership with technology providers to deliver integrated response strategies that minimise disruption and support long-term resilience. His approach is grounded in clear communication, operational precision, and a deep understanding of cyber risk in real-world business context. 

Prior to joining CyXcel, Steve held a leadership role at Ankura Consulting, where he built and led cyber response teams. He is recognised for his calm, pragmatic approach and his ability to translate technical complexity into practical decisions during high-stakes incidents. 

Danny Howett

Technical Director, Digital Forensics and Incident Response

dannyh@cyxcel.com

020 7227 6672

Danny Howett is Technical Director at CyXcel, where he leads the organisations Threat Intelligence and Incident Response capabilities. With 15+ years of experience spanning law enforcement and consultancy, he has developed a deep understanding of the cyber threat landscape, particularly in relation to threat actor tactics, techniques and procedures, as well as emerging risks. 

Danny specialises in dark web threat intelligence, with extensive experience tracking threat actors, analysing their methods and motivations, and translating that intelligence into actionable insights for clients. His work has enabled numerous organisations to proactively strengthen their defences, identify vulnerabilities, and prevent breaches before they occur. 

Prior to joining CyXcel, Danny worked in both Consultancy and Law Enforcement roles, most recently as a Director at Ankura, where he led complex investigations into incidents such as ransomware attacks, data breaches, and insider threats. He worked closely with legal teams, insurers, and senior leadership teams to manage incident response and provide clear, defensible reporting.  

A core part of Danny’s expertise involves direct engagement with threat actors across open and closed forums, including ransomware groups and criminal marketplaces. This work has supported both proactive intelligence gathering and active incident response, allowing clients to verify claims, assess credibility, and gain early insight into threat activity. He has supported negotiations, validated data leaks, and provided context to help organisations make informed decisions under pressure. 

Danny also spent 13 years in law enforcement as a Detective, investigating Cyber Crime and supporting the investigation of including cross-border criminality and covert dark web operations through forensic investigation of digital devices. This work laid the foundation for his detailed understanding of threat actor behaviour and the technical and legal complexities involved in cyber investigations. 

Danny takes a methodical and pragmatic approach to intelligence and response. He regularly engages with clients in high-pressure situations, offering calm, strategic guidance across technical and legal domains. He also contributes to industry discussions on cyber risk, threat actor behaviour, and response readiness. 

Brent Riley

Vice President of Digital Forensics and Incident Response (North America)

brentr@cyxcel.com

+1-855-490-495

Brent specializes in incident response, digital forensics, and cybersecurity with 12 years of law enforcement and over 15 years of digital forensics and cybercrime investigatory experience.  He currently serves at the Vice President of Digital Forensics and Incident Response for CyXcel North America.  Prior to joining CyXcel, Brent co-founded Lyra Recovery, an incident response recovery firm, was a Special Agent with the Ohio Bureau of Criminal Investigation’s cybercrimes unit, and a cybercrimes detective with the Spotsylvania County Sheriff’s Office in Virginia.

Brent holds a Master's Degree in Forensic Computing and Cybercrime Investigation from University College Dublin in Ireland and is also a GIAC Certified Forensic Analyst and a GIAC Certified Incident Handler.