"AI can accelerate investigative work, but the human examiner remains the final authority at every phase," Heather Barnhart, SANS VP of Curriculum, writes — and that principle drives two new SANS frameworks released this year.
Validation starts at the source file
Barnhart argues that an AI finding is only as usable as the examiner's ability to verify it. A tool that fails to show its reasoning is, by definition, unreliable regardless of the confidence score it attaches to its output. Where a model cites a concrete file — for example, asserting that browser history came from Chrome's database — an examiner at least has a starting point for independent confirmation. Absent a named source and traceable reasoning, examiners risk treating a detector's label as the final finding; Barnhart likens this to "a third grader insisting the homework is finished," meaning confidence alone does not equal correctness.
Documenting tools and exact model versions
The record of what produced a finding matters as much as the verification itself. Barnhart notes that many examiners claim not to use AI even while machine learning has long been embedded in forensic products for skin detection, facial similarity, and image categorization — producing confidence scores in the tools they already rely on. When AI is built into a forensic product, naming the tool can be sufficient because opposing experts can research the integration. For a general-purpose model, however, the exact version must be on record. Version history matters: Barnhart recounts a case where a helpful tool didn't exist at the time of data collection, and by the time she testified two years later the technology had advanced — a gap opposing counsel could exploit without a clear record of capabilities at collection time.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildSeparate policies for Digital Forensics and Incident Response
Barnhart explains why one AI policy cannot serve both disciplines. Digital forensics and incident response carry different risk tolerances: incident response deliberately accepts faster, broader actions to determine "what happened" quickly, while forensic examiners are held to validation of each source file and thus expect AI to add, not subtract, work. SANS created two separate frameworks mapped to established standards — the Digital Forensics & AI Investigations Framework aligned to the Scientific Working Group on Digital Evidence (SWGDE) standards, and the Incident Response & AI Investigations Framework mapped to the NIST Cybersecurity Framework 2.0 — to reflect those differing operational needs.
Actions that cannot be undone: the practitioner's responsibility
The single, recurring constraint in both frameworks is that AI must never take an irreversible action. Barnhart points to evidence collection as the clearest example: a flawed acquisition forecloses later analysis, no matter how skilled subsequent analysts are. Some tasks, like hash verification, can be safely automated; others — choosing how to pull cloud data, how to approach a scene, or how to deploy tools that capture lateral movement — cannot because they cannot be unwound. The same logic applies to legal authority: AI may flag that a subject has a linked cloud account, but allowing AI to collect that data autonomously crosses a boundary an examiner cannot undo, and some forensic tools can cross that line if misconfigured.
What this means for forensic examiners, incident responders, and organizational leadership
- Forensic examiners: maintain foundational skills and insist on provenance. Barnhart stresses knowing "where artifacts live before a tool tells you," understanding sound acquisition, and recognizing wrong answers when models produce them.
- Incident responders: use validated tooling with a human in the loop. If a team has built and validated the AI recommending containment or triage, a monitored, intervening human can avoid the bottleneck of sign-off on every action during a live incident.
- Organizational leadership and procurement: assess operator risk honestly. An inexperienced person using AI is "the landmine," Barnhart warns; leaders must weigh who will run the tools and fund the training necessary to keep the practice defensible.
Barnhart closes by framing these frameworks as living documents that work only if practitioners keep current and build the requisite skills. SANS points to training such as FOR498: Digital Acquisition and Rapid Triage, FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics, and FOR608: Enterprise-Class Incident Response & Threat Hunting to build that foundation, and invites practitioners to SANS Cyber Defense Initiative 2026 in December to attend FOR508 taught by Carlos Cajigas.
In short: confidence metrics from AI are not a substitute for traceable evidence, documented tooling, or practitioner judgment — and without those elements, an automated finding is brittle in court and in operations.
