Remote working powered much of the global economy during the recent pandemic lockdowns. Now, this emergency measure has become a permanent practice for many organizations. As work returns to normal, many businesses are offering more flexible work patterns, ranging from full flexibility to work weeks divided between home and office—great news for employees, but a massive security and compliance headache for IT security and compliance teams.

To stay productive, remote employees have been using any means possible to access internal data assets via whatever approved or unapproved devices they have on hand and frequently on connections outside the corporate VPN or secure network. 

Innovative? Yes. Productive? Certainly. 

But we hear loud and clear from clients that this has created a data nightmare for incident response, compliance and investigations teams.

Larger global customers are now collecting data on a daily basis from more than 20,000 endpoints. This is more than 100 collections per day in some cases: ten times more than in pre-COVID days. In the murkier world of crime detection, investigators face a growing data mountain because crucial digital evidence is now stored on countless devices.

The big three headaches

Data diversity is a significant challenge for today’s forensic investigation teams. Whether in business or crime prevention, investigators have to deal with mobile phones, tablets, computers, laptops, cameras, gadgets, recording devices and more. 

Every operating system - Windows, Macs, Androids, Linux, Symbian and more - have underlying differences that can expose, conceal or remove potential evidentiary data. Clients have told us time and again that a primary need is for a single digital forensics platform that can collate all data types and prepare the results for review. 

We also hear that staffing constraints are an ongoing issue. Another critical requirement, therefore, is for solutions that are self-explanatory even for non-technical users. By allowing all employees to quickly become effective users, this not only improves efficiency but also reduces the cost of using forensic technologies. 

Furthermore, scalability jostles for first place as a critical concern alongside data diversity and staffing shortages. Few digital forensic technologies can be scaled to efficiently collect and ready the crushing volumes of data that face them daily. Investigators, as a result, constantly struggle to manage the backlog of collections and investigations. This raises significant questions about how organizations’ infrastructure is managed and how it can be scaled. This is an area crying out for innovation.

Relevant data, faster

A successful investigation is all about finding and substantiating relevant evidence as quickly as possible. While forensic tools are potent weapons in the cyber world, on their own, they’re not enough to overcome the challenge of data sets growing in complexity and volume.

Uncovering the correct data is a challenge of staggering proportions. When you have hundreds of thousands of video images to look at, but you are only hunting for those with guns, or you’re seeking out suspicious data patterns from terabytes of data, it goes beyond trying to find a needle in a haystack: this is much more like hunting for individual atoms in a planet.

Without technology assistance, it is beyond ordinary human capabilities to examine so much data and find the results in a timely fashion. Artificial intelligence (AI) provides a solution by slashing investigators’ time to pinpoint relevant data. AI complements both the human effort and the contribution of other technologies by rapidly identifying the precise data that is being sought. Moreover, AI has a crucial role in reducing or stopping cyber attacks and other crimes: uncovering anomalies, shutting down fraud, or finding the evidence that will bring criminals to justice. Essentially, AI solves three significant challenges – scalability, staffing and data diversity - for overstretched forensic laboratories. Not only does it enhance the speed and effectiveness of forensic investigations even among terabytes of surrounding information, but it also learns and improves from a continual analysis of the process and behaviors of investigations.

One of the key defenses against digital crime – for example, phishing, mobile phone fraud, ransomware, or identity theft - is the ability to catch and halt anomalous activity as early as possible. Most of us have probably had calls from our credit card providers asking us if we really bought a soda from a gas station in another state, followed by a business class flight to Bangkok. This is AI in action. By identifying unusual data patterns, AI allows organizations to rapidly shut down possible crimes and provide early alerts to affected individuals. 

AI can continually scale its learnings by analyzing vectors of compromise - the data behaviors and patterns of digital attacks – which allows an organization to leverage the findings from a single incident or department to enhance its entire cyber defense strategy. 

Investigating in 4D

For the foreseeable future, AI technology is set to play a central role in the future of forensic investigations for more reasons than speed or ability to learn. AI can provide holistic, 360-degree views of any investigation by looking at different data platforms and synchronizing with other solutions to provide a better overview of all available data. Importantly, this allows investigators to give contextually defined responses based on the more informed suggestions of the AI technology. Future iterations of AI will provide a 4D view of data to provide forensic investigators far more efficiency and power. For example, we are currently working on enhancements that will help replicate investigators’ behavior so that the technology can learn more nuances about how murder investigations are conducted, bringing even more effectiveness to the process.

The unique thing about forensic investigations is that they are all different. You could solve 100 murder cases or stop twice as many cyberattacks, but there is no formula: each one is unique. The only certainty is that digital attacks, crimes, vulnerabilities and incidents will continue to evolve. AI helps investigators evolve by learning from each investigation – just as investigators do – and complementing organizations’ efforts to build and evolve their workflows and models in the right direction. It all feeds into helping investigators determine what might otherwise be missed or take too long to uncover. 

As a result, AI is helping relieve the stress on overstretched investigations teams, which is another crucial benefit. We are currently working with more than 300 organizations to support their forensic laboratories’ efforts, and all of them tell us what a boon – and what a stress reliever –technology is when it gets three things right: stability, scalability and collection processing speed.

In closing, AI’s capabilities allow providers like us to build innovative solutions that support investigative teams and improve the value of their existing tools. While AI is not the only technology required for forensic investigations, it enhances and supports human and technology resources to provide exponential improvements in speed and intuitiveness of response.