The AI Investigator Is Here. Keep a Human on the Evidence.

For most security operations centers, the expensive part of a GuardDuty alert is not reading the title. It is everything that comes next: opening CloudTrail, reconstructing the identity chain, checking whether the resource belongs in production, comparing the activity with the account’s baseline, mapping the behavior to an attack technique, and deciding whether the evidence supports containment. A strong analyst can do that work. The bottleneck is that a strong analyst can only do it one investigation at a time.

Amazon’s July release of the GuardDuty investigation agent puts generative AI directly into that bottleneck. The public-preview service can investigate a finding, an account, or an AWS organization and return a risk level, confidence assessment, MITRE ATT&CK mapping, supporting detail, and recommended actions. AWS says it examines related activity from the prior 90 days, affected resources, and threat indicators, using knowledge graphs to produce an assessment in minutes.

That is a meaningful change in the economics of triage. It is not the arrival of an autonomous incident commander. The distinction matters because an investigation summary is an interpretation of evidence, not the evidence itself. Teams that automate the first without preserving the second will be faster right up to the moment they need to explain a containment decision to counsel, an auditor, or a customer.

What changed in July

The new capability sits inside GuardDuty rather than beside it. An authorized user can initiate an investigation from the console, CLI, API, SDK, or AWS MCP server. During preview, AWS supports three scopes: an individual finding, a single account, or an organization-wide assessment covering up to 100 accounts. Finding-level support is narrower: all Extended Threat Detection findings and selected findings from foundational, S3, and runtime protection plans are in scope.

The output is structured enough for operations. It includes one of five risk levels, one of four confidence levels, a summary, investigation detail, and recommended actions that may include AWS CLI commands. Three new IAM actions control creation, retrieval, and listing. Crucially, those permissions do not themselves grant permission to execute the recommended remediation. That separation is a useful control boundary and teams should preserve it.

The preview also has practical limits. It is available in ten Regions, free during preview, capped at ten investigations per account per day and 100 cumulatively per account. Organization analysis stops at 100 accounts. Those limits mean this is presently a targeted triage tool, not a substitute for a queue-processing pipeline.

The agent changes speed, not epistemology

An investigation has always moved through three different objects: an observation, an interpretation, and a decision. GuardDuty creates the observation. An analyst interprets what it means in context. An authorized incident commander decides whether to isolate an instance, revoke a session, disable a key, or declare a breach.

The investigation agent accelerates the middle object. It can correlate more context, more consistently, than an analyst working across consoles under time pressure. But its risk label and narrative remain claims generated from the evidence available to the service. A high-confidence assessment is not a forensic artifact. A plausible CLI command is not authorization to run it.

This is more than philosophical neatness. Suppose the agent attributes anomalous API calls to a deployment role and recommends disabling it. The source event may be real, while the ownership mapping is stale; disabling the role could stop a revenue workload. Or the event may be a genuine compromise, but the recommended command destroys volatile evidence the response team needs. Speed without an evidence model merely lets the organization make the wrong decision sooner.

Build an evidence envelope

For every AI-assisted investigation, retain a compact, immutable envelope around the case. At minimum it should contain the GuardDuty finding ID and original JSON, detector and Region, investigation ID, exact trigger prompt, start and completion timestamps, the complete agent response, the analyst who reviewed it, source queries used to validate it, and the final disposition with reason.

Preserve the source data separately from the narrative. CloudTrail Lake query results, relevant flow records, DNS evidence, runtime events, and resource configuration snapshots should be exported or referenced with durable identifiers according to the organization’s incident-retention policy. Hash exports when evidentiary integrity matters. The goal is not to hoard every log. It is to make the path from source event to containment decision reproducible.

Version the reasoning context as well. If account ownership, criticality, maintenance windows, or known red-team activity informs a disposition, record which version of that context was used. A later reviewer should be able to tell whether the agent was wrong, the context was wrong, or the evidence changed.

Put confidence to work

Confidence should control workflow, not decorate the report. A useful operating policy combines risk and confidence rather than treating either as sufficient.

High risk with high confidence should page a human immediately and pre-stage reversible containment steps. High risk with low or unknown confidence should trigger rapid evidence collection and a second analytical path; uncertainty is not a reason to ignore a potentially severe event. Low risk with high confidence can enter a sampled closure queue. Low risk with low confidence should remain open until cheap validation closes the gap.

No combination should autonomously execute an irreversible action during preview. The safer automation target is everything around the decision: gather the evidence, identify an owner, open the case, enrich it with business context, draft commands, and time-stamp approval. Automate preparation aggressively. Gate containment according to blast radius.

Keep prompts operationally narrow

The API accepts a free-form trigger prompt of up to 2,048 characters. That flexibility invites vague prompts such as “investigate anything suspicious,” which produce outputs that are hard to compare and difficult to audit. Use a small prompt library with explicit scope, question, time window, and expected output.

A finding prompt should ask whether the evidence supports a named hypothesis, which identities and resources are implicated, what observations contradict the hypothesis, what data is unavailable, and which reversible next steps would reduce uncertainty. Asking for contradictory evidence is especially important. It shifts the agent from storytelling toward falsification.

Treat prompt changes like detection-rule changes. Review them, version them, and test them against a corpus of closed cases that includes true positives, benign administrative behavior, red-team exercises, and findings with incomplete telemetry.

Data residency needs an explicit decision

GuardDuty Investigation uses AWS’s Cross-Region Inference Service. AWS says customer data remains stored in the Region where the request originates, while investigation data and summaries may be processed in another supported Region within the geography and are encrypted in transit over the AWS network.

That may be acceptable for many organizations. It is not a detail to discover during an audit. Regulated teams should map the published inference-routing table to their residency requirements, update data-flow records, assess whether finding context can contain regulated identifiers, and document approval before enabling the preview. GovCloud does not support the capability at present.

Measure the investigator, not the demo

The right pilot metric is not how polished the summary sounds. Run the agent in shadow mode against a representative set of incidents and measure median time to a defensible disposition, analyst minutes consumed, false-closure rate, escalation precision, evidence completeness, and agreement with the final human conclusion.

Segment the results by finding family and account type. An agent that performs well on cryptocurrency-mining detections may be less reliable on subtle identity activity. A single blended accuracy number hides exactly the variation an operating policy needs.

Also measure automation bias. Review a sample in which analysts see the source evidence without the agent’s conclusion, then compare it with reviews where the conclusion is visible. If agreement rises while evidence quality falls, the tool is influencing judgment more than improving it.

A 30-day adoption sequence

In the first week, enable the feature only in a security tooling account, create a least-privilege investigator role, confirm cross-Region processing approval, and define the evidence envelope. In week two, replay closed cases and build the prompt library. In week three, run live investigations in shadow mode with no automated closure or remediation. In week four, allow high-quality outputs to create or enrich cases while keeping disposition and containment human-approved.

The exit criteria should be written before the pilot begins: target time savings, maximum acceptable false-closure rate, required source coverage, and the finding families approved for production use. Preview quotas and pricing will change; the control model should survive both.

The real opportunity

The investigation agent is valuable precisely because senior analysts should not spend their best hours copying identifiers between consoles. If it can turn a sparse alert into a well-organized hypothesis with mapped resources and next queries, it gives those analysts leverage.

But leverage is not authority. The durable operating model is an AI system that assembles and challenges the case, a human who owns the disposition, and an evidence record that can outlive both. That model gets faster as the technology improves without making the organization dependent on any one model’s confidence.

Sources and reporting notes

• AWS announcement: GuardDuty investigation agent, July 20, 2026.
• Amazon GuardDuty Investigation documentation, including supported analyses, quotas, and Cross-Region inference.
• GuardDuty foundational data sources, consulted for telemetry scope and limitations.

---

CloudDefender helps security teams keep the resource, identity, and exposure context around a GuardDuty finding visible, so faster investigation does not come at the cost of a defensible decision.