New analysis

Outlook 2027: six shifts in the open-source threat picture, and what each one changes for investigators.

Read the outlook

Methodology

Machines for volume, people for judgment: how we use AI in investigations

Clients now ask every intelligence provider the same question: are you using AI, and if so, for what? This is our answer. It covers where machine assistance is used on our platform, the five things it is never allowed to do and how a reader can check any step it touched.

A finding is only as good as the evidence it can be traced to. That rule was written for human analysts in 2014. It applies without amendment to anything a machine produces.

The question behind the question

When a client asks whether we use AI, they are rarely asking about technology. They are asking whether a conclusion that could end a contract, a career or an investment was reached by a person who can explain it, or by a system that cannot. They are right to ask.

Our position is simple. Machine assistance is valuable for reading more material than a team could otherwise read. It has no role in deciding what that material proves. Every use on our platform sits on one side of that line or the other.

Where machines earn their place

An investigation generates far more text, imagery and records than analysts can read line by line. Machine assistance is used to sort, translate and structure that volume so that human attention goes where it matters.

Machine-assisted tasks on the Aldervane platform
Task What the machine does What the analyst does
Triage Ranks collected items by likely relevance to the written requirements Reads what is ranked highly and samples what is ranked low
Translation drafts Produces a working translation so non-speakers can follow the material A native speaker translates anything that will be cited
Entity extraction Pulls names, companies, addresses and identifiers out of documents Confirms each one against the source before it enters the case
Transcription Turns audio and video into searchable text Listens to any passage relied on
Similarity and clustering Groups accounts, images or documents that resemble each other Decides whether the resemblance means anything
Summaries of long records Outlines a filing or a forum thread, with links to each passage Reads the passages before using any of it

In every row the machine output is a pointer to something an analyst then reads. It is never the thing that is cited.

Five things it is never allowed to do

  1. It does not attribute. No system on our platform names a person as responsible for anything. Attribution is a judgment that requires three independent lines of evidence, a search for contradictions and a red-team review. Those are human tasks.
  2. It is never a source. Nothing a model generates is cited as evidence. A statement in a report traces to a captured, hashed item, and an analyst has read that item.
  3. It does not write key judgments. The judgments, probability terms and confidence levels in a report are written by the lead investigator, who signs it and can be asked to defend it.
  4. It does not grade. Source reliability, information credibility and confidence are assessed by analysts under our published standard.
  5. It does not learn from client matters. Case data stays inside the case workspace. It is not used to train or tune any model, ours or anyone else's, and it is deleted on the same schedule as the rest of the case.

We do not use face recognition to identify people

This deserves its own heading because it is the use people most often assume. We do not run photographs of unknown individuals through face recognition to produce a name. The error rates are uneven across populations, the consequences of a false match are severe and the method cannot be explained to the standard our reports require.

Image comparison has narrower, defensible uses. It can show that two profile pictures are the same file, or that a photograph has been published before. Those are statements about images. They can be verified by looking. A claim about who is in an image needs independent evidence, as any other claim does.

Keeping every assisted step checkable

Three controls apply wherever machine assistance is used.

  • Every output links to its input. An extracted name opens the sentence it came from. A summary line opens the passage it describes. If the link cannot be followed, the output is discarded.
  • Assistance is logged. The case audit trail records which items were machine-ranked, translated or extracted, and which analyst confirmed each one. The record travels with the evidence bundle.
  • Reports say so. Where a machine-assisted step contributed to a finding, the method section of the report describes it in plain terms.
The test we apply

Could an independent examiner, given our evidence bundle and no access to our systems, reach the same conclusion? If any step depends on trusting a model's output, the answer is no, and the finding is not ready.

How machine assistance fails

We audit it the way we audit ourselves. In our most recent internal review, analysts checked 1,200 machine-extracted entities against their sources. Just over 6 percent were wrong: a name joined to the wrong company, a date misread, two people merged into one. Analysts had caught 97 percent of those errors before the entity was used. The remainder were caught at review.

The failures fall into a few recurring kinds.

Confident invention

Generative systems can produce a plausible detail that appears nowhere in the source. The linking rule exists for this reason. A claim that cannot be opened is not a claim.

Flattened language

Machine translation renders slang, coded terms and regional usage into bland, standard prose. The meaning that mattered is often the part that was lost, which is why cited material is always translated by a native speaker.

False resemblance

Clustering finds similarity. It does not know why things are similar. Accounts cluster because they belong to one operator, because they used the same template or because they are fans of the same team.

Ranking blind spots

A triage model trained on yesterday's cases underrates what it has not seen before. Analysts therefore sample low-ranked material on every case, and the unexpected lead is often there.

The other side has the same tools

The people we investigate generate profile photographs, biographies, reviews and entire personas cheaply. Tools that claim to detect generated content are useful for deciding what to look at first. They are not reliable enough to be evidence, and we do not report their output as a finding.

What defeats a generated persona is what has always defeated a false one: it has no past. It has no archived versions, no independent records and no connections that predate its creation. Provenance, established from preserved sources, is the answer to synthetic content. A better detector is not.

Six questions to ask any provider

These are the questions we would ask in a client's position, and the ones we expect to be asked.

  1. Which steps in your process use machine assistance, and which never do?
  2. Can I trace every statement in a report to a preserved source a person has read?
  3. Who writes and signs the conclusions?
  4. Is my data used to train or improve any model?
  5. What is your measured error rate, and how do you catch errors before they reach me?
  6. Do you use face recognition to identify individuals?

Our answers are on this page. They are also written into our standards, which means the committee that screens our engagements can stop any use that crosses the line.

Start an engagement

Bring us the question nobody else could answer.

Tell us what you need to know and why. A senior investigator will scope it with you, tell you candidly what open sources can and cannot establish, and propose a plan with a fixed fee and a firm timeline.