Sep 8, 2026 · 36 min
AI expands cyber investigations while evidence sets the limits
Worming its way through WeChat.
As AI accelerates attribution and credential-theft analysis, investigators must preserve human judgment and verifiable evidence.
- 1AI can connect identity, domain, and campaign intelligence across disparate sources, expanding investigators’ reach.
- 2Prompt-driven workflows turn investigative tradecraft into scalable identity reports while reducing the training burden for analysts.
- 3Surprising AI-generated connections remain hypotheses until reused infrastructure, certificates, domains, or favicons provide verifiable support.
Don't miss
Jason Lancaster explains how prompt-driven workflows can scale investigative tradecraft while keeping conclusions tied to verifiable evidence.
The brief
AI is changing cyber investigations from a specialist craft into a more scalable workflow, but the central question is whether speed can coexist with defensible conclusions.
Jason Lancaster of SpyCloud describes using AI to correlate identity, domain, and campaign intelligence, helping investigators connect infrastructure and attribute activity across scattered data.
The episode’s core tension is judgment: language models can surface surprising relationships, but investigators still need verifiable clues such as reused favicons, certificates, domains, and campaign infrastructure.
SpyCloud has translated investigative methods traditionally embedded in software into prompt-driven workflows that generate identity reports and let analysts focus on higher-value analysis.
The result is a lower training burden and broader access to specialized investigative capabilities, without treating AI’s output as a substitute for human review or evidence.