Digital Forensics Analysts

15-1299.06

Median wage $116,580/yr435,370 employed (US)Rank #321 of 923 scored · top 35% by substitution

Conduct investigations on computer-based crimes establishing documentary or physical evidence, such as digital media and logs associated with cyber intrusion incidents. Analyze digital evidence and investigate computer security incidents to derive information in support of system and network vulnerability mitigation. Preserve and present computer-related evidence in support of criminal, fraud, counterintelligence, or law enforcement investigations.

Sub-scores

0–100 · band = confidence interval from rater disagreement

Substitution33

Exposure33

Augmentation69

Substitution — the headline: capability discounted by cost, barriers and adoption.

Exposure — technical capability alone, regardless of whether anyone deploys it.

Augmentation — how much AI assists without replacing. High here + moderate substitution = a changing job, not a disappearing one.

Tasks on the substitution scale

20 rated tasks, binned by substitution score.

Position among all scored occupations

Distribution of 923 occupation scores; the marker is this occupation.

Tasks with substitution ≥ 70

Run 1.0.0-draft.1 · computed 2026-08-05 · rater panel: claude-sonnet-5, claude-haiku-4-5-20251001 · intervals span rater disagreement.

Why this score

The five weighted dimensions of the composite, averaged across this occupation's tasks (importance-weighted, panel mean). Exact weights and formulas: /api/v1/methodology.

Task automatabilityw 35%32

panel mean rating 2.3/5 → substitution pressure 32/100

Technical feasibility todayw 20%36

panel mean rating 2.4/5 → substitution pressure 36/100

Cost vs. human wagew 15%35

panel mean rating 2.4/5 → substitution pressure 35/100

Adoption barriersw 20%inverted — strong barriers lower the score29

panel mean rating 3.9/5 (barrier strength) → substitution pressure 29/100

Sector adoption velocityw 10%36

panel mean rating 2.5/5 → substitution pressure 36/100

Task breakdown (20 tasks)

Substitution pressure per task, weighted by O*NET importance in the composite. Expand a task for the full rater audit trail — every rating, every model, every rationale.

Write and execute scripts to automate tasks, such as parsing large data files.

CI 62–72 · exposure 70 · augmentation 100 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	3/5	Larger forensics organizations and law enforcement agencies are piloting AI-assisted code generation, but deployment remains inconsistent and cautious due to legal and evidentiary standards. Adoption is faster in commercial digital forensics firms than in government labs.
Sector adoption velocity	claude-sonnet-5	3/5	Digital forensics is a specialized niche within a broader tech/legal sector; AI coding tools are adopted individually by analysts, but formal integration into certified forensic workflows lags due to validation and evidentiary requirements.
Augmentation potential	claude-haiku-4-5-20251001	5/5	AI excels at drafting, suggesting, and iterating on parsing scripts, allowing forensic analysts to focus on validation, interpretation, and investigation logic. This is a textbook augmentation scenario where AI boosts analyst productivity while they retain control and judgment.
Augmentation potential	claude-sonnet-5	5/5	AI substantially speeds up script writing, debugging, and boilerplate generation, letting analysts focus on validating logic and interpreting parsed data rather than manual coding.
Task automatability	claude-haiku-4-5-20251001	4/5	Parsing large data files and writing automation scripts are both well-suited to current AI systems; large language models can generate functional parsing scripts and handle repetitive data extraction at significant time savings. However, full end-to-end automation requires validation of script correctness and integration into forensic workflows, preventing a perfect 5.
Task automatability	claude-sonnet-5	4/5	Writing scripts to parse large data files is a well-defined coding task that current LLMs handle well with iterative refinement, especially for common formats and logic patterns typical in forensics workflows.AI can generate, debug, and optimize such scripts largely autonomously with human review.
Adoption barriers	claude-haiku-4-5-20251001	3/5	Digital forensics operates in a regulated, legal context where script correctness and integrity are critical; organizations require human review and sign-off on automation, and there are liability concerns if scripts corrupt or mishandle evidence. However, the actual use of automation scripts is not legally prohibited.
Adoption barriers	claude-sonnet-5	2/5	No licensing requirement blocks script writing itself, though forensic tool validation and chain-of-custody standards may require documented, vetted methodologies before scripts are used in casework.
Cost vs. human wage	claude-haiku-4-5-20251001	4/5	LLM-based code generation costs are very low per script (cents to dollars), compared to analyst wages ($50–80+ per hour); even accounting for oversight and validation, the cost advantage is substantial.
Cost vs. human wage	claude-sonnet-5	4/5	AI-assisted script generation is dramatically cheaper than a human forensics analyst writing and debugging scripts from scratch, though some oversight and validation time is still needed for forensic soundness.
Technical feasibility today	claude-haiku-4-5-20251001	3/5	AI code-generation tools (GitHub Copilot, ChatGPT) and data-processing libraries are deployed and used in practice, but forensics-specific deployment is limited and requires expert human oversight of generated scripts for accuracy and legal chain-of-custody compliance. Error rates in code generation remain material for complex parsing tasks.
Technical feasibility today	claude-sonnet-5	4/5	Coding assistants (e.g., GitHub Copilot, ChatGPT, Claude) are already deployed in production for writing data-parsing and automation scripts across many technical fields including forensics tooling.

Perform file signature analysis to verify files on storage media or discover potential hidden files.

CI 59–75 · exposure 72 · augmentation 88 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	4/5	Digital forensics is a relatively mature, high-digitization domain (law enforcement, finance, tech companies) with strong incentives to adopt efficient tools. Automated file signature analysis is already standard practice in most forensics labs and incident response teams, indicating deep, established adoption.
Sector adoption velocity	claude-sonnet-5	3/5	Digital forensics labs (law enforcement, corporate security) have adopted automated scanning tools for years, but overall sector digitization and tool modernization pace is moderate, not as fast as pure information-services adoption.
Augmentation potential	claude-haiku-4-5-20251001	5/5	AI/automated signature analysis dramatically augments human analysts by rapidly triaging and flagging anomalies, allowing humans to focus on interpretation, context, and complex investigation. The human remains in the loop for judgment and reporting, while AI handles the computational heavy lifting, transforming analyst productivity.
Augmentation potential	claude-sonnet-5	4/5	Automated signature analysis tools substantially speed up the identification of file types and anomalies, letting analysts focus on interpretation and investigation rather than manual byte-level checks.
Task automatability	claude-haiku-4-5-20251001	4/5	File signature analysis—comparing file headers against known magic numbers and identifying mismatches or anomalies—is highly automatable. Current tools (EnCase, Forensic Toolkit, Volatility, open-source hashsets) can scan storage media and flag suspect files with minimal human intervention, easily meeting the 50% time-saving threshold; however, some interpretive judgment about benign signature mismatches may still require human review.
Task automatability	claude-sonnet-5	3/5	File signature analysis (header/magic-byte matching, extension mismatch detection) is a well-defined pattern-matching task that scripts and existing forensic tools already automate heavily, but interpreting anomalies and integrating findings into an investigation still requires human judgment.It could see roughly half the workflow automated with proper tool setup.
Adoption barriers	claude-haiku-4-5-20251001	3/5	Regulatory and legal frameworks (e-discovery, chain-of-custody requirements, criminal procedure rules in many jurisdictions) typically mandate human oversight, certification, and sign-off on forensic findings, creating organizational friction. However, the automation itself is not legally prohibited; human review is the barrier rather than a licensing requirement.
Adoption barriers	claude-sonnet-5	3/5	Forensic findings often must meet chain-of-custody and evidentiary admissibility standards requiring a qualified analyst to validate and testify to results, creating moderate procedural and legal friction against full automation.
Cost vs. human wage	claude-haiku-4-5-20251001	4/5	AI/automation can perform signature scanning at near-zero marginal cost per storage unit analyzed, compared to the loaded cost of a forensics analyst ($80–150k+ annually). Even accounting for tool licensing and infrastructure, the cost per terabyte scanned is orders of magnitude lower than human labor.
Cost vs. human wage	claude-sonnet-5	4/5	Signature-matching software runs at negligible marginal cost compared to analyst hours, since it's a deterministic, computationally cheap scan over large datasets.
Technical feasibility today	claude-haiku-4-5-20251001	5/5	Mature, production-deployed products (EnCase, Forensic Toolkit, specialized Linux utilities) reliably perform file signature analysis at scale in law enforcement, corporate forensics, and incident response teams worldwide. This capability is foundational to digital forensics workflows and has been stable for years.
Technical feasibility today	claude-sonnet-5	4/5	Established forensic suites (EnCase, FTK, Autopsy, X-Ways) already perform automated file signature analysis reliably in production casework, though flagging and validation of hidden/obfuscated files still needs analyst review.

Maintain knowledge of laws, regulations, policies or other issuances pertaining to digital forensics or information privacy.

CI 40–54 · exposure 42 · augmentation 75 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	3/5	Law enforcement and government digital forensics units have begun using compliance automation tools, but adoption is slower than in commercial sectors due to rigid organizational structures and the requirement for human verification; pilot and partial adoption predominate.
Sector adoption velocity	claude-sonnet-5	3/5	Legal/compliance-adjacent tech adoption is moderate; digital forensics as a niche field lags larger legal and compliance industries in adopting AI research tools.
Augmentation potential	claude-haiku-4-5-20251001	4/5	AI can dramatically assist analysts by flagging newly relevant regulations, summarizing policy changes, and linking them to existing organizational procedures, significantly reducing the time and effort required to stay current while the analyst retains judgment on applicability and risk.
Augmentation potential	claude-sonnet-5	4/5	AI substantially aids in surfacing, summarizing, and alerting on regulatory/legal changes, saving significant research time even though human review remains essential.
Task automatability	claude-haiku-4-5-20251001	2/5	While AI can summarize and index legal documents, the task fundamentally requires interpreting regulatory changes and assessing their implications for forensic practices—a judgment-heavy process requiring contextual understanding of organizational risk and evolving precedent that current systems struggle with reliably.
Task automatability	claude-sonnet-5	3/5	AI can efficiently summarize, track, and update legal/regulatory changes and produce briefings, but validating currency and applying nuanced legal interpretation to a specific jurisdiction or case requires human judgment.
Adoption barriers	claude-haiku-4-5-20251001	4/5	Regulatory bodies and organizations typically require that qualified professionals (often with legal backgrounds or forensic certifications) certify compliance knowledge and make risk determinations; liability asymmetry means organizations cannot rely on AI-only outputs for regulatory interpretation without human sign-off.
Adoption barriers	claude-sonnet-5	3/5	No licensing requirement for staying informed, but professional certification standards in forensics often mandate demonstrated continuing knowledge, creating moderate organizational and compliance friction.
Cost vs. human wage	claude-haiku-4-5-20251001	4/5	Automated regulatory monitoring and AI-assisted legal summarization are substantially cheaper than hiring paralegals or compliance officers to manually track changes; the cost of integration and oversight is low relative to the human alternative.
Cost vs. human wage	claude-sonnet-5	4/5	AI-assisted legal/regulatory monitoring tools are far cheaper than dedicating analyst hours to continuous manual legal research, though some oversight cost remains.
Technical feasibility today	claude-haiku-4-5-20251001	3/5	Legal research tools and regulatory monitoring products exist (e.g., LexisNexis, regulatory alert services) but they require significant human curation to filter false positives and translate abstract regulatory language into practice-relevant guidance; no fully autonomous system reliably maintains compliance knowledge without expert oversight.
Technical feasibility today	claude-sonnet-5	3/5	Legal research and regulatory monitoring tools using AI exist and are used in compliance and legal fields, but accuracy on niche digital forensics regulations is inconsistent and requires human verification.

Perform web service network traffic analysis or waveform analysis to detect anomalies, such as unusual events or trends.

CI 32–53 · exposure 42 · augmentation 75 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	4/5	Law enforcement, government cybersecurity, and large enterprise security operations have rapidly adopted AI-driven anomaly detection and SIEM tools with machine learning components. Production deployment is common in information-security sectors, though investigative and court-facing roles retain higher human involvement.
Sector adoption velocity	claude-sonnet-5	3/5	Cybersecurity and digital forensics are moderately fast adopters of AI-assisted anomaly detection, with pilots and some production use, but full autonomous analysis remains uncommon.
Augmentation potential	claude-haiku-4-5-20251001	4/5	AI powerfully augments forensic analysts by automating routine alert triage, reducing time to detect anomalies, clustering related events, and surfacing suspicious patterns that humans might miss at scale. Analysts remain in the loop to interpret findings, validate evidence, and prepare for legal proceedings.
Augmentation potential	claude-sonnet-5	4/5	AI-based anomaly detection and visualization tools substantially speed up identification of suspicious patterns in network traffic or waveforms, letting analysts focus on interpretation and case-building.
Task automatability	claude-haiku-4-5-20251001	3/5	AI can automate parts of network traffic analysis (e.g., anomaly detection via machine learning on packet data, pattern matching against known signatures), but forensic analysis requires expert judgment to contextualize anomalies within investigation goals, chain-of-custody concerns, and distinguishing false positives from genuine threats. This achieves partial automation rather than full end-to-end replacement.
Task automatability	claude-sonnet-5	2/5	Anomaly detection in network traffic has mature statistical/ML tooling, but interpreting anomalies within a forensic investigation, correlating with case context, and drawing legally defensible conclusions requires human judgment that current AI cannot fully replace end-to-end.
Adoption barriers	claude-haiku-4-5-20251001	4/5	Digital forensics is subject to strict legal and regulatory requirements (evidence admissibility, chain-of-custody, compliance with e-discovery rules, potential criminal proceedings). Human forensicators are often required to testify in court and certify findings, creating a hard legal barrier to full automation.
Adoption barriers	claude-sonnet-5	3/5	Forensic conclusions often need to withstand legal scrutiny and chain-of-custody standards, creating oversight requirements, though no explicit licensure mandates a human perform the raw traffic analysis itself.
Cost vs. human wage	claude-haiku-4-5-20251001	2/5	While automated detection reduces per-alert analysis labor, the infrastructure, tool licensing, data storage, and required human oversight for forensic-grade validation and reporting mean total cost remains high relative to a single analyst's labor, especially given liability and evidence-handling costs.
Cost vs. human wage	claude-sonnet-5	3/5	Automated monitoring tools reduce manual log review costs substantially, but licensing, tuning, and the need for skilled analyst oversight keep total cost roughly comparable to human-only workflows in many forensic contexts.
Technical feasibility today	claude-haiku-4-5-20251001	3/5	Mature products exist for network anomaly detection and intrusion detection (Suricata, Zeek, commercial SIEM platforms), but they require significant tuning, human validation of alerts, and integration with forensic workflows. Deployed systems show material false-positive rates and narrow scope relative to the full forensic context a human analyst must maintain.
Technical feasibility today	claude-sonnet-5	3/5	Deployed SIEM/NDR products (e.g., Darktrace, Splunk, Zeek-based tools) reliably flag anomalies in production, but they still require analyst triage and have significant false-positive rates, especially for novel or adversarial traffic patterns.

Duplicate digital evidence to use for data recovery and analysis procedures.

CI 32–50 · exposure 47 · augmentation 75 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	3/5	Law enforcement and corporate forensics teams use automated imaging tools routinely, but deployment remains largely as part of analyst-supervised workflows rather than fully autonomous systems, reflecting both regulatory and liability caution.
Sector adoption velocity	claude-sonnet-5	3/5	Forensic labs and law enforcement have adopted automated imaging tools for years, but adoption of newer AI-driven approaches specifically is moderate and constrained by certification and legal requirements.
Augmentation potential	claude-haiku-4-5-20251001	4/5	AI can assist by automating the technical imaging task, flagging potential corruption or anomalies, and organizing metadata, substantially reducing analyst time while the human retains control over validation and legal accountability.
Augmentation potential	claude-sonnet-5	4/5	Existing forensic software substantially augments analysts by automating hashing, verification, and duplication steps, letting them focus on judgment-intensive analysis afterward.
Task automatability	claude-haiku-4-5-20251001	2/5	While disk imaging tools can automate the technical duplication process itself, the task requires validation of evidence integrity, chain-of-custody documentation, and verification procedures that demand human judgment and legal compliance. AI cannot yet reliably perform the full end-to-end task with legal defensibility.
Task automatability	claude-sonnet-5	3/5	Forensic imaging/duplication follows well-defined procedures (bit-for-bit copying, hashing verification) that specialized software already automates heavily, but chain-of-custody documentation and validation still require human oversight, so full end-to-end automation isn't yet at the 50% threshold across the whole task.
Adoption barriers	claude-haiku-4-5-20251001	4/5	Legal requirements mandate that digital evidence chain-of-custody and integrity verification typically require a qualified human analyst or technician; many jurisdictions and investigative bodies require documented human validation of forensic image authenticity and completeness.
Adoption barriers	claude-sonnet-5	4/5	Chain-of-custody and evidentiary integrity rules mean duplication must be performed and attested to by a qualified, often certified analyst for legal admissibility, creating strong procedural and legal barriers to full automation.
Cost vs. human wage	claude-haiku-4-5-20251001	2/5	Duplication hardware and software infrastructure require significant upfront and ongoing investment; the human analyst's oversight costs partially offset any savings from automation, keeping the cost ratio higher than pure technical tool costs.
Cost vs. human wage	claude-sonnet-5	3/5	Automated imaging tools reduce labor time significantly, but hardware write-blockers, storage, and analyst verification still add cost comparable to a skilled technician's time rather than an order-of-magnitude reduction.
Technical feasibility today	claude-haiku-4-5-20251001	3/5	Automated duplication tools and imaging software exist in production, but current AI systems cannot independently validate forensic evidence integrity, handle exceptional cases (encrypted or damaged media), or manage the legal and procedural requirements without human oversight.
Technical feasibility today	claude-sonnet-5	4/5	Mature forensic tools (FTK Imager, EnCase, dd/dc3dd, Cellebrite) reliably perform bit-level duplication and hash verification in production forensic labs today, though these are specialized forensic software rather than general AI systems.

Write technical summaries to report findings.

CI 39–43 · exposure 50 · augmentation 75 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	2/5	Digital forensics operates in law enforcement, legal, and highly regulated corporate environments where adoption of AI-automated reports remains cautious and slow. Pilot projects exist, but production deployment of AI-generated forensics summaries is limited by legal risk aversion and institutional conservatism.
Sector adoption velocity	claude-sonnet-5	2/5	Digital forensics and law enforcement/legal-adjacent fields are typically slower to adopt AI tools broadly due to evidentiary standards, chain-of-custody concerns, and conservative organizational practices in security and legal sectors.
Augmentation potential	claude-haiku-4-5-20251001	4/5	AI can substantially augment analyst productivity by drafting summaries, organizing findings into report structure, and flagging key evidence for inclusion, allowing the human analyst to focus on analysis quality and legal compliance rather than manual writing.
Augmentation potential	claude-sonnet-5	4/5	AI can meaningfully speed up drafting, summarizing technical logs, and structuring findings into readable reports, letting analysts focus on verification and judgment while still requiring their final review and sign-off.
Task automatability	claude-haiku-4-5-20251001	3/5	AI can automate parts of report generation—drafting template sections, organizing findings, and summarizing technical data—but requires domain expertise and legal precision that typically demand human review and finalization. The task involves synthesis of complex investigative results into legally defensible documents, where errors carry high stakes.
Task automatability	claude-sonnet-5	3/5	AI can draft technical summaries from structured findings and notes with substantial time savings, but accuracy on forensic-specific facts, chain-of-custody details, and legal admissibility requires careful human verification, limiting full end-to-end automation.
Adoption barriers	claude-haiku-4-5-20251001	4/5	Digital forensics reports are often evidence in legal proceedings, subject to discovery rules, expert testimony requirements, and chain-of-custody protocols. Liability for report errors is high, and courts typically require a qualified human analyst to certify findings, creating strong legal and organizational barriers to full automation.
Adoption barriers	claude-sonnet-5	4/5	Forensic reports are often used as legal evidence, requiring analyst certification, sworn accuracy, and potential court testimony, creating strong professional and legal barriers to full automation of the writing and attestation process.
Cost vs. human wage	claude-haiku-4-5-20251001	2/5	While AI can reduce writing time, the required human review by qualified forensics analysts means total cost savings are modest. Expert analyst time for verification and legal review dominates the labor cost, limiting the overall cost advantage to perhaps 20–30% rather than order-of-magnitude savings.
Cost vs. human wage	claude-sonnet-5	3/5	Using general-purpose LLMs for drafting is cheap, but the need for expert review, verification against forensic evidence, and formatting to legal/technical standards adds oversight cost that narrows the savings versus a skilled analyst writing directly.
Technical feasibility today	claude-haiku-4-5-20251001	3/5	Products exist (LLMs, document automation tools) that can draft summaries and structure technical reports, but forensics reports require precise language, chain-of-custody documentation, and admissibility standards. Current AI systems produce useful drafts but fall short of reliable end-to-end performance without significant human oversight.
Technical feasibility today	claude-sonnet-5	3/5	LLM-based drafting tools are already used to generate report drafts from notes in many technical fields, but no widely deployed product specializes reliably in digital forensics report writing with the precision and evidentiary rigor required in this domain.

Write cyber defense recommendations, reports, or white papers using research or experience.

CI 29–50 · exposure 38 · augmentation 75 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	2/5	Cybersecurity firms are experimenting with AI writing tools, but deployment for critical deliverables is cautious due to liability concerns and the need for expert judgment. Adoption remains in pilot phase rather than production at scale.
Sector adoption velocity	claude-sonnet-5	3/5	Cybersecurity and information security sectors are moderately fast adopters of AI tools for documentation and analysis, though production-grade autonomous report writing is still emerging rather than widespread.
Augmentation potential	claude-haiku-4-5-20251001	3/5	AI can assist by drafting initial sections, organizing technical findings, and improving prose clarity, meaningfully accelerating the early writing phases. However, the core task of synthesizing research into actionable, expert recommendations still requires the analyst's judgment.
Augmentation potential	claude-sonnet-5	5/5	AI writing assistants substantially speed up drafting, summarizing technical findings, and structuring recommendations, giving major productivity gains while the analyst retains judgment and final accountability.
Task automatability	claude-haiku-4-5-20251001	2/5	AI can draft sections of reports or summarize findings, but cyber defense recommendations require domain expertise, risk judgment, and organizational context that humans must validate. Current LLMs struggle with synthesizing novel technical insights and ensuring recommendations align with specific threat landscapes.
Task automatability	claude-sonnet-5	3/5	LLMs can draft substantial portions of reports and white papers from provided findings, but synthesizing forensic evidence, validating technical accuracy, and framing defense recommendations still requires expert review, limiting full end-to-end automation.
Adoption barriers	claude-haiku-4-5-20251001	4/5	Cyber defense recommendations carry legal and liability weight; organizations typically require a licensed or credentialed analyst to author and sign off on reports. Professional liability insurance and regulatory frameworks often mandate human accountability for recommendations.
Adoption barriers	claude-sonnet-5	3/5	No strict licensing mandates a human author, but reports often feed legal/compliance processes and require analyst attestation, creating moderate liability and credibility barriers to full automation.
Cost vs. human wage	claude-haiku-4-5-20251001	3/5	AI inference and integration costs are modest, but significant human oversight is required to validate technical accuracy and liability exposure, making the all-in cost comparable to having an experienced analyst draft from scratch.
Cost vs. human wage	claude-sonnet-5	3/5	AI drafting reduces writing time significantly, but the need for expert fact-checking and case-specific analysis keeps overall cost comparable to skilled analyst time rather than an order-of-magnitude cheaper.
Technical feasibility today	claude-haiku-4-5-20251001	2/5	While AI writing assistants exist, no deployed product reliably generates cyber defense recommendations or white papers that meet professional standards without substantial human revision. Benchmarks show LLMs produce generic content; production deployments in security firms remain limited.
Technical feasibility today	claude-sonnet-5	3/5	Generative AI writing tools are deployed for technical documentation drafting, but forensic-specific report generation with accurate evidentiary detail is still mostly human-authored with AI assisting rather than replacing.

Conduct predictive or reactive analyses on security measures to support cyber security initiatives.

CI 28–37 · exposure 30 · augmentation 75 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	3/5	Adoption of AI-assisted security tools is growing in large enterprises and financial services, but remains pilot-stage or limited in scope at many organizations. Cyber skills shortages drive interest, but conservative risk postures and regulatory requirements slow broad production deployment of autonomous security agents.
Sector adoption velocity	claude-sonnet-5	3/5	Cybersecurity is a moderately digitized, tech-forward field with growing AI-assisted SOC tools and threat detection platforms, but full agentic automation of predictive/reactive analysis is still in early-to-mid adoption stages rather than deep deployment.
Augmentation potential	claude-haiku-4-5-20251001	4/5	AI tools demonstrably augment analyst productivity by automating data ingestion, pattern matching, and alert triage, allowing analysts to focus on investigation and response. Generative AI and ML-driven insights meaningfully accelerate the initial phases of threat analysis while humans retain judgment on severity and action.
Augmentation potential	claude-sonnet-5	4/5	AI-driven anomaly detection, threat intelligence correlation, and automated alert triage significantly boost analyst throughput and detection speed while humans retain interpretive and decision-making control.
Task automatability	claude-haiku-4-5-20251001	2/5	While AI can assist with pattern detection and anomaly identification in security data, conducting end-to-end predictive or reactive analyses requires contextual judgment, threat modeling, and integration with complex organizational security postures that current AI systems struggle to automate fully. Significant human oversight and decision-making remain essential for prioritization and response direction.
Task automatability	claude-sonnet-5	2/5	This task requires integrating threat intelligence, contextual judgment about organizational risk, and forensic reasoning that current AI can support but not fully replace; only narrow sub-analyses (log pattern detection, anomaly flagging) meet the time-saving bar today.
Adoption barriers	claude-haiku-4-5-20251001	4/5	Regulatory requirements (HIPAA, SOC 2, industry compliance standards), liability for missed threats, and organizational liability exposure create strong friction against fully autonomous security decision-making. Critical security findings typically require human authorization before action, and many sectors mandate human accountability in incident response.
Adoption barriers	claude-sonnet-5	3/5	No strict licensing requirement mandates a human perform this specific analysis, but liability for missed threats, compliance audits, and need for accountable judgment create meaningful organizational friction against full automation.
Cost vs. human wage	claude-haiku-4-5-20251001	2/5	AI infrastructure (models, compute, integration) for security analysis is expensive and requires specialized setup; when factored against loaded analyst wages (often $80k–$150k+), the all-in cost per actionable analysis often remains comparable to or exceeds human delivery, especially given ongoing oversight needs.
Cost vs. human wage	claude-sonnet-5	2/5	AI tools reduce some analyst hours but still require expensive tooling, tuning, and human oversight to validate findings, so total cost savings versus skilled analyst wages are moderate rather than order-of-magnitude cheaper.
Technical feasibility today	claude-haiku-4-5-20251001	3/5	Products exist (SIEM tools, ML-based anomaly detection) that perform parts of security analysis in production, but they typically flag candidates for human review rather than delivering fully autonomous threat analysis with high confidence. Error rates and false-positive rates remain material enough that analyst review is standard practice.
Technical feasibility today	claude-sonnet-5	2/5	Deployed SIEM/SOAR tools with ML components exist and assist analysts, but end-to-end predictive/reactive security analysis in production still relies heavily on human analysts due to high false-positive rates and evolving threat landscapes.

Maintain cyber defense software or hardware to support responses to cyber incidents.

CI 28–36 · exposure 33 · augmentation 75 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	3/5	Information-sector and large enterprise adoption of automated monitoring and patching is common, but incident-response-focused maintenance automation remains in the pilot and cautious-rollout phase; smaller firms and critical infrastructure lag significantly due to risk aversion.
Sector adoption velocity	claude-sonnet-5	3/5	Security operations centers are adopting AI-assisted tools moderately quickly, but full automation of defense system maintenance remains in pilot/augmented stages rather than widespread deployment.
Augmentation potential	claude-haiku-4-5-20251001	4/5	AI-powered monitoring dashboards, anomaly detection, patch recommendation systems, and automated log analysis substantially assist analysts in prioritizing and understanding threats, even as humans retain decision authority. This augmentation meaningfully raises productivity on routine maintenance and triage tasks.
Augmentation potential	claude-sonnet-5	4/5	AI significantly aids analysts via automated alerting, patch recommendations, and configuration monitoring, improving efficiency while humans retain decision-making control.
Task automatability	claude-haiku-4-5-20251001	3/5	Much of the underlying cyber defense software/hardware maintenance—patches, updates, log rotation, system status monitoring—can be partially automated with existing tools and agents. However, the response-support aspect requires human judgment about which incidents merit escalation and how to prioritize competing defenses, limiting full-task automatability.
Task automatability	claude-sonnet-5	2/5	Maintenance of cyber defense infrastructure involves physical/hands-on configuration, patching, and troubleshooting across heterogeneous systems that require contextual judgment AI cannot fully replicate end-to-end today.'
Adoption barriers	claude-haiku-4-5-20251001	4/5	Strong regulatory and organizational barriers exist: incident response roles often require security clearances, compliance certifications, and legal accountability; many organizations mandate human sign-off on critical defense changes; liability for missed or misconfigured defenses during incidents creates friction against full automation.
Adoption barriers	claude-sonnet-5	4/5	Cyber defense changes often require accountable human sign-off due to liability, compliance (e.g., NIST, SOC2), and incident response protocols that mandate human authorization for critical system changes.
Cost vs. human wage	claude-haiku-4-5-20251001	2/5	Automated maintenance tools reduce overhead, but the cyber defense domain demands high reliability and liability tolerance; integration, validation, and the need for human oversight often keep total AI-driven costs comparable to or exceeding dedicated human analysts for mission-critical systems.
Cost vs. human wage	claude-sonnet-5	2/5	Tooling reduces some labor but ongoing licensing, integration, and required human oversight keep costs comparable to or only modestly below human-only maintenance.
Technical feasibility today	claude-haiku-4-5-20251001	2/5	Automated patch management and log analysis products exist and are deployed, but no mature end-to-end product autonomously maintains cyber defense infrastructure while reliably supporting incident response decisions without human oversight. Current systems typically require significant configuration and validation by skilled operators.
Technical feasibility today	claude-sonnet-5	2/5	Some AI-driven security tools (SOAR, automated patch management) exist but reliable autonomous maintenance of defense systems in production is narrow and still heavily supervised by analysts.

Recommend cyber defense software or hardware to support responses to cyber incidents.

CI 25–36 · exposure 25 · augmentation 75 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	2/5	Cyber defense recommendations remain deeply human-driven in practice. While some organizations use AI for threat detection and triage, the strategic recommendation of defense solutions lags adoption; most firms rely on retained experts, consultants, or vendor relationships rather than autonomous AI agents for this high-stakes decision.
Sector adoption velocity	claude-sonnet-5	3/5	Cybersecurity is a moderately fast-adopting sector with many AI-assisted SOC and threat intel tools in pilot or partial production use, but full delegation of defense recommendations to AI remains uncommon.
Augmentation potential	claude-haiku-4-5-20251001	4/5	AI can meaningfully assist by surfacing threat intelligence, enumerating candidate products, comparing features, and summarizing market research—substantially accelerating the analyst's work. The analyst remains responsible for final judgment, but AI tools can elevate productivity on research-intensive aspects of the recommendation process.
Augmentation potential	claude-sonnet-5	4/5	AI tools can quickly synthesize threat intelligence, compare vendor solutions, and draft recommendation reports, meaningfully speeding up the analyst's research and decision-making process while the analyst retains final judgment.
Task automatability	claude-haiku-4-5-20251001	2/5	Recommending cyber defense solutions requires deep context about threat landscape, organizational infrastructure, incident specifics, and risk tolerance. While AI can gather information and surface candidate products, the final recommendation demands human judgment on trade-offs, integration feasibility, and business criticality that current systems cannot reliably perform end-to-end with sufficient quality.
Task automatability	claude-sonnet-5	2/5	Recommending defense tools requires contextual judgment about an organization's specific incident, infrastructure, and threat landscape that current AI cannot fully replicate end-to-end, though it can assist with research and option generation.
Adoption barriers	claude-haiku-4-5-20251001	4/5	Strong barriers exist: cyber incidents often trigger incident response obligations under regulatory frameworks (HIPAA, GDPR, SEC); liability and reputation risks if recommendations prove inadequate; organizational preference for certified, legally accountable experts; and insurance/contractual requirements for human sign-off on critical security infrastructure choices.
Adoption barriers	claude-sonnet-5	3/5	No strict licensing requirement exists for making such recommendations, but organizational risk tolerance, liability concerns, and need for trusted judgment create meaningful friction against pure AI-driven recommendations.
Cost vs. human wage	claude-haiku-4-5-20251001	2/5	A skilled digital forensics analyst's recommendation incorporates years of domain expertise, certification, and deep incident knowledge. AI systems would require significant human oversight, validation, and liability coverage, making the all-in cost comparable to or higher than the human expert's time investment.
Cost vs. human wage	claude-sonnet-5	3/5	AI can cheaply generate candidate recommendations, but the human analyst's validation, contextualization, and accountability still add significant cost, making overall savings moderate rather than dramatic.
Technical feasibility today	claude-haiku-4-5-20251001	2/5	AI tools can research and summarize available solutions, but no deployed product reliably makes binding cyber defense recommendations in production environments. Organizations rely on expert consultants and threat intelligence teams rather than autonomous AI systems for this task, as error costs are high and liability concerns prevent delegation.
Technical feasibility today	claude-sonnet-5	2/5	AI chat assistants and some security copilots can suggest tools or configurations, but no deployed product autonomously and reliably recommends comprehensive defense solutions tailored to specific incident contexts at production scale.

Analyze log files or other digital information to identify the perpetrators of network intrusions.

CI 28–32 · exposure 25 · augmentation 75 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	3/5	Financial and government sectors have adopted AI-assisted log analysis and anomaly detection at scale, but full perpetrator identification remains heavily analyst-driven. Adoption of purely autonomous attribution is limited; most deployments are pilot-stage or hybrid human-AI models rather than production automation.
Sector adoption velocity	claude-sonnet-5	3/5	Cybersecurity is a digitized, fast-moving sector with active AI tool adoption (SOC copilots, anomaly detection), though full autonomous attribution workflows remain mostly pilot-stage rather than widely deployed in production.
Augmentation potential	claude-haiku-4-5-20251001	4/5	AI systems substantially augment analysts by automating log parsing, pattern recognition, and anomaly flagging, dramatically improving their ability to correlate events and narrow investigation scope. Analysts remain essential for final judgment, but AI tools meaningfully elevate their productivity on this task.
Augmentation potential	claude-sonnet-5	4/5	AI substantially accelerates log parsing, pattern detection, and drafting of incident reports, giving analysts strong productivity gains while they retain responsibility for final attribution judgments.
Task automatability	claude-haiku-4-5-20251001	2/5	While AI can assist in parsing and flagging anomalies in log files, identifying perpetrators requires contextual judgment, correlation across diverse data sources, and often human investigation and verification. Current AI systems lack the end-to-end capability to reliably attribute intrusions to specific actors at 50% time savings with equal quality.
Task automatability	claude-sonnet-5	2/5	AI can help parse and correlate logs, flag anomalies, and summarize timelines, but attributing intrusions to specific perpetrators requires cross-referencing threat intelligence, contextual judgment, and often legal-grade chain-of-custody work that current AI cannot autonomously complete end-to-end.
Adoption barriers	claude-haiku-4-5-20251001	4/5	Legal and regulatory barriers are substantial: law enforcement involvement, chain of custody requirements, potential admissibility in court proceedings, and organizational liability for incorrect attribution all create friction. Many jurisdictions require licensed investigators or certified professionals to sign off on forensic findings and perpetrator identification.
Adoption barriers	claude-sonnet-5	3/5	No formal licensing requirement to perform attribution, but legal/evidentiary standards, chain-of-custody rules, and organizational risk aversion around misattribution create meaningful friction against full automation.
Cost vs. human wage	claude-haiku-4-5-20251001	2/5	AI-powered security tools require significant infrastructure, tuning, and human oversight. The total cost of deploying and maintaining such systems plus required analyst oversight remains comparable to or higher than the loaded wage of an experienced forensics analyst performing the attribution work.
Cost vs. human wage	claude-sonnet-5	2/5	AI tools reduce log-triage time but the attribution phase still requires expensive skilled analyst oversight, integration with threat-intel feeds, and validation, keeping overall cost savings modest rather than order-of-magnitude.
Technical feasibility today	claude-haiku-4-5-20251001	2/5	Security tools exist for log analysis and anomaly detection (e.g., SIEM systems with ML), but these are assistive rather than autonomous. No deployed product reliably performs full perpetrator attribution end-to-end; the task requires human expertise, context, and often collaboration with law enforcement or external intelligence.
Technical feasibility today	claude-sonnet-5	2/5	SIEM/XDR products with AI-assisted anomaly detection and correlation exist in production, but genuine attribution of perpetrators still relies heavily on analyst expertise; no deployed product reliably performs full attribution unsupervised.

Develop policies or requirements for data collection, processing, or reporting.

CI 25–30 · exposure 25 · augmentation 63 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	2/5	Digital forensics organizations are moderate-to-slow adopters of AI for policy work; this remains largely a human domain requiring domain-specific judgment, regulatory knowledge, and organizational sign-off, with limited production evidence of full AI automation.
Sector adoption velocity	claude-sonnet-5	2/5	Digital forensics is a specialized, security-sensitive niche within a broader slow-moving legal/law-enforcement adoption pattern, with AI drafting tools only beginning to see pilot use for policy work.
Augmentation potential	claude-haiku-4-5-20251001	3/5	AI can meaningfully assist by generating initial policy drafts, identifying gaps in requirements checklists, and researching compliance precedents; these augmentations improve an analyst's productivity but the human retains essential judgment and validation roles.
Augmentation potential	claude-sonnet-5	4/5	AI can meaningfully speed up drafting, benchmarking against standards, and summarizing best practices for policy development, substantially aiding an analyst who retains final judgment and approval.
Task automatability	claude-haiku-4-5-20251001	2/5	Policy and requirements development requires domain expertise, stakeholder consultation, and judgment about organizational risk tolerance and legal compliance—tasks that demand human oversight. Current AI can assist with drafting and research but cannot independently author defensible policies without substantial human review and revision.
Task automatability	claude-sonnet-5	2/5	Drafting policy documents can be AI-assisted, but formulating substantive requirements for forensic data collection and reporting requires organizational judgment, legal knowledge, and domain expertise that AI cannot fully replace end-to-end today.
Adoption barriers	claude-haiku-4-5-20251001	4/5	Organizational and regulatory requirements often mandate that policies be authored and signed off by authorized personnel (legal, compliance, management); liability concerns mean institutions cannot rely solely on AI-generated policy outputs without human validation and institutional accountability.
Adoption barriers	claude-sonnet-5	3/5	While no license is strictly required to write a policy, forensic policies often need sign-off from legal, compliance, or accreditation bodies (e.g., chain-of-custody standards), creating moderate institutional and liability-driven barriers to full automation.
Cost vs. human wage	claude-haiku-4-5-20251001	2/5	Policy development is typically a one-time or infrequent engagement by senior analysts or compliance officers; AI tooling may reduce drafting time modestly but does not eliminate the need for expert human review and refinement, keeping cost ratio closer to parity than savings.
Cost vs. human wage	claude-sonnet-5	2/5	AI can cheaply generate draft text, but the bulk of cost is in expert review, legal vetting, and stakeholder alignment, so overall cost savings versus a skilled analyst's time are modest.
Technical feasibility today	claude-haiku-4-5-20251001	2/5	While LLMs can generate policy templates and requirement lists, no production system reliably outputs complete, legally sound, organization-specific policies without expert human authorship and sign-off. AI-generated policy drafts exist in tools but require extensive domain expert review before deployment.
Technical feasibility today	claude-sonnet-5	2/5	AI writing tools can produce policy drafts and templates, but no deployed product autonomously develops legally sound, organization-specific forensic data policies in production without heavy human authorship and review.

Develop plans for investigating alleged computer crimes, violations, or suspicious activity.

CI 25–25 · exposure 25 · augmentation 75 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	2/5	Law enforcement and legal sectors have traditionally adopted automation cautiously due to liability concerns and regulatory constraints. While evidence-processing tools are spreading, autonomous investigation planning remains rare in production; adoption is slower than in commercial sectors.
Sector adoption velocity	claude-sonnet-5	2/5	Digital forensics and cybersecurity investigation units are cautious adopters of AI, using it mainly for data triage rather than strategic planning, reflecting slower institutional adoption in specialized, high-stakes legal/security contexts.
Augmentation potential	claude-haiku-4-5-20251001	4/5	AI can substantially assist by recommending investigative leads based on pattern analysis, suggesting evidence prioritization, and automating preliminary data review—raising human analyst productivity in plan formulation while the expert investigator retains judgment and accountability.
Augmentation potential	claude-sonnet-5	4/5	AI can meaningfully assist by summarizing prior cases, suggesting investigative steps, flagging anomalies, and organizing evidence, boosting analyst efficiency while human judgment still drives the final plan.
Task automatability	claude-haiku-4-5-20251001	2/5	While AI can assist with evidence cataloging, pattern detection, and preliminary analysis of data logs, developing investigation plans requires understanding legal frameworks, case context, and strategic judgment about resource allocation. Current AI systems lack the contextual reasoning and accountability needed to autonomously design full investigative strategies.
Task automatability	claude-sonnet-5	2/5	Investigation planning requires judgment about legal context, case specifics, and evolving evidence, which current AI cannot reliably synthesize end-to-end; at best it can draft checklists or templates from prompts.
Adoption barriers	claude-haiku-4-5-20251001	4/5	Legal and regulatory frameworks require qualified, licensed digital forensics professionals to develop investigation plans with legal chain-of-custody accountability. Liability for missed evidence or investigative errors, combined with court admissibility requirements, create strong barriers to full automation of plan development.
Adoption barriers	claude-sonnet-5	4/5	Investigations often require adherence to chain-of-custody, legal admissibility standards, and organizational sign-off by certified/licensed forensic personnel, creating strong procedural and liability barriers to full automation.
Cost vs. human wage	claude-haiku-4-5-20251001	2/5	AI assistance for evidence analysis and pattern detection has modest cost savings, but the integration overhead, requirement for expert review, and liability exposure mean overall costs remain comparable to or exceed those of experienced human analysts designing plans independently.
Cost vs. human wage	claude-sonnet-5	2/5	Because human oversight, legal review, and case-specific judgment remain essential, AI only reduces drafting time modestly, so all-in cost savings versus a skilled analyst are limited.
Technical feasibility today	claude-haiku-4-5-20251001	2/5	No production system reliably develops digital forensics investigation plans end-to-end. Tools exist for evidence processing and analysis recommendation, but deployed systems do not generate comprehensive, legally sound investigation strategies that practitioners would trust in production without substantial human oversight.
Technical feasibility today	claude-sonnet-5	2/5	Some AI-assisted case-management and forensic tools offer templated investigation workflows, but no deployed product autonomously develops full investigation plans reliably in production.

Identify or develop reverse-engineering tools to improve system capabilities or detect vulnerabilities.

CI 25–25 · exposure 25 · augmentation 63 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	2/5	Digital forensics remains a highly specialized domain with slow digital transformation; most organizations still rely on established human experts and proprietary/legacy tools, with AI adoption lagging behind more commoditized tech sectors.
Sector adoption velocity	claude-sonnet-5	2/5	Digital forensics is a specialized, security-sensitive field with cautious tool adoption due to evidentiary and legal standards, resulting in slower AI integration than mainstream IT sectors.
Augmentation potential	claude-haiku-4-5-20251001	3/5	AI can meaningfully assist by analyzing large codebases, suggesting pattern matches in binaries, and accelerating documentation—useful for productivity—but the human analyst must validate all findings and retain judgment over tool design and vulnerability assessment.
Augmentation potential	claude-sonnet-5	4/5	AI-assisted code analysis, decompilation aids, and pattern-matching tools meaningfully speed up parts of reverse-engineering work, helping analysts prioritize and understand complex systems faster.
Task automatability	claude-haiku-4-5-20251001	2/5	While AI can assist with code analysis and pattern recognition in binaries, the core of reverse-engineering tool development requires creative problem-solving, architectural decisions, and novel vulnerability discovery that current AI systems cannot perform end-to-end. AI tools can accelerate parts of the process but cannot independently design, implement, and validate complex reverse-engineering solutions.
Task automatability	claude-sonnet-5	2/5	Reverse engineering tool development requires deep, novel technical judgment, creativity, and iterative experimentation on unknown binaries/systems that current AI cannot reliably perform end-to-end without heavy expert oversight.
Adoption barriers	claude-haiku-4-5-20251001	4/5	Digital forensics and vulnerability discovery work often occurs in regulated environments (law enforcement, government, critical infrastructure) where human certification, legal liability for tool outputs, and organizational policies require human responsibility and sign-off on tool integrity and correctness.
Adoption barriers	claude-sonnet-5	4/5	Legal admissibility, chain-of-custody requirements, and certification standards in forensics create strong barriers requiring human expert sign-off and accountability.
Cost vs. human wage	claude-haiku-4-5-20251001	2/5	The human specialist commands a high loaded wage ($120k+), and current AI systems require significant expert oversight, prompt engineering, and validation to contribute meaningfully to tool development, making the all-in cost still higher than human-only approaches.
Cost vs. human wage	claude-sonnet-5	2/5	Given the need for expert validation, custom tool development, and high stakes of errors in forensic contexts, AI assistance reduces some effort but doesn't yet undercut skilled analyst costs significantly.
Technical feasibility today	claude-haiku-4-5-20251001	2/5	No deployed products reliably perform full reverse-engineering tool development autonomously. AI code generation exists for routine tasks, but creating novel reverse-engineering tools that detect new vulnerabilities remains primarily a human domain with AI providing narrow support functions rather than end-to-end capability.
Technical feasibility today	claude-sonnet-5	2/5	Some AI-assisted tools exist for code analysis and vulnerability pattern detection, but no deployed product autonomously develops or identifies novel reverse-engineering tools in production forensic workflows.

Perform forensic investigations of operating or file systems.

CI 25–25 · exposure 25 · augmentation 63 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	2/5	Adoption of AI-driven forensic automation remains low; most law enforcement and corporate forensic teams use AI as a supplementary tool within human-led workflows rather than adopting autonomous investigation. Regulatory conservatism, liability concerns, and the specialized expertise required slow production-level displacement.
Sector adoption velocity	claude-sonnet-5	2/5	Digital forensics is a specialized, moderately digitized field with slow-moving certification and evidentiary standards, so AI tool adoption in production forensic workflows remains limited to narrow automation aids.
Augmentation potential	claude-haiku-4-5-20251001	3/5	AI can usefully assist analysts by automating triage, pattern detection (e.g., suspicious file activity), and large-scale artifact correlation, raising throughput on data processing; however, interpretation and validation remain human-driven, so the augmentation is real but bounded to support roles rather than transformative productivity gains.
Augmentation potential	claude-sonnet-5	4/5	AI-driven tools significantly speed up log parsing, artifact correlation, malware triage, and timeline generation, meaningfully boosting analyst productivity while the analyst retains interpretive and evidentiary responsibility.
Task automatability	claude-haiku-4-5-20251001	2/5	Digital forensic investigations require complex judgment about evidence relevance, chain-of-custody rigor, and interpretation of ambiguous data patterns that current AI cannot reliably handle end-to-end. While AI can assist with artifact identification and data triage, human analysts must oversee and validate findings, so the 50% time-saving threshold is not consistently met.
Task automatability	claude-sonnet-5	2/5	Core investigative work requires interpreting artifacts, reconstructing timelines, and forming legally defensible conclusions, which current AI cannot do end-to-end reliably; AI can assist with parsing and pattern detection but not the full investigation.
Adoption barriers	claude-haiku-4-5-20251001	4/5	Forensic investigations face substantial legal and regulatory barriers: chain-of-custody requirements, admissibility in court, and licensing expectations mean that a qualified human analyst must perform or sign off on findings. Liability and error costs are high, and organizations are reluctant to substitute human judgment in cases affecting prosecution or civil liability.
Adoption barriers	claude-sonnet-5	4/5	Legal admissibility, chain-of-custody rules, and certification requirements for forensic examiners create strong barriers to full automation, since findings often must be defensible in court by a qualified analyst.
Cost vs. human wage	claude-haiku-4-5-20251001	2/5	Current AI tools require significant overhead (infrastructure, forensic expertise to validate outputs, legal review), making them cost-comparable or more expensive than hiring experienced analysts for thorough investigations. The skill premium and error-cost asymmetry of forensic work keep AI cost-benefit unfavorable.
Cost vs. human wage	claude-sonnet-5	2/5	Specialized forensic software plus required human expert review and chain-of-custody documentation keep costs similar to or only modestly below fully human-led investigations.
Technical feasibility today	claude-haiku-4-5-20251001	2/5	Some commercial tools incorporate AI for disk image analysis and malware detection, but no deployed product performs full forensic investigations autonomously or with production-grade reliability. Systems exist for narrow tasks (file carving, hash matching) but not for the holistic evidence synthesis and interpretation that defines forensic work.
Technical feasibility today	claude-sonnet-5	2/5	Forensic tools use scripted automation and some ML-based anomaly detection, but no deployed product autonomously conducts full OS/file system forensic investigations without expert-driven analysis and validation.

Recover data or decrypt seized data.

CI 25–25 · exposure 25 · augmentation 50 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	2/5	Adoption is concentrated in well-resourced law enforcement and corporate forensics teams; small-to-medium organizations lag significantly. AI agents in forensics remain experimental; most workflows still depend on manual analyst expertise rather than autonomous automation.
Sector adoption velocity	claude-sonnet-5	2/5	Law enforcement and forensic sectors adopt new tech cautiously due to evidentiary standards, budget constraints, and specialized training needs, resulting in slow, uneven AI integration for this specific task.
Augmentation potential	claude-haiku-4-5-20251001	3/5	AI can usefully assist by automating pattern detection, suggesting decryption strategies, and accelerating brute-force searches, but forensic analysts remain essential for decision-making, integrity verification, and expert judgment on complex cases. Productivity gains are real but incremental rather than transformative.
Augmentation potential	claude-sonnet-5	3/5	AI-assisted tools can speed up file carving, pattern matching, and password-guessing heuristics, meaningfully aiding analysts on parts of the recovery process while decryption and judgment remain human-led.
Task automatability	claude-haiku-4-5-20251001	2/5	Data recovery and decryption require substantial human judgment about attack vectors, key recovery strategies, and forensic integrity chains. While AI can assist in pattern recognition and brute-force optimization, the unpredictable nature of encryption schemes and the need to maintain chain-of-custody make full end-to-end automation with 50% time savings at equal quality infeasible today.
Task automatability	claude-sonnet-5	2/5	Recovering deleted files or running decryption tools can be partially automated, but seized data recovery often requires case-specific judgment, chain-of-custody handling, and novel encryption schemes that AI cannot fully resolve end-to-end.dopt
Adoption barriers	claude-haiku-4-5-20251001	4/5	Legal and regulatory barriers are substantial: forensic work must comply with chain-of-custody rules, evidence admissibility standards, and often requires expert testimony from a licensed/credentialed human. Liability for incorrect recovery or data loss is high, and many jurisdictions require human certification and sign-off on forensic procedures.
Adoption barriers	claude-sonnet-5	4/5	Chain-of-custody, legal admissibility, and licensing/certification requirements for forensic analysts create strong barriers, since courts often require a qualified human expert to attest to methods and results.
Cost vs. human wage	claude-haiku-4-5-20251001	2/5	Forensic analysis requires domain expertise and expensive specialized hardware/software licenses. AI-assisted tools reduce some labor but do not yet eliminate the need for skilled analysts, keeping total cost comparable to or slightly below human-only approaches rather than orders of magnitude cheaper.
Cost vs. human wage	claude-sonnet-5	2/5	Specialized forensic tools and expert oversight remain costly; AI does not yet replace the specialized hardware/software and human expertise needed for decryption, so cost savings are limited.
Technical feasibility today	claude-haiku-4-5-20251001	2/5	Deployed tools exist for standard data recovery (e.g., commercial forensic platforms), but decryption remains highly specialized and context-dependent. Most production systems require expert oversight and cannot autonomously handle novel encryption methods or complex multi-layer scenarios without human intervention.
Technical feasibility today	claude-sonnet-5	2/5	Forensic suites (e.g., EnCase, Cellebrite) use automated carving and some AI-assisted pattern recognition, but decryption of seized data typically depends on specialized cryptographic exploits or legal compulsion, not deployed AI products performing this reliably alone.

Preserve and maintain digital forensic evidence for analysis.

CI 20–25 · exposure 25 · augmentation 50 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	2/5	Digital forensics is a specialized, heavily regulated field dominated by law enforcement, government, and corporate security teams with strong procedural conservatism. Adoption of automation remains limited to narrow, low-risk ancillary tasks (logging, deduplication); production deployment of AI for core evidence preservation is rare and cautious.
Sector adoption velocity	claude-sonnet-5	2/5	Digital forensics is a specialized, compliance-heavy niche within law enforcement/legal sectors where AI adoption is slow and cautious due to evidentiary standards.
Augmentation potential	claude-haiku-4-5-20251001	3/5	AI can assist by automating metadata logging, checksumming, storage verification, and flagging anomalies in preserved evidence, raising analyst efficiency on routine maintenance tasks. However, the high-stakes, low-error nature of the work limits how transformative this assistance can be—the human remains tightly in the loop for validation and legal sign-off.
Augmentation potential	claude-sonnet-5	3/5	AI can assist with automating repetitive documentation, hash verification, and flagging anomalies, improving efficiency, but the core preservation and custody tasks remain human-driven.
Task automatability	claude-haiku-4-5-20251001	2/5	Evidence preservation and maintenance requires careful chain-of-custody protocols, legal compliance, and contextual decision-making about what constitutes relevant evidence. While AI can assist with metadata logging and automated archival verification, the full task demands human judgment about legal sufficiency and integrity—AI cannot reliably handle the high-stakes, low-margin-for-error components that prevent ≥50% time savings at equal quality.
Task automatability	claude-sonnet-5	2/5	Some steps like hashing, imaging, and chain-of-custody logging can be scripted/automated, but proper preservation requires judgment about scope, legal admissibility, and handling volatile or novel media that current AI cannot reliably manage end-to-end.'
Adoption barriers	claude-haiku-4-5-20251001	4/5	Digital forensic evidence preservation is subject to strict regulatory and legal requirements (chain-of-custody, admissibility standards, compliance with criminal procedure rules). Courts and prosecutors require documented human accountability for evidence handling; liability and legal defensibility create hard barriers to full automation, and many jurisdictions effectively require a qualified human to sign off on preservation integrity.
Adoption barriers	claude-sonnet-5	5/5	Evidence preservation is governed by strict legal chain-of-custody and admissibility rules requiring certified human analysts to document and attest to procedures, making unsupervised automation legally untenable.
Cost vs. human wage	claude-haiku-4-5-20251001	2/5	Current AI tools for evidence handling (automated archival, deduplication) are specialized, require significant infrastructure and expert configuration, and still demand senior analyst oversight. The all-in cost (licensing, integration, validation, human review) remains comparable to or exceeds the loaded cost of an experienced digital forensics technician.
Cost vs. human wage	claude-sonnet-5	2/5	Specialized forensic software and hardware (write blockers, imaging tools) still require trained analysts to operate and validate, so AI does not yet significantly undercut labor costs for this task.
Technical feasibility today	claude-haiku-4-5-20251001	2/5	No production system exists that autonomously preserves and maintains digital forensic evidence to forensic standards. Tools exist for log aggregation and disk imaging automation, but deployed forensics platforms require human oversight of preservation workflows, and no mature product reliably handles the legal and evidentiary validation requirements without human review.
Technical feasibility today	claude-sonnet-5	2/5	Forensic imaging and write-blocking tools are mature and automated, but AI-driven evidence preservation with full chain-of-custody assurance is not a deployed standard; most tooling is procedural/software-based rather than AI-driven.

Create system images or capture network settings from information technology environments to preserve as evidence.

CI 18–25 · exposure 25 · augmentation 50 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	1/5	Adoption of autonomous AI for forensics evidence capture is negligible in practice; the industry remains human-driven due to legal liability, regulatory compliance, and case-critical accuracy. Sectors handling digital forensics (law enforcement, legal, incident response) move slowly on this specific automation.
Sector adoption velocity	claude-sonnet-5	2/5	Digital forensics is a specialized, security-sensitive field with cautious AI adoption due to evidentiary and legal risk, resulting in slower uptake of AI tools for core evidence capture tasks.
Augmentation potential	claude-haiku-4-5-20251001	3/5	AI can assist forensic analysts by automating routine imaging workflows, flagging anomalies in network configurations, and organizing captured data, but the analyst must remain in control of evidence decisions and validation to maintain legal defensibility.
Augmentation potential	claude-sonnet-5	3/5	AI can help automate scripting, documentation, anomaly detection, and metadata logging during the imaging process, improving efficiency while the analyst retains responsibility for execution and verification.
Task automatability	claude-haiku-4-5-20251001	2/5	While capturing network settings and creating system images involve routine technical steps that could be partially scripted, the task requires human judgment about what evidence to preserve, chain-of-custody decisions, and handling of sensitive systems where errors carry forensic consequences. Current AI cannot reliably end-to-end replace this without continuous expert oversight.
Task automatability	claude-sonnet-5	2/5	This task requires physical/remote access to systems, chain-of-custody procedures, and hardware/software forensic tools to create verified bit-for-bit images; AI can script or guide parts but cannot independently perform legally defensible evidence acquisition.
Adoption barriers	claude-haiku-4-5-20251001	5/5	Strong legal and regulatory barriers protect this task: forensic evidence chain-of-custody requirements, admissibility standards, and often explicit legal mandates that certified human examiners must collect and validate evidence. Courts require human expertise and accountability in evidence preservation.
Adoption barriers	claude-sonnet-5	4/5	Evidence integrity, chain-of-custody, and admissibility in legal proceedings require certified human analysts to perform or attest to the process, creating strong procedural and legal barriers to full automation.
Cost vs. human wage	claude-haiku-4-5-20251001	2/5	Integration and validation costs for AI-assisted forensics capture remain high relative to a trained analyst's wage, particularly given liability exposure and the need for human sign-off on evidence integrity. The specialized domain and low error tolerance limit cost-saving potential.
Cost vs. human wage	claude-sonnet-5	2/5	Imaging tools already automate much of the technical process at low marginal cost, but the analyst's certification, oversight, and legal defensibility requirements keep human involvement costly and necessary, limiting AI cost advantage.
Technical feasibility today	claude-haiku-4-5-20251001	2/5	No mature production system reliably performs complete digital forensics evidence capture autonomously. Specialized tools exist for imaging and network capture, but they are not AI-driven agents; human analysts must make case-specific decisions about scope, method, and validation that no deployed AI product handles independently.
Technical feasibility today	claude-sonnet-5	2/5	Established forensic imaging tools (FTK, EnCase, dd) exist but are not AI-driven; AI assistance in this specific evidentiary capture step is not demonstrated in deployed products at scale.

Write reports, sign affidavits, or give depositions for legal proceedings.

CI 0–20 · exposure 13 · augmentation 50 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	1/5	Legal departments and forensic firms are not adopting AI to replace expert testimony or signed affidavits, given evidentiary requirements and liability concerns. Adoption remains minimal and focused narrowly on drafting assistance, not autonomous document execution.
Sector adoption velocity	claude-sonnet-5	2/5	Legal and forensic sectors are cautious adopters of AI for evidentiary work due to admissibility, chain-of-custody, and liability concerns, so adoption for this specific task is slow.
Augmentation potential	claude-haiku-4-5-20251001	3/5	AI can assist by drafting report sections, summarizing evidence, or suggesting logical organization, which may speed analyst writing. However, the core task of forming expert conclusions and signing legal documents remains fundamentally human, limiting augmentation scope.
Augmentation potential	claude-sonnet-5	3/5	AI can help analysts organize findings, draft initial report language, and prepare summaries for depositions, improving efficiency while the human remains responsible for sworn content.
Task automatability	claude-haiku-4-5-20251001	1/5	This task requires human legal authority, expert judgment about case-specific facts, and sworn statements that must be personally accountable under law. AI cannot autonomously generate legally binding affidavits or depositions; a qualified human analyst must author, review, and personally sign these documents.
Task automatability	claude-sonnet-5	2/5	AI can draft portions of technical reports summarizing forensic findings, but affidavits and depositions require sworn personal attestation and testimony that cannot be delegated to AI end-to-end.
Adoption barriers	claude-haiku-4-5-20251001	5/5	Legal proceedings require an actual human expert to sign affidavits under oath and testify in depositions. Courts mandate personal accountability from the forensic analyst; this is a hard regulatory and procedural barrier that cannot be bypassed by automation.
Adoption barriers	claude-sonnet-5	5/5	Affidavits and depositions legally require a qualified human expert to swear to accuracy and be subject to cross-examination, creating a hard legal barrier to automation.
Cost vs. human wage	claude-haiku-4-5-20251001	1/5	The cost of an AI system that could generate legally sound, defensible forensic reports plus human oversight to validate and sign them would exceed the cost of the analyst simply writing the report directly, especially given liability exposure.
Cost vs. human wage	claude-sonnet-5	2/5	AI drafting may reduce time on report writing, but the legal requirement for human sign-off, review, and testimony means overall cost savings are limited relative to the sworn portions of the task.
Technical feasibility today	claude-haiku-4-5-20251001	1/5	No deployed product reliably generates legal affidavits or depositions independently. While AI can draft report text, the legal signing and deposition components require human expertise and accountability that current systems cannot provide in production legal contexts.
Technical feasibility today	claude-sonnet-5	2/5	Products exist for AI-assisted report drafting and document summarization, but no deployed system reliably produces court-ready affidavits or performs deposition testimony in production.

Adhere to legal policies and procedures related to handling digital media.

CI 3–11 · exposure 5 · augmentation 50 · click for rater detail

Panel ratings per dimension for this task
Dimension	Model	Rating	Rationale
Sector adoption velocity	claude-haiku-4-5-20251001	2/5	Digital forensics operates in regulated, high-stakes legal environments where adoption of autonomous systems is slow. Organizations remain risk-averse about ceding compliance decisions to AI, and sector culture emphasizes human expertise and accountability over automation.
Sector adoption velocity	claude-sonnet-5	2/5	Forensics is a specialized, highly regulated niche within IT/legal sectors where AI adoption for compliance-critical tasks remains cautious and slow despite broader tech-sector AI uptake.
Augmentation potential	claude-haiku-4-5-20251001	3/5	AI can assist by auto-populating policy checklists, flagging known non-compliant practices, or summarizing regulatory requirements, improving the analyst's ability to review and document adherence. However, the core judgment and sign-off remain human, limiting transformative potential.
Augmentation potential	claude-sonnet-5	3/5	AI tools can help track, log, and flag procedural steps or anomalies in evidence handling, aiding analysts in maintaining compliance, though the legal responsibility remains human-held.
Task automatability	claude-haiku-4-5-20251001	1/5	Adhering to legal policies and procedures requires understanding context-specific regulations, maintaining chain-of-custody accountability, and making judgment calls on legal compliance. AI cannot independently ensure legal adherence or take responsibility for procedural compliance in forensic investigations.
Task automatability	claude-sonnet-5	1/5	Adherence to legal policy is a compliance behavior requiring human accountability and judgment about chain of custody and admissibility; AI cannot independently 'adhere' to law in a way that carries legal weight.'
Adoption barriers	claude-haiku-4-5-20251001	5/5	Legal and regulatory requirements (e.g., evidence handling, chain of custody, admissibility standards) mandate human accountability and expert judgment. Forensic findings used in legal proceedings require a qualified human analyst to sign off, creating a hard barrier to full automation.
Adoption barriers	claude-sonnet-5	5/5	Chain-of-custody and evidentiary handling are governed by strict legal/regulatory requirements and courtroom admissibility standards, requiring accountable human analysts and often certifications.
Cost vs. human wage	claude-haiku-4-5-20251001	2/5	Current AI systems that assist with compliance checking or documentation are relatively inexpensive, but they cannot replace human oversight, and integrating them into forensic workflows with requisite review still requires substantial human labor, keeping costs comparable to or higher than unaugmented work.
Cost vs. human wage	claude-sonnet-5	1/5	Since AI cannot perform this task on its own, there is no valid AI-only cost comparison; compliance still requires human oversight and legal accountability regardless of AI tooling costs.
Technical feasibility today	claude-haiku-4-5-20251001	2/5	While AI can flag policy text or suggest procedural checklists, no deployed system can reliably ensure end-to-end legal compliance in forensic work where errors create liability and exclusion of evidence. Some tools assist with documentation but do not perform the task.
Technical feasibility today	claude-sonnet-5	1/5	No deployed product independently ensures legal compliance in digital media handling; at best AI tools log actions for human-reviewed compliance, but the adherence itself remains a human responsibility.

Related occupations — Computer & Mathematical

How to read this

A high substitution score does not mean this job disappears — it means a large share of its current tasks face replacement pressure, so the mix of tasks is likely to change. High augmentation alongside substitution typically means the occupation reorganizes around the protected tasks. Wide confidence intervals mean the rater panel disagreed: treat those scores as open questions, not verdicts.

What would change this score

New model capabilities (automatability, feasibility), falling inference costs (cost ratio), regulation and licensing shifts (barriers), and measured sector adoption (velocity) all re-enter at every index release. Each release is recomputed, versioned and kept queryable — scores are claims with a date on them, not permanent labels.