A practical look at whether ChatGPT, Claude, and Gemini are actually useful in a cyber security data breach investigation

Everyone has an opinion on AI and cyber security. Some people think it's going to replace analysts entirely, others think it's just a glorified autocomplete that hallucinates registry keys that don't exist and confidently tells you a process is malicious because it "looks suspicious." The truth, as always, sits somewhere in the middle, and Josh has spent the last couple of years trying to find exactly where that is.

Having previously researched the intersection of AI and Digital Forensics and Incident Response (DFIR), Josh is back with something more practical: a head-to-head look at how today's leading AI models — ChatGPT, Claude, and Gemini — actually perform when you throw real investigative tasks at them. Not marketing slides. Not a demo with carefully curated prompts and a suspiciously clean dataset. Actual cyber security investigation work, the kind you do at 11pm when you've got a compromised endpoint, a mountain of logs, and a client who wants answers by morning.

This talk walks through how each model handles a common DFIR scenario, from parsing artefacts and assisting analysts on what to do next or how to protect the victim's systems. You'll see where these tools genuinely save time, where they confidently lead you down the wrong path with the enthusiasm of a golden retriever, and where they flat-out refuse to help because someone somewhere decided your forensic query looked a bit too spicy.

This presentation will give you an honest, practical account of what these tools can and can't do right now, so you can start using them effectively in your investigations, rather than waiting for the industry to figure it out for you.