AI has one job here.
Reduce the effort it takes to understand an investigation. Not to decide the outcome of one. Those are different jobs and only one of them can be automated safely.
Five things, done narrowly.
Summarise evidence
Turn thirty artifacts and their sources into a paragraph a duty analyst can read at handover.
Explain relationships
Say why two marbles are connected, in the order a person would explain it to a colleague.
Identify patterns
Point out that this week's finding shares infrastructure with one from four months ago.
Recommend next steps
Propose the specific action — rotate this credential, claim this subdomain — not a category of action.
Highlight uncertainty
Say plainly which parts of the summary rest on a single unconfirmed source.
Analysts make decisions. AI provides acceleration.
Every answer cites the marbles it was built from. If the citation does not support the sentence, the sentence is wrong and you can see that it is wrong.
Things it deliberately will not do.
- Close a case
- Resolution is a judgement about acceptable risk. That belongs to a person who can be asked about it later.
- Invent an artifact
- Answers are built only from evidence already in the graph. No plausible-sounding hostnames.
- Hide its uncertainty
- A confident tone over thin evidence is the failure mode we care most about avoiding.
More evidence. Less guessing.
We don't promise perfect visibility. We promise better understanding.