4,413 people entered the Find Evil! hackathon to answer a question the rest of the industry has mostly been arguing about in blog posts: can an autonomous agent do real forensic work on real evidence, and prove what it found?
291 submissions came in. 123 reached finalist review. 90 working practitioners logged 1,775 evaluations, and every finalist was re-verified before a winner was named.
In this 30-minute broadcast, Rob T. Lee, Chief AI Officer and Chief of Research at SANS Institute, announces the three winning harnesses and walks through what the judges found when they stress-tested them: read-only evidence mounts, typed tool surfaces with no shell access, and evidence-reference gates that refuse to record any finding the agent cannot tie back to a real artifact.
Judges will describe how they built their own validation approach, because no rubric existed for grading an autonomous forensic investigation. Several wrote their own harnesses to check the harnesses.
All three winning harnesses are open source, and the repositories go public the same day. Live Q&A closes the session.
What you will leave with
- What separates a harness from a model, and which rails the judges treated as non-negotiable for evidence work
- How 90 practitioners built a validation approach for autonomous forensic investigation when no rubric existed
- Where to get all three winning harnesses, and what to check in the accuracy reports before running one on your own evidence
