Investigate a suspected AI-driven security incident as both an AI-system question and a broader cybersecurity incident: verify whether activity was authorized, trace what the AI service and connected systems did, preserve relevant evidence, and contain the demonstrated risk without reflexively shutting down every AI capability. An unusual answer alone does not prove an AI compromise.
When is unusual AI behavior a security incident?
CISA’s JCDC AI Cybersecurity Collaboration Playbook defines an AI cybersecurity incident as “An occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of the AI system, any other system enabled and/or created by the AI system, or information stored on any of these systems.” The scope can therefore include connected applications, data, or systems that an AI tool can affect—not just the model or service itself.
Use that definition to frame the investigation, then apply your organization’s incident criteria. A surprising or incorrect output may result from ordinary system behavior, a configuration change, or a software defect; it is not, by itself, evidence of malicious activity. Look for evidence of unauthorized access or actions, compromised accounts, unexpected data or model changes, malicious inputs, or misuse of connected tools.
How should you triage the report?
Start by establishing what happened and what could be affected. Record the original alert or report before it is altered, and distinguish confirmed observations from assumptions.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
- Validate authorization. Check whether the reported activity could have been performed by an authorized user, service, agent, deployment, or scheduled process. Review relevant change and access records.
- Identify the affected components. Record the AI service and model, relevant data, user or service identities, and connected applications, infrastructure, tools, or systems. Note the model and configuration versions if known.
- Set the time window. Establish the earliest plausible event and the latest observed activity. Include preceding changes or access that could explain how the event began.
- Assess impact. Consider confidentiality, integrity, availability, affected business functions, and possible downstream effects. Determine what information may have been exposed or changed and what actions the system could take.
- Set response ownership. Bring in the incident lead and relevant AI-system, infrastructure, identity, data, and business owners. Add legal, privacy, communications, continuity, or provider contacts when the situation warrants it.
CISA’s federal incident-response playbook describes detection and analysis as determining whether an incident occurred and assessing its type, extent, and magnitude across systems. Treat a suspected AI event the same way: the question is not simply whether an output looks strange, but whether the evidence indicates unauthorized jeopardy to a system or information.
What evidence should you preserve?
When circumstances permit, preserve relevant evidence before making changes that could overwrite logs, alter volatile data, or change the system’s state. Follow your organization’s acquisition and retention procedures; involve counsel where legal, privacy, contractual, or law-enforcement considerations may apply. Record what was collected, by whom, when, from where, and how it was transferred or stored, so later reviewers can assess its integrity and handling.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
| Evidence category | Examples to look for | What it can help establish |
|---|---|---|
| Conventional system telemetry | Perimeter, network, endpoint, application, cloud, identity, and user-activity logs that exist; volatile memory or forensic disk images when appropriate and within the team’s capability. | Who accessed which assets, what changed, and how activity moved across connected systems. |
| AI-service activity | Prompt and completion logs, tool or agent activity, retrieval or embedding queries, and decision traces, when available and lawfully retainable. | What inputs the system received, what actions it took, and which connected capabilities were invoked. |
| AI system state and change history | Model and dataset versions, parameters or configuration, deployment records, and changes to the system. | Which system version acted and whether an unapproved or unexpected change may be relevant. |
Capture hashes or other provenance metadata using established procedures where available. NIST IR 8596, an initial preliminary draft published in December 2025, discusses dataset tracking, model metadata, investigation records, integrity, provenance, and AI inputs and outputs; it is a draft, not a finalized requirement. Missing logs, version records, or other evidence may limit what the investigation can confirm.
CISA describes Velociraptor as a way to collect and examine artifacts across a network and conduct targeted hunts. It is an optional tool example, not a CISA endorsement or an assurance that it suits a particular environment; choose collection methods based on the systems involved and your team’s capability.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
How do you determine what happened?
Build a timeline and correlate AI-service events with identity, endpoint, network, cloud, application, deployment, and data-pipeline records. Compare the activity with a known baseline and relevant change history. Investigate whether the event involved unauthorized access, malicious or unexpected inputs, changes to data or a model, misuse of connected tools, or a compromise of ordinary accounts or software.
Keep the account of the event disciplined: label what logs directly show, what you infer from the sequence, and what remains unconfirmed. Record competing explanations rather than treating correlation as proof that the AI system caused the event. If a relevant log or version was not retained, state how that gap affects the conclusion.
Rank #4
- Runs UniFi Network for full-stack network management
- Manages 30+ UniFi Network devices and 300+ clients
- 1 Gbps routing with IDS/IPS
- Multi-WAN load balancing
- 0.96" LCM status display
How should you contain the threat?
Choose containment based on observed activity, the system’s access and autonomy, the potential impact, and the cost of interrupting the service. Weigh the need to stop harm against business continuity, and preserve evidence before containment changes the system when circumstances allow.
- Revoke or rotate credentials and tokens when they may be compromised.
- Isolate an affected workload or restrict its access to sensitive systems and data.
- Limit an agent’s tools or external connections if those capabilities are implicated.
- Pause a model deployment, disable a vulnerable integration, or block malicious inputs when evidence supports that action.
Coordinate changes with system owners and relevant legal, privacy, communications, business-continuity, and AI-provider contacts. A blanket shutdown of all AI is not a universal response rule; the containment action should address the demonstrated risk while accounting for operational impact.
How do you eradicate the cause and recover?
- Remove the cause. Address the confirmed compromise, vulnerability, unauthorized access, or unsafe change. Rotate compromised secrets and remove unauthorized persistence or access where applicable.
- Restore a known-good state. Recover from approved assets or versions. Check that model, data, configuration, and tool versions are authorized, and that restoration has not reintroduced malicious changes.
- Validate dependent services and controls. Confirm that connected applications, identity controls, data flows, and security monitoring work as expected before restoring affected capabilities.
- Monitor for recurrence. Watch for related access, changes, or behavior after recovery, using the available telemetry and an appropriate observation period for the system.
What should the incident record and response framework cover?
Document the scope and impact, evidence collected and its handling, the timeline, decisions and their rationale, containment and recovery changes, notifications made, unresolved uncertainty, and lessons for future prevention and response. Maintain system-change and version history where possible. The NIST AI Risk Management Framework Playbook material recommends monitoring deployed systems and documenting incident and error processes; those records can support later analysis and improvement.
NIST SP 800-61 Rev. 3, finalized in April 2025, is the current general incident-response reference identified here. It integrates response recommendations throughout the NIST Cybersecurity Framework 2.0 and supersedes SP 800-61 Rev. 2. CISA’s phase-oriented federal playbook covers preparation, detection and analysis, containment, eradication and recovery, and post-incident activities. Its stated audience is federal executive branch agencies responding to confirmed malicious activity where a major incident has been declared or not reasonably ruled out. Other organizations can use it as a reference while following their own policies and applicable duties. The JCDC AI Cybersecurity Collaboration Playbook describes voluntary information-sharing processes for partners; it is not a universal reporting mandate.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
