Questions of privilege and work-product protection routinely arise in post-breach litigation, especially concerning forensic consultants’ analyses. Plaintiffs target these materials in discovery because they often provide a roadmap to the attack and include details regarding the victim business’s defenses and internal steps taken in response to a breach. Since these issues began to surface in post-breach litigation, courts have grappled with them and reached varying results. In this guest article, Patterson Belknap partner Alejandro H. Cruz and associate Elana M. Stern analyzed the case law and offered five themes that have emerged along with best practices that may help maximize the protection afforded to post-breach forensic analyses in follow-on litigation.