Research,
engineering,
and what we're learning.

The 200‑hour engagement is a billing artifact. Not a methodology.

The standard DFIR engagement bills 200 to 400 analyst hours not because that is how long the investigation takes, but because that is how long the firm needs to amortize a senior analyst's payroll across enough billable cases. The methodology was reverse‑engineered from the cost structure, then dressed up as rigor.

Strip the analyst out of the critical path and the math collapses. Most of those hours are queue time, ticket triage, manual artifact parsing, and re‑writing the same executive summary for the seventh insurer this quarter. None of that is forensic work. It is the human tax on a 2011 operating model that the industry has spent fifteen years pretending is a craft.

The honest version is shorter. A real investigation has roughly the same number of decisions in it whether the case file is a phishing payload or a domain‑wide ransomware event — what changes is the volume of evidence the responder has to carry through those decisions. Carry it with software and the engagement closes in days, at a price that lets a 200‑endpoint clinic actually afford an answer instead of a retainer they will never use.

Anti‑hallucination is not a prompt problem. It is an architecture problem.

Most of the "AI in security" discourse treats model hallucination as a prompting failure — better instructions, better grounding, better retrieval, and the model will stop making things up. It will not. A language model will always produce plausible text faster than it can verify the underlying claim. That is the job. Asking the same model to be both author and auditor is asking the witness to grade their own deposition.

Forensic findings have to survive a different standard. A Daubert challenge does not care how confident the model sounded. It cares whether the claim is anchored to a specific artifact, whether the artifact's integrity can be independently verified, and whether the methodology that produced the claim is reproducible. None of those properties live inside a prompt. They live in the architecture surrounding the model — in a separate validator that re‑grounds every claim against raw evidence, in hash‑anchored provenance on every reference, in a system that drops unverifiable claims rather than softening them into hedged language.

The DFIR firms experimenting with LLM‑assisted reporting are going to learn this in front of opposing counsel before they learn it in a design review. The market is going to bifurcate quickly between systems that produce findings and systems that produce admissible findings. The architectural decisions that separate those two categories are being made right now, by people who will not be able to retrofit them later.

The gap between attacker tempo and responder tempo is the real threat surface.

Adversaries crossed the machine‑speed line two years ago. Initial access brokers are running automated reconnaissance at a cadence that would have required a team in 2022. Phishing copy is being generated and personalized by the same models defenders are still arguing about deploying. Ransomware affiliates have playbooks that fire end‑to‑end without a human at the keyboard for stretches measured in minutes, not hours.

The response side has not moved. The intake queue at the average panel DFIR vendor is still measured in business days. The kickoff call still happens on Tuesday for a breach that hit on Friday. The first analyst still touches evidence on day four of an incident where the attacker was finished by hour three. Every one of those gaps is dwell time the regulator, the insurer, and the attacker all get to use against the victim before the responder shows up.

That gap — not the malware, not the unpatched VPN, not the misconfigured S3 bucket — is the actual threat surface no one is pricing. The next decade of incident response is going to be defined by which providers close it and which providers pretend it does not exist. The math is not subtle: a responder operating in days against an attacker operating in minutes is not a slower competitor. It is a different category of service entirely.