According to one court, cyber incident forensic reports may lose work product protection if not created "because of" anticipated litigation and disclosed beyond the legal team. If other courts follow, the opinion may impact reports and investigations outside of cybersecurity such as regulatory compliance and HR matters.