Most security practitioners know that unfortunately, containing a cyberattack is only the beginning of thorough incident response. An affected organization must still determine which systems may have been compromised, whether sensitive information was stolen and, perhaps most importantly, whether the attackers retain system access.
During a recent SC Media webcast, Exterro Senior Product Marketing Manager Robert Bond and Exterro Technical Solutions Engineer Daniel Gugliotta joined Healthfirst Incident Response Manager Scott Sattler to explain how digital forensics and AI-assisted investigations can establish the full scope of a breach.
Looking beyond the initial alert
The trio walked through a hypothetical case study that began with suspicious PowerShell activity on a workstation. In the scenario, although responders were able to isolate the machine and disable the affected account, subsequent analysis uncovered related activity on another endpoint.
On that second endpoint, the investigators found evidence of script execution, account activity and a scheduled task that could let attackers regain access.
Sattler emphasized the importance of quickly searching the broader environment for indicators of compromise.
"You have to do that hunt as quickly as you can," he said.
His team integrates endpoint detection tools, including CrowdStrike, with an agentic security operations center and Exterro's forensic capabilities to accelerate investigations across multiple systems.
Determining whether data was stolen
The investigation also uncovered an archive on the second workstation containing customer reports, establishing that sensitive information had been staged for exfiltration, but not whether it had actually left the organization.
To be certain, the investigators needed evidence from network traffic, transfer records and other available logs.
The three participants stressed that separating confirmed findings from unanswered questions is key when assessing notification requirements and communicating with customers. They added that digital forensics supports legal and insurance proceedings by preserving evidence, documenting investigative actions and maintaining chain of custody.
Gugliotta explained that forensic evidence provides something beyond ordinary endpoint telemetry.
"The forensic data is going to be what holds up from a chain-of-custody standpoint," he said.
He and Bond point out that Exterro's FTK Central supports endpoint evidence collection, while FTK Connect integrates forensic workflows with security tools. The company's Armor for FTK uses AI-assisted queries to help investigators retrieve relevant artifacts and reconstruct activity.
Finding persistence and preventing reinfection
Attackers frequently establish multiple methods of maintaining access, including scheduled tasks, registry changes and compromised infrastructure. In the case scenario, discovering a suspicious scheduled task required expanding containment and verifying that the mechanism had been removed.
Sattler described previous investigations in which attackers had modified network-device firmware to maintain access even after compromised workstations were cleaned.
"We don't trust anything," he said, explaining why his team wipes and rebuilds affected machines as a policy.
Turning evidence into defensible decisions
AI-assisted forensic workflows can accelerate evidence collection, the three participants said, correlate activity across endpoints, and generate reports tailored to executives, legal counsel and privacy teams.
Sattler said Healthfirst uses AI to translate technical findings into explanations different stakeholders can understand.
"The AI does the work for us, but we go through and validate the data that gets returned," Sattler said. "The worst thing we could do is present something and it was false."
Human verification remains essential. Investigators must validate AI-generated findings and document missing evidence rather than presenting assumptions as facts.
A defensible post-breach investigation ultimately connects technical evidence with business decisions. By establishing what happened, identifying remaining uncertainties and documenting corrective actions, organizations can respond more effectively while protecting customer trust and reducing the likelihood of another compromise.
