The Future of Forensics

Forensics has always a highly specialised sport - skilled analysts working by hand to piece together what happened from what was left behind. That's what makes it powerful. It's also what makes it slow and expensive, and something you only do after the damage is done. This session looks at what happens when new technology is applied to that craft. The goal isn't to replace the analysts judgement. It's to take on the hours of work underneath it. Once an investigation takes minutes instead of days, forensics stops being something you call in after a breach. It becomes something you can run every day, and something that starts on its own the moment an attacker shows themselves.