Tag: Binalyze

What did the AI actually do?

Posted on August 20, 2026 by - DFIR Lab - Binalyze, Digital Forensics, Digital Forensics Blog - Binalyze

Binalyze blog-what did the AI do

Introducing AI Evidence Collection in Binalyze AIR

AI tools can read files, run commands, connect to external services, and retain sensitive context. Binalyze AIR gives investigators the forensic evidence to understand what happened on the computer.

The question: When an incident involves an AI-enabled computer, can your team prove what the AI saw, did, and exposed?

AI assistants have moved rapidly from experimental tools to everyday corporate software. They are used by engineering, sales, finance, legal, support, HR, and IT. To be useful, many of these tools operate close to the work: they read files, inspect projects, execute commands, call external services, and extend their capabilities through Model Context Protocol (MCP) servers, custom agents, skills, and automation hooks.

That access creates a new investigation problem. When an incident occurs, security teams may be able to see the computer, the user, and the surrounding alerts, but not the activity inside the AI tool itself. They are left asking the employee what was shared or guessing what the assistant accessed and executed.

Binalyze AIR closes that visibility gap. AI Evidence Collection acquires and analyzes forensic evidence from locally installed AI tools on Windows, macOS, and Linux endpoints, then brings it into structured, searchable views in Investigation Hub. It helps investigators move from assumptions about AI usage to evidence of what actually happened.

AI risk is not one story

Much of the conversation about AI security focuses on whether employees are allowed to use a particular tool. That is important, but it is only the starting point. Once an AI tool is present on a computer, two risk stories run in parallel.

The AI can become an execution surface

AI tools may execute shell commands with the user’s privileges, install packages, change files, or transfer data. They may also follow instructions embedded in files or web content, creating a path for indirect prompt injection. MCP servers, hooks, custom agents, skills, and permission settings extend that execution surface further. A malicious or over-privileged component can act automatically and may not look like a conventional application to the investigator.

The AI can become a channel for information exposure

Most exposure is not deliberate. An employee may paste a customer record, contract, internal report, API token, or database connection string into a prompt simply to get useful work done. The AI may also encounter sensitive information on its own while inspecting a project or troubleshooting a machine. Environment files, key material, configuration files, and credential stores can appear in commands, tool output, conversations, or local state even when the employee never intended to share them.

Those scenarios require different responses. A security team needs to know whether a user supplied a secret, the assistant produced it, a command attempted to access credential material, or a tool result brought it into the session. Without that context, teams may rotate the wrong credentials, miss the real exposure path, or struggle to explain the incident to auditors and stakeholders.

From AI artifacts to an investigation timeline

Binalyze AIR supports evidence from nine locally installed AI tools, including Claude Desktop, ChatGPT Desktop / Atlas, Gemini CLI, Claude Code, Cursor, OpenAI Codex, GitHub Copilot Chat, Continue, and Windsurf. 

Eleven independently selectable AI evidence types can be collected. Together, they give investigators a view of the tools present on the computer, how those tools were configured, what activity occurred, and where risk may require closer review.

Understand the AI environment

AI Artifacts and AI Configs establish which files and tools exist, preserve hashes and timestamps, and show relevant configuration such as models, allowed tools, permission modes, and declared MCP servers.

Reconstruct what happened

AI Sessions and AI Agent Events organize prompts, assistant messages, tool calls, tool results, commands, outcomes, referenced files, and available timing information into a searchable event sequence.

Inspect the extension surface

AI MCP, AI Rules, AI Agents, AI Skills, AI Hooks, and AI Commands expose the components that shape or extend an assistant’s behavior, including remote tool servers, executable scripts, automation triggers, and broad autonomy settings.

Investigate credential exposure

AI Secrets identifies credential findings across user prompts, assistant responses, commands, tool output, and configuration values. Investigators can pivot to the relevant session and correlate the same secret across computers using a one-way fingerprint, without AIR storing the cleartext value.

Every parsed record links back to the raw source artifact from which it was derived. This allows an analyst to move from a risk flag to the session, configuration, skill, or source file that provides its investigative context, rather than treating the finding as an isolated alert.

Questions investigators can now answer

The value of AI evidence is not the number of artifacts collected. It is the quality of the questions an investigator can answer:

  • Did a user paste credentials or confidential information into an AI tool on this computer?
  • Did the AI itself read credential files, key material, or credential stores?
  • Which credentials may require rotation, and where else did the same credential appear?
  • Did the AI execute a destructive, encoded, network-transfer, or credential-reading command?
  • Which MCP servers, hooks, skills, or custom agents were configured to run, and with what level of autonomy?
  • Was an AI transcript altered, truncated, or reordered after the activity occurred?

Binalyze AIR also applies deterministic, offline triage signals to help analysts prioritize large volumes of activity. These signals surface patterns such as secret exposure, prompt injection phrasing, destructive commands, remote or shell-launched MCP servers, auto-executing hooks, permission-bypass settings, executable skill scripts, and broad ignore rules. A signal is a reason to review the evidence, not a verdict that a breach occurred.

Evidence that stands up to scrutiny

AI transcripts and configuration files are ordinary local artifacts. They can be changed, deleted, malformed, or partially retained. Binalyze AIR treats those limitations as part of the evidence rather than silently ignoring them.

Parsed AI events carry cryptographic hashes and a running chain that makes deleted or reordered conversation turns visible. Sessions and findings remain tied to the SHA-256 hash of their source files, while raw artifacts are preserved in the endpoint case workspace. When evidence has weaker timing or comes from a derived source, AIR records that confidence explicitly so analysts do not mistake an estimate for a precise timestamp.

The result is more than an inventory of AI-related files. It is an integrity-checked record that can support an investigation narrative, an audit, an insider or offboarding review, and post-incident reporting.

Designed with privacy in mind

Investigating AI activity can involve sensitive employee and business information. The collection approach is therefore designed to retain investigative value while limiting unnecessary exposure:

  • Cleartext credentials are never stored. Findings use a masked excerpt and a one-way fingerprint.
  • Full prompt and response bodies are not stored in the evidence database. Binalyze AIR retains bounded, secret-masked excerpts alongside hashes.
  • MCP environment-variable names may be recorded, but their values are not.
  • Command output is represented by its hash rather than retained as content.
  • Triage is local, offline, and deterministic. No AI model is invoked to analyze the evidence.

Built for endpoint AI investigations

AI adoption should not mean investigating blind

Organizations will continue adopting AI because it improves how work gets done. The security response cannot be to assume every use is malicious, nor can it be to accept an evidence gap around increasingly capable endpoint software.

Binalyze AIR brings AI activity into the same evidence-led investigation discipline security teams already expect elsewhere: collect the relevant artifacts, preserve their provenance, reconstruct the activity, prioritize what matters, and let investigators reach a defensible conclusion.

When the next investigation involves an AI-enabled computer, the question should no longer be whether anyone remembers what happened. It should be what the evidence shows. With AI Evidence Collection, Binalyze AIR turns AI activity from an investigative blind spot into evidence you can examine, verify, and defend.

Binalyze and ThreatMon Join Forces to Operationalize Threat Intelligence Inside Investigation Workflows

Posted on July 30, 2026 by - DFIR Lab - Binalyze, Digital Forensics, Digital Forensics Blog - Binalyze

Binalyze x ThreatMon collab blog

Binalyze and ThreatMon Join Forces to Operationalize Threat Intelligence Inside Investigation Workflows

Threat intelligence is most valuable when security teams can act on it.

Most organizations already have access to intelligence feeds, IOCs, and threat context from trusted sources. But turning that intelligence into practical investigation and hunting content often remains a manual, time-consuming process. Analysts need to export IOCs, convert them into usable rules, upload those rules into security tools, and continuously maintain them as intelligence changes.

For busy SOC, IR, DFIR, MDR, and MSSP teams, that operational burden can slow down proactive threat hunting.

That is why Binalyze and ThreatMon are joining forces through a Technology Alliance to help security teams move faster from threat intelligence to investigation-ready action.

With Binalyze AIR’s new Cyber Threat Intelligence (STIX/TAXII Feed) Integration, supported intelligence can be imported into AIR and transformed into ready-to-use YARA, Sigma, and osquery triage rules. The result is a practical way to operationalize threat intelligence inside threat-hunting and investigation workflows.

A New Look. The Same Mission.

Posted on July 22, 2026 by - In the Press

Binalyze new website same mission blog

A New Look. The Same Mission.

Why We’ve Reimagined the Binalyze Brand

Today, we’re excited to launch the new Binalyze website.

While you’ll immediately notice a fresh visual identity, new messaging and a completely redesigned experience, this launch represents much more than a new website.

It reflects something we’ve believed since the day Binalyze was founded.

Security teams don’t need more alerts. They need answers.

Every day, security operations teams are flooded with alerts, telemetry and threat intelligence. Detection technology has become incredibly sophisticated, but when an alert arrives, the most important questions often remain unanswered.

  • What actually happened?
  • How did the attack start?
  • How far did it spread?
  • What systems are affected?
  • Can we confidently close the incident?

That’s where investigation begins.

And that’s why we’ve evolved how we tell our story.

A clearer way to explain what we do

As Binalyze has grown, so has our platform.

AIR has evolved far beyond traditional investigation tools, yet we often found ourselves being described as a forensic platform, another incident response tool, or even an AI SOC company.

While those descriptions contain elements of the truth, none of them fully explain the role AIR plays within today’s Security Operations Centre.

Our new messaging better reflects that role.

Binalyze reveals the truth behind cyber alerts and incidents.

AIR is the investigation platform that makes a SOC complete, working alongside SIEM, XDR, EDR, SOAR and threat intelligence solutions to transform alerts into understanding – and understanding into confident action.

It’s not about replacing existing security investments.

It’s about giving security teams the evidence, context and clarity they need to investigate with confidence.

Why superheroes?

One question we’ve already been asked is:

“Why superheroes?”

The answer is simple.

Because the heroes have never been our technology.

They’re the people using it.

Every day, SOC analysts, incident responders and threat hunters face enormous pressure. They sift through endless alerts, investigate complex attacks and make critical decisions that protect their organisations.

They’re expected to uncover the truth, often with incomplete information and against the clock.

We wanted our new visual identity to celebrate those defenders.

The comic-inspired artwork represents the hidden battles taking place every day inside security operations centres around the world. Hidden threats. Invisible adversaries. Complex investigations.

AIR doesn’t replace the hero.

It helps them see what others can’t.

It helps them reveal the truth.

More than a new design

This website isn’t simply a visual refresh.

Every page has been rewritten to better explain where AIR fits, how investigation complements detection, and why organisations need more than alerts to build cyber resilience.

We’ve expanded the site with new resources, deeper product information, practical use cases and clearer guidance for different audiences – from SOC analysts and incident responders to security leaders and managed service providers.

Our goal was simple:

  • Make it easier to understand who we are.
  • Explain why investigation matters.
  • Show how Binalyze helps.

This is just the beginning

Like any great investigation, our story will continue to evolve.

We’ll continue adding new content, sharing customer stories, publishing research and helping security teams understand why investigation is becoming one of the most important capabilities in modern security operations.

The new website is just the beginning.

We hope you enjoy exploring it.

 

Binalyze reveals the truth behind cyber alerts and incidents.

AIR is the investigation platform that makes a SOC complete.

 

Binalyze Announces Strategic Technical Services Partnership with DIFOSE to Strengthen Capabilities in Türkiye

Posted on May 18, 2026 by - In the Press

Binalyze Announces Strategic Technical Services Partnership with DIFOSE to Strengthen Capabilities in Türkiye

London, UK– May 18th, 2026 —Binalyze, a provider of automated investigation and response solutions , today announced a strategic partnership with DIFOSE, a Türkiye-based cybersecurity and technical services provider. This collaboration marks an important step in expanding Binalyze’s regional capabilities and enhancing customer support and service delivery across Türkiye.

Under the agreement, DIFOSE will act as Binalyze’s Technical Services Partner in the region, delivering a range of specialized services aligned with Binalyze’s operational standards and methodologies. These services include technical support, product deployment and maintenance, training, and incident response consulting for customers operating in Türkiye.

This partnership is designed to bring customers closer to expert support and hands-on technical capabilities, ensuring faster response times, improved implementation experiences, and deeper engagement with Binalyze’s solutions. By combining Binalyze’s advanced technology platform with DIFOSE’s local expertise and on-the-ground presence, the collaboration aims to deliver a seamless and high-quality customer experience.

As part of the relationship, DIFOSE’s technical personnel will work closely with Binalyze’s internal teams, integrating into its technical ecosystem and collaborating across support, product, and engineering functions. This alignment enables consistent service delivery and ensures that customers benefit from both global expertise and localized knowledge.

“We are excited to welcome DIFOSE as our Technical Services Partner in Türkiye,” said Steve Jackson, SVP of Partnerships at Binalyze. “Their strong technical background and regional expertise make them an ideal partner to help us scale our services and better support our growing customer base.”

DIFOSE leadership also highlighted the strategic importance of the partnership, emphasizing their commitment to delivering high-quality technical services and contributing to the success of Binalyze customers in the region.

This partnership reflects Binalyze’s continued investment in building a robust global ecosystem of partners to support its mission of empowering defenders with faster, more effective investigative capabilities, simplifying and accelerating digital investigations and incident response.

Binalyze Launches Full-Text Search capability to Bring Investigative e-Discovery to the SOC

Posted on March 27, 2026 by - Press Release

New capability enables security teams to proactively search file contents across endpoints, whilst also enabling faster, more accurate investigation and response

London, UK – March 26th, 2026 : Binalyze, the cybersecurity company delivering AIR, Automated Investigation and Response, today announced the launch of Full-Text Search, a new capability that brings ‘e-discovery’ of file contents directly into the Security Operations Center (SOC) to help close the ‘content blind spot’ for organizations.

Despite years of investment in detection technologies such as EDR, XDR, and SIEM, most SOCs investigate incidents without direct visibility into file contents. This reliance on metadata such as filenames, hashes, and access logs blinds investigators to crucial context such as what actual data was involved; how it was misused; and what the potential consequences are.

Full-Text Search capability introduces investigative e-discovery capabilities at the endpoint, allowing teams to go beyond detecting suspicious activity to determine the true potential impact of an incident without affecting the speed of an investigation. In contrast to legacy e-discovery solutions, Full-Text Search removes the need to centrally index and create copies of data that already exists. This enables security teams to search and examine the contents of files across endpoints and hybrid environments in real-time. This results in a clear understanding of what’s in a file, where it’s stored, who has access, and whether it’s being used appropriately.

Embedded within the Binalyze AIR platform, Full-Text Search enables distributed full-text search directly on the device where the data resides. By removing the need to export files or wait for centralized indexing, security teams can quickly examine file contents across large environments, giving a full picture of the extent of a breach and what data is at risk. Moreover, it also helps security teams to proactively spot issues before breaches occur, especially when confidential files are being accessed by users whom wouldn’t usually have authorization to access them.

“When triaging and responding to a potential incident, context is everything,” said Emre Tinaztepe, Founder and CEO of Binalyze. “Detection tools are excellent at telling teams that something suspicious happened. What they rarely show is what data was actually involved. By bringing e-discovery-like capabilities directly into the investigation workflow, Full-Text Search capability allows analysts to search inside files and quickly understand what information may have been exposed or misused.”

Closing the Visibility Gap in Cyber Investigations

The Full-Text Search capability addresses a broader shift in cybersecurity priorities. As attacks become more complex and regulatory expectations increase, organizations need deeper investigative capabilities to understand exactly what happened during an incident.

Yet these organizations also have to deal with rapidly growing data volumes across their endpoints – from both cloud services, and remote environments – alongside rising insider threats and accidental data exposure. Security teams can easily study indirect indicators such as metadata or access logs, but deeper inspection requires involvement from forensic specialists, IT teams, or legal workflows. These delays can extend investigations and increase uncertainty around the scope of an incident.

Full-Text Search capability gives security teams the capability to search across their entire infrastructure; investigate insider threats and data exposure directly at the source; and provide evidence-based answers to key stakeholders and regulators.

“Security teams do not need more alerts and new dashboards telling them they ‘might’ have something they need to deal with,” continued Tinaztepe. “What they need is clarity about what data is involved. By bringing e-discovery directly into the investigation process, Full-Text Search capability gives analysts the confidence to answer even the most granular and complex questions about data. Most importantly, by seeing the content behind the signals, investigators can address the critical fact of any incident: what actually happened?”

Availability

Full-Text Search is available immediately as a new module within the Binalyze AIR platform.

 

Binalyze bolsters leadership team as company advances global growth and innovation in cyber investigations

Posted on December 8, 2025 by - In the Press

London, UK – December 10th, 2025 – Binalyze, the cybersecurity company delivering AIR – Automated Investigation and Response, has announced three strategic leadership appointments to drive its next phase of global growth. Brian D. Owen has been named Chairman of the Board, Jonathan Rees joins as Chief Operating Officer, and Jim Hansen, a founding executive of Mandiant, joins the Board of Directors.

These appointments reflect growing global demand for solutions that help security teams go beyond alerts – delivering the visibility and context needed to act faster and with greater certainty. Binalyze AIR connects with existing security tooling to automate evidence collection and deliver rich, investigation-ready context across endpoints, cloud, and hybrid environments enabling teams to respond decisively to both proactive and reactive threats.

Brian Owen brings more than three decades of experience leading and scaling enterprise SaaS and infrastructure companies. A seven-time CEO and advisor to over two dozen technology firms, he has guided 17 successful exits and driven significant investor returns, including a 300% IRR for Greylock’s MapInfo IPO and a tenfold return for Viola following the sale of Decalog to SunGard.

“Binalyze is solving one of the biggest gaps in cybersecurity – helping teams close the space between detection and understanding,” said Owen. “AIR delivers context where other tools stop. That shift from guesswork to evidence-driven action is game-changing.”

Joining as Chief Operating Officer, Jonathan Rees brings extensive international experience in scaling high-growth technology businesses. Having led operations, go-to-market execution, and organizational transformation, most recently at Nuix, Rees will oversee Binalyze’s global business operations and execute the company’s next phase of commercial expansion.

“Security teams are overwhelmed by alerts but lack the context to act confidently,” said Rees. “Binalyze flips that dynamic by giving analysts what they really need – speed, clarity, and control. That’s why demand is accelerating, and why we’re scaling to meet it.”

Binalyze also welcomes Jim Hansen to its Board of Directors. Hansen, one of the founding executives of Mandiant (acquired by FireEye, Inc.), is widely regarded as one of the pioneers of modern incident response. As Mandiant’s Chief Operating Officer, he helped define the company’s strategy and build its renowned sales and services organization, driving an average of 90% annual revenue growth over four years. Under his leadership, Mandiant became a trusted name in digital forensics and cyber incident management.

With more than two decades in information security, Hansen’s career spans executive roles at Trident Data Systems, Veritect, Foundstone, and Oakley Networks – all later acquired by leading defence and cybersecurity firms. Before entering the private sector, he served as Deputy Director of Computer Crime Investigations for the U.S. Air Force Office of Special Investigations, overseeing global investigations into Department of Defense network intrusions.

“I’ve seen how critical visibility and speed are in cyber investigations,” said Hansen. “Binalyze delivers both – but in a way that scales with today’s hybrid, cloud-driven environments. This is the kind of innovation that resets the standard.”

For Emre Tinaztepe, Binalyze’s Founder and CEO, the appointments represent both an acceleration of the company’s growth and a deepening of its leadership in the emerging category of Cloud Investigation and Response Automation.

“This is about more than growth – it’s about focus, execution, and helping our customers solve a critical challenge: turning detection into decisive action,” said Tinaztepe. “With Brian, Jonathan, and Jim, we’re ready to scale AIR globally and lead this category.”

Recognized by Gartner in the CIRA category, Binalyze AIR is trusted by enterprises, MSSPs, and incident response teams worldwide. By integrating with existing security tooling, AIR automates the evidence collection process and delivers rich, contextual insight – helping analysts cut investigation times from hours to minutes, and act with precision and confidence.

About Binalyze

Lack of Clarity in Cyber Investigations Costs U.S. Enterprises $48.1 Billion

Posted on November 19, 2025 by - In the Press

New report from Binalyze reveals $114K-per-hour cost of delayed cyberattack response

London, November 18, 2025: Binalyze, a leader in automated investigation and response, today released a new report that examines enterprises’ approach to cyber incident response. The research reveals that a lack of clarity in cybersecurity investigations costs organizations on average $1.1 million over the last five years – or $48.1 billion across the U.S.A. In addition, every hour of delay in responding to a cyber incident costs on average $114,000.

With 84% of CISOs saying a successful cyberattack is now inevitable, organizations must establish effective and rapid response protocols to stop attackers in their tracks, minimize financial losses, and protect against reputational damage. Yet 79% of organizations favor cyberattack prevention over response, with budgets averaging a 2:1 ratio towards prevention ($3.02 million to $1.54 million).

Binalyze’s report, The State of Cybersecurity Investigations 2025: How Cyber Scene Investigators Can Turn the Tide Against Attackers’ Sense of Impunity, surveyed 200 US CISOs. The report exposes major cracks in enterprise crisis management, showing how repeated missteps responding to cyberattacks are worsening both financial and reputational damage. Key findings show:

  • A clarity gap blocking simple answers: At most 50% of CISOs can answer the most basic cyberattack questions, such as: Does the attacker still have access? How did they get in? Was data stolen? And if so, what? Being able to answer these questions with confidence should be every organization’s priority.
  • Repeating mistakes of the past: 65% of CISOs admit their organizations haven’t always learned the right lessons following cyberattacks. In fact, 75% say once a cyberattack has happened, there’s no guarantee that the exact same attack won’t succeed again.
  • The attack aftermath: 70% of organizations say they struggled to remediate or recover from an attack in the past year. Additionally, 61% have been punished by regulators because of a security breach, and 56% denied cyber insurance payouts, due to being unable to demonstrate, through sufficient insight, that the necessary security controls were in place.

“With cyberattacks now inevitable, the real test for organizations is how fast they can respond and recover,” says Lee Sult, Chief Investigator at Binalyze. “The recent Jaguar Land Rover breach, which halted operations for a month and cost an estimated $2.5 billion, highlights the scale of disruption at stake. Rapid cyber response encompassing in-depth Cyber Scene Investigation is essential to identify, isolate, and eliminate threats while keeping regulators and insurers informed. But this relies on visibility, and 75% of CISOs feel they are missing key information every time there is a breach. With clear, actionable insight into IT environments, organizations can locate attackers, contain damage, and regain control before the impact spirals.”

The Need for Speed in Cyber Investigation

Rapid response is critical when cyber breaches or attacks occur. Every minute gives attackers more time to cause damage or hide their tracks, and organizations less time to understand the breach, update stakeholders, and warn the wider community of new threats.

Yet limited visibility across security frameworks continues to hinder effective incident

Reflecting on 2024: A Year of Milestones, Recognition & Fresh Identity

Posted on December 19, 2024 by - Digital Forensics Blog - Binalyze

As we close the chapter on 2024, I’m filled with immense pride for what Binalyze has accomplished this year. This has been a year of transformation and recognition, marked by groundbreaking achievements, an evolving brand identity, and our inclusion in the emerging Cloud Investigation and Response Automation (CIRA) category identified by Gartner®.

Thriving in a Remote-First World: Why Flexibility Beats Mandates

Posted on September 17, 2024 by - Culture - Binalyze

In a time when some companies are rolling back their remote work policies and pushing for a return to the office, the debate over the “right” way to work has reignited. Every time I read someone confidently declaring that working in an office is the only way to be productive or build a strong culture, I shake my head. The reality? These arguments are often driven by personal preferences or underlying agendas. True flexibility means giving people the power to choose the environment that works best for them. For some, it could even mean working in an office five days a week – and that’s perfectly fine. It’s about choice.

Binalyze Achieves SOC 2 Type II Compliance

Posted on August 2, 2024 by - Digital Forensics Blog - Binalyze

Binalyze is excited to announce that it has successfully achieved SOC 2 Type II compliance, adhering to the stringent standards of the American Institute of Certified Public Accountants (AICPA) for Service Organizations, also known as SSAE 18. This significant accomplishment, received with an unqualified opinion, serves as a third-party industry validation of Binalyze’s dedication to providing enterprise-level security for customer data.