Source: https://calcyber.net/ai-forensics.html

Sacramento-based, serving California.

# Investigate the incident. Understand the agent.

When an AI system is involved in a security incident, the usual questions still matter. What happened? What was accessed? What needs to change? Getting the answers means understanding the agent, too.

CalCyber provides specialist forensic investigations for incidents involving AI agents, LLM applications, and the tools and data they connect to.

[Discuss an Investigation](https://calcyber.net/#contact)

[Explore the Service →](https://calcyber.net/ai-forensics.html#investigations)

## When AI is part of what happened.

An agent can be compromised, misused, or used against your organization. We investigate its role in the incident alongside the systems, identities, and people involved.

### Your agent did something unexpected.

Investigate suspected prompt injection, unauthorized actions, sensitive data exposure, and misuse of connected tools or accounts.

### A vendor's AI touched your environment.

Establish what can be determined from your environment and work with the provider to clarify activity, access, and evidence gaps.

### You suspect an attacker used AI.

Assess the evidence for AI involvement and its contribution to the incident, with clear limits on what the available records support.

## From an AI incident to an evidence-based account.

### What happened

A documented account of the incident, the agent's role, and the activity the available evidence supports.

### What was affected

Findings on affected systems, identities, tools, and data, with scope and uncertainty made explicit.

### What to change

Practical recovery and control recommendations tied to the findings of your investigation.

### What you can explain

Clear reporting for technical teams and leadership, including supporting evidence, confidence, and investigation limits.

Suspected AI involvement is a question to investigate. Our conclusions distinguish observed activity from inference and identify what remains unknown.

## Make your AI systems ready for investigation.

Already deploying agents or LLM applications? CalCyber can review forensic readiness: whether your logging, access arrangements, and vendor relationships will support an investigation when something goes wrong.

[Discuss Forensic Readiness →](https://calcyber.net/#contact)

## Need broader incident support?

Our Sacramento-based team also serves California organizations with ransomware, business email compromise, breach and employee misconduct investigations, and expert witness services.

[Explore Digital Forensics & Incident Response →](https://calcyber.net/digital-forensics-incident-response.html)

## AI involved? Start with the evidence.

Tell us what happened and which systems are involved. We'll discuss the scope of an investigation or a readiness review with your team.

[Discuss Your Situation](https://calcyber.net/#contact)