AI in Incident Response: How I Use It During Real Investigations

The 30-second explanation

During an incident, AI can act like a fast junior analyst: it reads everything at once and hands back a first draft. The catch is that it can sound completely sure of itself and still be wrong, so every draft gets checked against the actual evidence before it goes anywhere.

How it works

1. 1

   1. Evidence

   Collect logs and artefacts.

2. 2

   2. Assist

   AI drafts a first summary or a query to run.

3. 3

   3. Verify

   The analyst checks it against the source.

4. 4

   4. Decide

   A human approves the response.

During a ransomware incident, analysts are buried in alerts, logs, screenshots and messages, and every hour spent without a clear picture costs something. An AI assistant can help by summarising long text, suggesting what to check next, and turning scattered notes into a working timeline, which frees the analyst up for the judgement calls a machine can't make. It has real limits too. It can invent a detail that sounds entirely plausible, so it should never be treated as the final word, and sensitive incident data should only ever go into tools the organisation has actually approved.

Real-world example

How to spot it

• Claims without a source

  Output that states a fact without pointing to the evidence it came from.

• Data leaving approved tools

  Sensitive logs pasted into a service the organisation hasn't approved.

• Untrusted content in the prompt

  Text from logs or files that could contain hidden instructions.

• Actions without sign-off

  A consequential step, like isolating a host, taken without human approval.

What to do

1. 1Treat every AI-drafted conclusion as a hypothesis to check, never as a finished finding.
2. 2Only use tools your organisation has approved for handling incident data.
3. 3Keep a human in the loop for any action with real consequences.