{"id":13450,"date":"2026-09-29T10:19:05","date_gmt":"2026-09-29T07:19:05","guid":{"rendered":"https:\/\/aboveit.fi\/?p=13450"},"modified":"2026-09-29T14:14:13","modified_gmt":"2026-09-29T11:14:13","slug":"security-incident-investigation-with-ai","status":"publish","type":"post","link":"https:\/\/aboveit.fi\/en\/security-incident-investigation-with-ai\/","title":{"rendered":"Security Incident Investigation with AI: Benefits and Limits"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"13450\" class=\"elementor elementor-13450 elementor-13448\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-d849432 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"d849432\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-e780006\" data-id=\"e780006\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-235968e elementor-widget elementor-widget-text-editor\" data-id=\"235968e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><em>A security incident is rarely investigated by a forensics professional. Most often, it is done by whoever happens to be present. This is exactly where AI helps the most. At Above IT&#8217;s Afterwork on October 8, 2026, we will carry as the central theme &#8220;Do more with less,&#8221; as <\/em><em style=\"font-size: 1rem;\">AI brings efficiency to the daily work of IT management experts. <\/em><em style=\"font-size: 1rem;\">In this blog, Above IT partner and security expert Matias Haapaniemi provides a teaser for the event by discussing the utilization of AI in security forensics.<\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-b131890 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"b131890\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-b5e401a\" data-id=\"b5e401a\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-fd0efa9 elementor-widget elementor-widget-heading\" data-id=\"fd0efa9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Incidents Are Usually Investigated by Someone Other Than an Expert<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-41c671c3 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"41c671c3\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-31b2e6cd\" data-id=\"31b2e6cd\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-403a0dfa elementor-widget elementor-widget-text-editor\" data-id=\"403a0dfa\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>An SME does not have its own SOC. When an account is hijacked on Friday at 4 PM, the investigator is the company&#8217;s own IT manager or the local IT partner&#8217;s on-call technician. They know Windows, networks, and Microsoft 365. However, forensics is not their day job.<\/p><p>The difference compared to an expert is not in intelligence. The difference is in routine. A cybersecurity expert knows which log to look at first and which field is decisive. An IT generalist spends the same amount of time just searching for it.<\/p><p>AI bridges exactly this gap. It does not make anyone an expert. It makes the first hour significantly more productive, and the first hour is usually what determines the extent of the damage.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-96413bc elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"96413bc\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-36bfd6c\" data-id=\"36bfd6c\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-7a4df8b elementor-widget elementor-widget-heading\" data-id=\"7a4df8b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Where Does the Time Go in a Security Incident Investigation?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-ab7e5d4 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"ab7e5d4\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-3035440\" data-id=\"3035440\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-bd3be55 elementor-widget elementor-widget-text-editor\" data-id=\"bd3be55\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Investigating a single hijacked Microsoft 365 account typically involves these four different views:<\/p>\n<ul>\n<li>sign-in logs and their source IPs<\/li>\n<li>mailbox rules and forwarding<\/li>\n<li>application consents and valid tokens<\/li>\n<li>file access and sharing logs<br\/><br\/><\/li>\n<\/ul>\n<p>Each is in a different place and a different format. A week&#8217;s sign-in log for a single user can be thousands of rows, as it also includes background session renewals.<\/p>\n<p>Building a timeline usually fails due to time zones. The Microsoft 365 audit log is in UTC. A workstation&#8217;s event log is in local time. In summer, the difference is three hours; in winter, two. The wrong time zone produces the wrong story of the sequence of events, and wrong decisions are quickly made based on it.<\/p>\n<p>This work is not difficult. It is slow. Slowness is the actual risk in an incident situation.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-914c291 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"914c291\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2f75a73\" data-id=\"2f75a73\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-26d7be6 elementor-widget elementor-widget-heading\" data-id=\"26d7be6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Four Areas Where AI Helps the Most<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-82a3ae1 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"82a3ae1\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-f49419b\" data-id=\"f49419b\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-019244e elementor-widget elementor-widget-text-editor\" data-id=\"019244e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3>1. From Raw Log to Timeline<\/h3>\n<p>Export the log to CSV or JSON format and ask the language model for a timeline. A good prompt is precise: time in UTC, time in Finnish time, source IP, action, and assessment of anomaly. An export of a thousand rows is thus condensed into a few dozen rows that a human has time to read.<\/p>\n<p>The language model also notices repetition that the eye does not. The same IP in eight different events stands out from the table immediately.<\/p>\n<h3>2. Formulating the Right Question<\/h3>\n<p>The hardest part is not the answer. The hardest part is the question. The query language for Defender and Sentinel is powerful, but writing it under pressure is slow.<\/p>\n<p>Describe the situation in your own words and ask for a ready-made query. &#8220;Find successful sign-ins for this user from the last 14 days from outside Finland.&#8221; You get the answer in seconds and can run it directly after verification. The same applies to phishing email header information, base64-encoded commands, and alert names that may mean nothing to a layman.<\/p>\n<h3>3. Order of Initial Actions<\/h3>\n<p>The wrong order destroys evidence. This is where inexperience costs the most.<\/p>\n<p>Two errors we repeatedly encounter:<\/p>\n<ul>\n<li>A password change alone does not terminate an attacker&#8217;s session. Existing tokens must be revoked separately; otherwise, access remains. Malicious OAuth app consent also persists through a password change.<\/li>\n<li>Shutting down a workstation destroys the contents of the memory. The device should be isolated from the network instead, so that evidence is preserved.<br\/><br\/><\/li>\n<\/ul>\n<p>AI can produce an ordered action list based on the situation description. The list is not followed blindly, but it prevents forgetting a step in a hurry.<\/p>\n<h3>4. Reporting and deadlines<\/h3>\n<p>Notification obligations run against the clock. A personal data security breach must be reported to the Data Protection Ombudsman within 72 hours. <a href=\"https:\/\/kyberturvallisuuskeskus.fi\/fi\/toimintamme\/saantely-ja-valvonta\/nis-2-euroopan-unionin-kyberturvallisuusdirektiivi\">For those within the scope of the Cyber Security Act<\/a>, an early warning is 24 hours and the actual notification 72 hours, in addition to which a final report must be submitted within a month. It is worth checking whether your organization falls within the scope of the Cyber Security Act.<\/p>\n<p>AI writes a draft from the findings quickly. It also produces an understandable message to users and management from the same material. In an incident, communication is otherwise always left last, even though it is often the part from which the customer forms their impression.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-cb1006e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"cb1006e\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-825e4cf\" data-id=\"825e4cf\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-2a304ec elementor-widget elementor-widget-heading\" data-id=\"2a304ec\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Four Limits You Should Know in Advance<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-9fb3a84 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"9fb3a84\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-85fd5f1\" data-id=\"85fd5f1\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-7f27ccc elementor-widget__width-initial elementor-widget elementor-widget-text-editor\" data-id=\"7f27ccc\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>A language model might invent fields and commands. It might produce a plausible-looking cmdlet that does not exist. Every command should only be run after it has been checked.<\/p>\n<p>A language model might name the cause too early. It is happy to tell you what happened, even if the data is insufficient. This is the most dangerous single trait in an investigation. Always keep separate what has been established and what is an assumption.<\/p>\n<p>Collecting evidence should always be prioritized over speed. For example, save the content of a malicious mailbox rule before you delete it. Otherwise, you lose information about where the messages were redirected.<\/p>\n<p>Data should not be fed into a publicly available AI model. Logs contain personal data, IP addresses, and sometimes secrets. The language model should therefore preferably be run in your own tenant or a service where the location and use of data are restricted by agreement.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-7b76e3a elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"7b76e3a\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-11ac872\" data-id=\"11ac872\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a3f9e59 elementor-widget elementor-widget-heading\" data-id=\"a3f9e59\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How We Use This<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-c49fc81 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"c49fc81\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-c2c8966\" data-id=\"c2c8966\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-52d90ca elementor-widget elementor-widget-text-editor\" data-id=\"52d90ca\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>We deliver <a href=\"https:\/\/aboveit.fi\/en\/cybersecurity\/\">holistic security<\/a> to our customers, ourselves operating as part of their IT organization. For us, AI is the first reader in an investigation, not the decision-maker. It reads the exports, builds the timeline, and suggests actions. A human checks every claim against the raw log before it becomes a conclusion. The language model is run in our own Azure environment, so customer data does not leave our control.<\/p>\n<p>The practical impact has been measurable on the time axis. An hour of reading work has typically been condensed to about fifteen minutes. The saved time can then be used for what is actually needed: containment and decisions.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-3a40486 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"3a40486\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-bafccff\" data-id=\"bafccff\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-8f265f0 elementor-widget elementor-widget-heading\" data-id=\"8f265f0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Where Should You Start?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-a8ed766 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"a8ed766\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-23ad81c\" data-id=\"23ad81c\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-f5a7b36 elementor-widget elementor-widget-text-editor\" data-id=\"f5a7b36\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>First, ensure that all necessary logs are available to your organization. Without a log there is no forensics, and retention times are by default shorter than many think. Entra ID sign-in logs are retained for typically 7-30 days depending on the license. The Microsoft 365 audit log is typically retained for 180 days. An incident is often detected only after some of the logs have already been lost.<\/p>\n<p>Three things you should do before the next situation:<\/p>\n<ul>\n<li>Check the retention periods for all logs and extend them if necessary<\/li>\n<li>Ensure the process. Write down the initial actions in advance, including who decides on isolation<\/li>\n<li>Try the language model in an exercise, not during the first real incident<br\/><br\/><\/li>\n<\/ul>\n<p>The most important thing to remember is that AI does not replace a security expert. It replaces the situation where no one knows where to start. The benefit it brings may be a significantly larger change for an SME than any single new tool.<\/p>\n<p>Security forensics is, however, just one example. AI does the reading and the human makes the decisions, and the same model works everywhere where IT management time is spent on slow but not difficult work. We will go through these examples more extensively at the <strong><a href=\"https:\/\/aboveit.fi\/en\/above-it-afterwork-2025\/\" rel=\"noopener\">Above IT Afterwork on October 8, 2026<\/a><\/strong> with the theme <em>Do more with less<\/em>. There, we will also look at agentic forensics from the perspective of contracts and data protection: what needs to be considered regarding data processing before an agent can be allowed into the logs. The event is free of charge, and places are limited.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-4d02490 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"4d02490\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2b39bf0\" data-id=\"2b39bf0\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-be7f18e elementor-widget elementor-widget-text-editor\" data-id=\"be7f18e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<blockquote><p><em>As your IT management&#8217;s trusted advisor, our task is to ensure that the IT environment you manage remains secure and is not compromised. <span style=\"font-size: 1rem;\">So book a meeting using the link below if you would like to discuss, for example, the utilization of AI in security forensics within your own environment.<\/span><\/em><\/p><\/blockquote>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>A security incident is rarely investigated by a forensics professional. Most often, it is done by whoever happens to be present. This is exactly where AI helps the most.<\/p>\n","protected":false},"author":9,"featured_media":8619,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","inline_featured_image":false,"footnotes":""},"categories":[218,236,231],"tags":[455,219,536,237,540],"class_list":["post-13450","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-microsoft-365","category-technologies","tag-artificial-intelligence","tag-cybersecurity","tag-forensics","tag-microsoft365","tag-security-incident"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Security Incident Investigation with AI: 4 Benefits and 4 Limits | Above IT Oy<\/title>\n<meta name=\"description\" content=\"A hijacked Microsoft 365 account on Friday at 4 PM? Here is how AI speeds up security incident investigation in SMEs and where its use must be limited.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/aboveit.fi\/en\/security-incident-investigation-with-ai\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Security Incident Investigation with AI: 4 Benefits and 4 Limits | Above IT Oy\" \/>\n<meta property=\"og:description\" content=\"A hijacked Microsoft 365 account on Friday at 4 PM? Here is how AI speeds up security incident investigation in SMEs and where its use must be limited.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/aboveit.fi\/en\/security-incident-investigation-with-ai\/\" \/>\n<meta property=\"og:site_name\" content=\"Above IT Oy\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/aboveitfi\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-29T07:19:05+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-29T11:14:13+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/aboveit.fi\/wp-content\/uploads\/2025\/04\/AboveIT-Matias-20.jpeg\" \/>\n\t<meta property=\"og:image:width\" content=\"2048\" \/>\n\t<meta property=\"og:image:height\" content=\"1365\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Matias Haapaniemi\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Matias Haapaniemi\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/security-incident-investigation-with-ai\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/security-incident-investigation-with-ai\\\/\"},\"author\":{\"name\":\"Matias Haapaniemi\",\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/#\\\/schema\\\/person\\\/d4a53cbdd8698810ce4da0615fac49f0\"},\"headline\":\"Security Incident Investigation with AI: Benefits and Limits\",\"datePublished\":\"2026-09-29T07:19:05+00:00\",\"dateModified\":\"2026-09-29T11:14:13+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/security-incident-investigation-with-ai\\\/\"},\"wordCount\":1363,\"publisher\":{\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/security-incident-investigation-with-ai\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/aboveit.fi\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/AboveIT-Matias-20.jpeg\",\"keywords\":[\"artificial intelligence\",\"cybersecurity\",\"forensics\",\"microsoft365\",\"security incident\"],\"articleSection\":[\"Cybersecurity\",\"Microsoft 365\",\"Technologies\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/security-incident-investigation-with-ai\\\/\",\"url\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/security-incident-investigation-with-ai\\\/\",\"name\":\"Security Incident Investigation with AI: 4 Benefits and 4 Limits | Above IT Oy\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/security-incident-investigation-with-ai\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/security-incident-investigation-with-ai\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/aboveit.fi\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/AboveIT-Matias-20.jpeg\",\"datePublished\":\"2026-09-29T07:19:05+00:00\",\"dateModified\":\"2026-09-29T11:14:13+00:00\",\"description\":\"A hijacked Microsoft 365 account on Friday at 4 PM? Here is how AI speeds up security incident investigation in SMEs and where its use must be limited.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/security-incident-investigation-with-ai\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/aboveit.fi\\\/en\\\/security-incident-investigation-with-ai\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/security-incident-investigation-with-ai\\\/#primaryimage\",\"url\":\"https:\\\/\\\/aboveit.fi\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/AboveIT-Matias-20.jpeg\",\"contentUrl\":\"https:\\\/\\\/aboveit.fi\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/AboveIT-Matias-20.jpeg\",\"width\":2048,\"height\":1365,\"caption\":\"Pilvinatiivi it-konsultti Matias Haapaniemi\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/security-incident-investigation-with-ai\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Etusivu\",\"item\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/it-management-resource-partner\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security Incident Investigation with AI: Benefits and Limits\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/\",\"name\":\"We Are Above IT\",\"description\":\"Tietohallinnon voimavarakumppani\",\"publisher\":{\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/#organization\",\"name\":\"Above IT Oy\",\"url\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/aboveit.fi\\\/wp-content\\\/uploads\\\/2024\\\/10\\\/aboveIT-logo.png\",\"contentUrl\":\"https:\\\/\\\/aboveit.fi\\\/wp-content\\\/uploads\\\/2024\\\/10\\\/aboveIT-logo.png\",\"width\":1613,\"height\":383,\"caption\":\"Above IT Oy\"},\"image\":{\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/aboveitfi\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/aboveitfi\",\"https:\\\/\\\/instagram.com\\\/aboveitfi\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/#\\\/schema\\\/person\\\/d4a53cbdd8698810ce4da0615fac49f0\",\"name\":\"Matias Haapaniemi\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/62a88c40ff59fa65af0446f9fed83102baf125a315973ea874297af43da02528?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/62a88c40ff59fa65af0446f9fed83102baf125a315973ea874297af43da02528?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/62a88c40ff59fa65af0446f9fed83102baf125a315973ea874297af43da02528?s=96&d=mm&r=g\",\"caption\":\"Matias Haapaniemi\"},\"sameAs\":[\"https:\\\/\\\/aboveit.fi\"],\"url\":\"https:\\\/\\\/aboveit.fi\\\/en\\\/author\\\/matias-haapaniemiaboveit-fi\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Security Incident Investigation with AI: 4 Benefits and 4 Limits | Above IT Oy","description":"A hijacked Microsoft 365 account on Friday at 4 PM? Here is how AI speeds up security incident investigation in SMEs and where its use must be limited.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/aboveit.fi\/en\/security-incident-investigation-with-ai\/","og_locale":"en_US","og_type":"article","og_title":"Security Incident Investigation with AI: 4 Benefits and 4 Limits | Above IT Oy","og_description":"A hijacked Microsoft 365 account on Friday at 4 PM? Here is how AI speeds up security incident investigation in SMEs and where its use must be limited.","og_url":"https:\/\/aboveit.fi\/en\/security-incident-investigation-with-ai\/","og_site_name":"Above IT Oy","article_publisher":"https:\/\/www.facebook.com\/aboveitfi","article_published_time":"2026-09-29T07:19:05+00:00","article_modified_time":"2026-09-29T11:14:13+00:00","og_image":[{"width":2048,"height":1365,"url":"https:\/\/aboveit.fi\/wp-content\/uploads\/2025\/04\/AboveIT-Matias-20.jpeg","type":"image\/jpeg"}],"author":"Matias Haapaniemi","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Matias Haapaniemi","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/aboveit.fi\/en\/security-incident-investigation-with-ai\/#article","isPartOf":{"@id":"https:\/\/aboveit.fi\/en\/security-incident-investigation-with-ai\/"},"author":{"name":"Matias Haapaniemi","@id":"https:\/\/aboveit.fi\/en\/#\/schema\/person\/d4a53cbdd8698810ce4da0615fac49f0"},"headline":"Security Incident Investigation with AI: Benefits and Limits","datePublished":"2026-09-29T07:19:05+00:00","dateModified":"2026-09-29T11:14:13+00:00","mainEntityOfPage":{"@id":"https:\/\/aboveit.fi\/en\/security-incident-investigation-with-ai\/"},"wordCount":1363,"publisher":{"@id":"https:\/\/aboveit.fi\/en\/#organization"},"image":{"@id":"https:\/\/aboveit.fi\/en\/security-incident-investigation-with-ai\/#primaryimage"},"thumbnailUrl":"https:\/\/aboveit.fi\/wp-content\/uploads\/2025\/04\/AboveIT-Matias-20.jpeg","keywords":["artificial intelligence","cybersecurity","forensics","microsoft365","security incident"],"articleSection":["Cybersecurity","Microsoft 365","Technologies"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/aboveit.fi\/en\/security-incident-investigation-with-ai\/","url":"https:\/\/aboveit.fi\/en\/security-incident-investigation-with-ai\/","name":"Security Incident Investigation with AI: 4 Benefits and 4 Limits | Above IT Oy","isPartOf":{"@id":"https:\/\/aboveit.fi\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/aboveit.fi\/en\/security-incident-investigation-with-ai\/#primaryimage"},"image":{"@id":"https:\/\/aboveit.fi\/en\/security-incident-investigation-with-ai\/#primaryimage"},"thumbnailUrl":"https:\/\/aboveit.fi\/wp-content\/uploads\/2025\/04\/AboveIT-Matias-20.jpeg","datePublished":"2026-09-29T07:19:05+00:00","dateModified":"2026-09-29T11:14:13+00:00","description":"A hijacked Microsoft 365 account on Friday at 4 PM? Here is how AI speeds up security incident investigation in SMEs and where its use must be limited.","breadcrumb":{"@id":"https:\/\/aboveit.fi\/en\/security-incident-investigation-with-ai\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/aboveit.fi\/en\/security-incident-investigation-with-ai\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/aboveit.fi\/en\/security-incident-investigation-with-ai\/#primaryimage","url":"https:\/\/aboveit.fi\/wp-content\/uploads\/2025\/04\/AboveIT-Matias-20.jpeg","contentUrl":"https:\/\/aboveit.fi\/wp-content\/uploads\/2025\/04\/AboveIT-Matias-20.jpeg","width":2048,"height":1365,"caption":"Pilvinatiivi it-konsultti Matias Haapaniemi"},{"@type":"BreadcrumbList","@id":"https:\/\/aboveit.fi\/en\/security-incident-investigation-with-ai\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Etusivu","item":"https:\/\/aboveit.fi\/en\/it-management-resource-partner\/"},{"@type":"ListItem","position":2,"name":"Security Incident Investigation with AI: Benefits and Limits"}]},{"@type":"WebSite","@id":"https:\/\/aboveit.fi\/en\/#website","url":"https:\/\/aboveit.fi\/en\/","name":"We Are Above IT","description":"Tietohallinnon voimavarakumppani","publisher":{"@id":"https:\/\/aboveit.fi\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/aboveit.fi\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/aboveit.fi\/en\/#organization","name":"Above IT Oy","url":"https:\/\/aboveit.fi\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/aboveit.fi\/en\/#\/schema\/logo\/image\/","url":"https:\/\/aboveit.fi\/wp-content\/uploads\/2024\/10\/aboveIT-logo.png","contentUrl":"https:\/\/aboveit.fi\/wp-content\/uploads\/2024\/10\/aboveIT-logo.png","width":1613,"height":383,"caption":"Above IT Oy"},"image":{"@id":"https:\/\/aboveit.fi\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/aboveitfi","https:\/\/www.linkedin.com\/company\/aboveitfi","https:\/\/instagram.com\/aboveitfi"]},{"@type":"Person","@id":"https:\/\/aboveit.fi\/en\/#\/schema\/person\/d4a53cbdd8698810ce4da0615fac49f0","name":"Matias Haapaniemi","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/62a88c40ff59fa65af0446f9fed83102baf125a315973ea874297af43da02528?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/62a88c40ff59fa65af0446f9fed83102baf125a315973ea874297af43da02528?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/62a88c40ff59fa65af0446f9fed83102baf125a315973ea874297af43da02528?s=96&d=mm&r=g","caption":"Matias Haapaniemi"},"sameAs":["https:\/\/aboveit.fi"],"url":"https:\/\/aboveit.fi\/en\/author\/matias-haapaniemiaboveit-fi\/"}]}},"_links":{"self":[{"href":"https:\/\/aboveit.fi\/en\/wp-json\/wp\/v2\/posts\/13450","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aboveit.fi\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aboveit.fi\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aboveit.fi\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/aboveit.fi\/en\/wp-json\/wp\/v2\/comments?post=13450"}],"version-history":[{"count":19,"href":"https:\/\/aboveit.fi\/en\/wp-json\/wp\/v2\/posts\/13450\/revisions"}],"predecessor-version":[{"id":13544,"href":"https:\/\/aboveit.fi\/en\/wp-json\/wp\/v2\/posts\/13450\/revisions\/13544"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aboveit.fi\/en\/wp-json\/wp\/v2\/media\/8619"}],"wp:attachment":[{"href":"https:\/\/aboveit.fi\/en\/wp-json\/wp\/v2\/media?parent=13450"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aboveit.fi\/en\/wp-json\/wp\/v2\/categories?post=13450"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aboveit.fi\/en\/wp-json\/wp\/v2\/tags?post=13450"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}