Forensic Debt
I spent a decade answering one question for companies on their worst day. AI agents are quietly making it impossible to answer.
For about ten years, my job was to walk into the worst day of a company’s year and answer one question.
Not “are we still down.” Not “whose fault is this.” Just the one that everything else hangs on: what actually happened here — and can you prove it?
That question sounds simple until you’re the one being asked. It’s what general counsel needs answered before they can tell a regulator anything. It’s what the board wants before they decide whether this is a disclosure or a footnote. It’s what a customer is really asking when they say “was my data touched.” And for two decades, our industry has had a real discipline for answering it. Digital forensics and incident response — DFIR — is how you take a compromised system, pull the evidence, walk the timeline, and produce an account of events that holds up when someone’s lawyer reads it back to you line by line.
I’ve sat in those rooms. The good ones answer the question. The bad ones fill the silence with the most confident-sounding guess available and hope it’s right.
Here’s what’s been keeping me up lately: AI agents are quietly taking the answer away.
The day the method runs out
Picture the incident you haven’t had yet.
An autonomous agent in your environment — one of the helpful ones, the kind that books the meetings and files the tickets and touches three SaaS apps before lunch — does something it was never supposed to do. Maybe it was steered by a poisoned document. Maybe it followed a chain of tool calls right off a cliff. Maybe nobody’s sure, which is rather the point. You find out after the fact, the way you always do.
So you do what I’d do. You reach for the method. You go to investigate.
And the method isn’t there.
It isn’t there because everything that made traditional forensics work quietly stopped being true. The thing you’re investigating isn’t a server that did what it was told — it’s an actor that reasoned, that chose what to read and which tool to call and whether to escalate, and may still be choosing while you watch. There’s no single user account to pivot on, because the agent didn’t have one account; it had a fistful of non-human identities — API keys, service principals, OAuth tokens, roles — scattered across model providers and clouds and SaaS. It didn’t move at human speed, leaving a tidy trail you can read top to bottom; it took hundreds of consequential actions in seconds, across systems, before anyone looked up. And the evidence you’d want was never collected, because you deployed the agent before anyone built logging for agents.
Every one of those is a symptom of the same disease. The capability arrived. The ability to investigate it didn’t. And the gap between the two has a name, even if nobody’s using it yet.
Forensic debt
Forensic debt is the distance between what your agents can already do and your ability to prove what they did.
You take it on a little at a time, and it never feels like a decision. Someone gives the agent another tool — a write scope here, a new integration there, access to one more system that “makes it so much more useful.” Each grant is reasonable on its own. Each one also widens the gap between what the agent can now reach and what you could reconstruct if it reached somewhere it shouldn’t. The capability ships this sprint. The means to investigate it ships… later. Maybe. In the meantime the debt accrues, silently, the way debt does — because nothing feels wrong until the day something is.
And here’s the part that catches good teams off guard: you can be doing prevention perfectly and still be buried in it.
Prevention and investigation are different capabilities. One is the lock on the door; the other is the camera in the hallway. You can have the best locks in the building and still, the morning one fails, have no idea who walked through. Every control you deploy is a bet that you anticipated the attack — and some fraction of the time you’ll be wrong, because the threat was novel, the config drifted, or a human in the loop clicked approve. That isn’t pessimism. It’s the entire reason incident response exists as a profession. We build prevention knowing it fails sometimes, and we build a second thing for when it does. With agents, almost everyone is building the first thing and almost no one is building the second.
The vacuum fills itself
I wrote last time about confidence laundering — how a 60% guess becomes a stated fact on its way to the board, because fluent prose reads as truth. Forensic debt is where that gets expensive.
When you genuinely can’t reconstruct what your agent did, the vacuum doesn’t stay empty. It fills with the most confident-sounding story in the room. Not the truest story. The most fluent one. And under pressure — with a disclosure clock running and executives wanting an answer now — fluent beats accurate almost every time. So you don’t hand leadership the truth. You hand them a well-written guess, laundered into a finding, and they make a real decision on it: what to tell the regulator, what to tell the customer, whether to say the data was safe.
The antidote to a laundered story is the one thing you can’t launder: a reconstruction you can prove.
OWASP is a list of bills coming due
If you want the catalog of ways this bill arrives, OWASP already published it. In December the GenAI Security Project released the Top 10 for Agentic Applications — ten ways an autonomous agent fails in production. Goal hijack. Tool misuse. Identity abuse. Memory poisoning. Cascading failures. Rogue agents.
Read it as a list of things to prevent and you’ve read half of it. Read it as a list of incidents you will someday have to investigate, and the debt jumps off the page. Every one of those ten is a question you’ll be asked under pressure, by someone who needs an answer you can stand behind — and not one of them ships with the forensic method you’d need to answer it. The list tells you how your agent will fail. It is silent on how you’ll prove what it did.
Pay it down before the pressure arrives
The cruel thing about debt is that the worst moment to deal with it is the moment it comes due. You do not want to discover, at hour nineteen of an incident, that the logs weren’t kept, the agent was never inventoried, and the only narrative on offer belongs to whoever sounds most sure.
So pay it down early, while it’s cheap. Know what your agents can actually reach — inventory the credentials, map the blast radius before you need it. Keep the evidence that lets you reconstruct their decisions, even the ordinary logs that were never built for this; in the absence of agent-native telemetry, they’re often all you’ll have. And build — or buy — the ability to answer what did it do with proof instead of prose, before the morning you need it.
I spent a decade learning that the teams who walk out of an incident intact are not the ones with the most controls. They’re the ones who could answer the question — quickly, precisely, defensibly — while everyone else was still arguing about what their systems did three days after they did it.
Prevention will keep getting better. It will also keep failing some of the time, because that is what prevention does. The agentic era is going to run straight into the question I spent my career answering — except faster, at machine speed, against an actor that reasons. The only thing that changes is whether you’ve paid down enough of your forensic debt to answer it when it’s your turn.
You can’t prevent your way out of forensic debt. You can only refuse to take on more of it than you’re prepared to pay back.
The First 72 Hours is about exactly this kind of moment — the decisions that determine whether a crisis becomes a catastrophe. If that’s your job, or it’s about to be, subscribe and I’ll keep sending the thinking before you need it.
And if you want to see what agent forensics actually looks like in practice, I went deeper over at agentautopsy.com.