AI Agent for Security Investigation
An investigation is won or lost on the timeline. This agent pulls evidence from endpoint, identity, network and application sources onto one clock, establishes what is in scope, and is explicit about the intervals where no evidence exists rather than narrating across them.
What is an AI security investigation agent?
An AI security investigation agent is a governed software worker that constructs security investigations from correlated evidence. It resolves entities across endpoint, identity, network and application sources, normalises timestamps onto one clock, enumerates the affected accounts and assets, and marks the intervals where no evidence exists rather than inferring across them.
What it does
What it is not
Six consoles, six clocks, one question
Establishing what happened means reading endpoint, identity, network and application evidence that use different identifiers, different timestamp conventions and different retention windows. Most of an investigation is spent assembling that into one sequence, and the assembly is where errors enter and stay.
Identifiers do not match
The same activity appears as a hostname, a device identifier and an address, and joining them is manual and error-prone.
Time zones and skew corrupt order
Two logs place the same event twenty minutes apart, and the resulting sequence implies a causal order that never happened.
Absence is read as evidence
Nothing appears in a log for an interval, and that is taken to mean nothing happened rather than that nothing was recorded.
Scope is established last
The question of which other accounts and hosts were involved is answered at the end, when containment decisions were needed at the start.
One timeline, every entry attributable
Correlation
Resolve The Identifiers, Then The Clock
Before anything is sequenced.
Hostnames, device identifiers, account names and addresses are resolved to the same entities, timestamps are normalised to one zone with known skew corrected, and only then are events placed in order.
- Entity resolution across all sources
- Timestamps normalised to one zone
- Known clock skew corrected explicitly
- Ordering stated as uncertain when it is
Entities and time
Scope
What Else Was Touched
Established early, not last.
From the initial evidence the agent expands outward along shared accounts, hosts, sessions and destinations to enumerate the accounts and assets plausibly involved, which is the input a containment decision actually needs.
Accounts and assets
Honesty
Where There Is No Evidence
Marked, not narrated over.
Intervals with no telemetry, sources beyond their retention window and activity that would not have been logged at all are marked as evidential gaps, because an investigation that hides its blind spots produces false confidence about scope.
Not filled in
How the AI Security Investigation Agent runs a task
- STEP 01
Fix the starting evidence
The escalated signal is taken as the anchor and its supporting artefacts are captured with their original source records preserved, because an investigation whose starting evidence was paraphrased cannot be re-examined later.
Artefact captureSource preservation - STEP 02
Resolve entities and time
Hostnames, device identifiers, accounts, sessions and addresses are reconciled to the same underlying entities, and timestamps are converted to a single zone with known source skew corrected before any ordering is attempted.
Entity resolutionTime normalisation - STEP 03
Expand the scope
From the anchor the investigation widens along shared sessions, accounts, hosts and destinations to enumerate what else was plausibly involved, which is the question containment depends on and is usually answered too late.
Scope expansionSession tracing - STEP 04
Build the sequence
Events are placed on one clock with each entry naming the log and record it came from, and where two events cannot be reliably ordered that uncertainty is stated rather than resolved by placing one first.
Timeline assemblySource attribution - STEP 05
State the gaps
Intervals with no telemetry, sources already past retention and activity that would never have been logged are recorded as gaps, so a decision about scope is made in full knowledge of what the evidence cannot show.
Gap identificationRetention check
Systems the AI Security Investigation Agent connects to
Evidence sources
Correlation
Inputs, outputs and runtime
- Ingests
- Escalated alert or artefactEndpoint and identity telemetryNetwork flow recordsApplication and email logsRetention configuration
- Produces
- Sourced incident timelineAffected scope enumerationSupported findingsEvidential gap listUncertain ordering notes
- Triggered by
- Escalation from triageSuspected account compromiseRegulatory enquiry
- Human oversight
- The incident owner decides every action
- Models
- Open-weight LLMs you host — Llama, Qwen or Mistral class
- Typical latency
- Hours for a multi-source investigation
- Deployment
- On-premise or sovereign cloud with egress control
- Data residency
- Evidence is examined where it is stored
Where the Security Investigation Agent pays back
Escalated Alert Investigation
Take an escalated signal and establish what actually happened around it across every available source.
Account Compromise Scoping
Enumerate everything a suspected compromised account accessed and where the session activity originated.
Phishing Campaign Analysis
Establish who received a message, who acted on it, and what followed on each of those endpoints.
Lateral Movement Tracing
Follow authentication and network evidence between hosts to establish the path and where it stopped.
Regulatory Notification Support
Produce the sourced factual timeline and scope that a notification decision has to be based on.
Telemetry Gap Reporting
Report where the investigation was blocked by missing logging, which is a detection engineering backlog.
AI Security Investigation Agent vs chatbots and SaaS copilots
Investigations go wrong at the join, not at the analysis: two logs with mismatched identifiers and a twenty-minute clock difference will produce a coherent and entirely fictional sequence of events.
| Generic chatbot | SaaS copilot | VDF AI | |
|---|---|---|---|
| Entity joining | Manual | Within one product | Resolved across all sources |
| Time handling | As pasted | Per tool | Normalised with skew corrected |
| Source attribution | None | Partial | Every entry names its record |
| Missing evidence | Narrated over | Invisible | Marked as an evidential gap |
| Scope | Not attempted | Manual | Enumerated early for containment |
| Takes action | Suggests freely | May execute | Never — the owner acts |
| Where evidence is read | Pasted to vendor | Vendor cloud | Inside your own environment |
Governance and controls
An investigation record can end up in front of a regulator, an insurer or a court, so the standard it has to meet is not persuasiveness but attributability: every statement traceable to a preserved source.
Original records preserved
Evidence is cited, never paraphrased away
No containment actions
Isolation and blocking stay with people
Gaps recorded explicitly
Absent evidence is stated as absent
No actor attribution
The agent does not name a threat actor
Case access restricted
Visibility limited to the case team
Notification stays human
Disclosure decisions involve counsel
Evidence it leaves behind
What changes after rollout
Who runs the AI Security Investigation Agent
Incident responder
Starts from a normalised timeline with the identifier reconciliation already done, which removes the part of the work where a twenty-minute clock difference silently reverses the order of two events.
Head of security operations
Gets scope enumerated early enough to inform containment rather than as the conclusion of the investigation, and a standing record of where missing telemetry blocked the work.
Data protection officer
Receives a factual account with each assertion traceable to a preserved record and the evidential gaps stated, which is the basis a notification assessment has to be made on.
Questions about the AI Security Investigation Agent
What is an AI security investigation agent?
It is an agent that builds security investigations from evidence: resolving identifiers across endpoint, identity, network and application sources, normalising timestamps, sequencing events onto one clock, enumerating affected scope, and marking intervals where no evidence exists.
How is an AI security investigation agent different from a generic chatbot?
A chatbot can describe attack techniques in general. This agent correlates your own logs into a specific sequence and attributes every entry to the source record it was read from.
Can an AI security investigation agent run on-premise on security evidence data?
Yes. Investigation evidence contains account names, internal addresses, message content and the precise extent of your visibility, which must remain within the environment it describes.
What does an AI security investigation agent produce, and in what format?
A sourced timeline with entities resolved and time normalised, an enumerated affected scope, the findings the evidence supports, and an explicit list of evidential gaps and uncertain orderings.
Where does an AI security investigation agent fit in a governed AI programme?
It establishes facts; people decide what follows. Containment, eradication, notification and any statement about cause remain with the incident owner and, where relevant, legal counsel.
How is this different from the IT incident response agent?
They handle different kinds of incident and optimise for different things. The IT agent coordinates a service outage where the objective is restoration, so speed of recovery dominates. This agent works a suspected compromise where evidence preservation, scope and defensibility dominate, and where restoring a host too quickly can destroy the evidence needed later. When an outage turns out to be an intrusion, the handover to this agent is explicit.
Will it attribute an incident to a particular threat actor?
No. It reports the techniques observed and can note where they resemble publicly documented patterns, but naming an actor is an inference that goes well beyond what internal telemetry supports and carries consequences for insurance, disclosure and sometimes diplomacy. Where a resemblance exists it is reported as a resemblance with its source, not as an identification.
What does it do when logs have already been rotated out?
It records the retention boundary as an evidential gap and states which questions therefore cannot be answered. That is a genuinely useful output: an investigation that reports being unable to establish activity before a certain date is more defensible than one that reaches a confident conclusion about a period for which no evidence exists. Those boundaries also form the retention case for the next budget cycle.
Can it decide whether a breach is notifiable?
No. It establishes the facts the assessment needs — what data was accessible, which records were involved, over what period, with what confidence — and the notification decision is made by the people accountable for it, normally with legal counsel. That decision turns on legal tests and risk judgement rather than on the evidence alone, and the record shows who made it.
Does it preserve evidence to a forensic standard?
It works from your existing logging and preserves references to the original records rather than performing forensic acquisition of disks or memory. Where an investigation needs that standard, the agent identifies which systems should be acquired and does not overwrite or disturb them. The timeline it produces is designed to be checkable against the sources, which is the property that matters when the record is later scrutinised.
Build the timeline before the questions arrive
See the AI Security Investigation Agent correlate evidence into one sourced sequence.