Where AI Actually Helps in DFIR and Where It Still Lies to You

Artificial intelligence is now appearing in both sides of modern incidents: from adversary tradecraft attributed to state-backed actors experimenting with AI-assisted operations, to responder tooling embedded directly into investigation workflows.

This session aims to examine where AI is genuinely adding value in DFIR today, including triage assistance, query generation, and analyst acceleration in platforms such as the AI-enabled SANS SIFT Workstation. We’ll contrast those gains with areas where AI remains unreliable, misleading, or actively dangerous if trusted without verification.