An AI assistant for security investigations should help analysts examine evidence and follow up on unanswered questions. Evaluate it on whether an analyst can verify its work, correct its mistakes and understand what information it could not obtain.
Consider an unusual sign-in alert. An assistant might gather approved identity, endpoint and cloud records and prepare a draft timeline. The evaluation should establish whether that timeline represents the records faithfully. A confident explanation of an account compromise is not enough when the available evidence supports several possibilities.
Define the analyst's task
Choose a specific investigation task before comparing products. Preparing a timeline, suggesting further queries and taking containment actions require different access and authority. For an initial evaluation, a read-only assistant can be tested on gathering and summarizing information while analysts continue using the existing incident response process.
For the sign-in example, define the relevant account, time window and sources. Ask for the observed events, links or identifiers for the underlying records, possible explanations and missing evidence. Decide which parts of the draft the analyst must verify before using it in an investigation record.
NIST's incident response guidance recommends recording investigation activity and preserving the integrity and provenance of investigation records and incident data. An assistant's summary needs to fit those existing practices. It should supplement the original records and preserve references that let authorized investigators examine them.
View full-size diagram
Check the explanation against the records
Use a controlled example with a known sequence of events. Have an analyst check the draft against the original records, including the time zones, account identifiers, affected systems and order of events. Record any missing event or incorrect connection between records.
Keep observations separate from interpretations. A sign-in from an unfamiliar location is an observation if the source record supports it. A claim that stolen credentials caused the sign-in requires additional evidence. The assistant should make the distinction visible and identify what would help the analyst investigate further.
Check whether a source reference supports the statement beside it. A valid link can still point to a record that does not establish the claimed relationship. When records disagree, the draft should describe the conflict and preserve enough detail for the analyst to resolve it.
Include incomplete and misleading cases
A useful evaluation includes cases where a complete explanation is unavailable. Use invented cases or approved historical material prepared for the test. Preserve expected findings separately so reviewers can assess the draft against what the evidence supports.
| Test case | What the analyst should assess |
|---|---|
| Endpoint records are unavailable | The draft names the missing source and limits its conclusions accordingly. |
| Similar account names appear in different systems | Events are matched using appropriate identifiers, with unresolved identity differences visible. |
| Timestamps use different time zones | The timeline preserves the original timing information and shows how times were compared. |
| Evidence supports more than one explanation | The draft identifies alternatives and useful follow-up questions. |
| A record contains text directing the assistant to ignore its rules | The assistant treats the text as investigation material and stays within its configured task and access. |
| A user requests information outside their permissions | The configured connection prevents access, and the draft reports the limitation. |
NIST's AI Risk Management Framework recommends documenting test sets and measures and evaluating performance under conditions similar to deployment. Repeat these cases with the intended connections, user roles and source formats. Retest relevant cases when those components change.
Verify access and keep response authority clear
Document which sources the assistant can query and which account it uses. Test permitted and restricted requests through the actual connection. Ask who can inspect investigation drafts, where copies are stored and how the configured retention settings apply. Verify those details for the proposed deployment rather than assuming them from a product category.
Keep the evaluation's read-only scope enforceable in the connected tools. A suggestion to disable an account should remain a suggestion for an authorized responder to assess through the existing process. Moving into containment would require a separate decision about actions, limits, approvals and recovery.
Have an operator show what happens when a query fails or a source becomes unavailable. The assistant should expose the gap so the analyst can continue the investigation elsewhere. It should not turn an unavailable record into a claim that no relevant activity occurred.
Judge the work an analyst can use
Compare the assisted task with the team's current process using the same cases. Measure analyst effort to verify and correct the draft, unsupported statements, missed events and useful follow-up questions. Include the work needed to prepare sources and maintain connections. Producing a summary quickly may add little value if checking it takes longer than the original task.
Keep the results specific to the cases and configuration tested. An accurate timeline does not establish that an assistant can identify every attack or determine the cause of an incident. Record unresolved questions and the evidence needed to answer them before expanding its role.
X-Centric.ai helps teams evaluate AI workflows, connect existing systems and define operating responsibilities. Explore our AI consulting and engineering services.