Definition
A structured step-by-step guide that security teams follow when investigating a suspected security or safety incident involving an AI system—for example, a Copilot assistant that leaked data, an agent that took unauthorised actions, or a model that was manipulated. It mirrors the forensic playbooks used for traditional IT incidents but adapted for AI-specific evidence and failure modes.
Why it matters
Without a dedicated playbook, security teams lack the methodology to reconstruct what an AI system did, how it was influenced, and what data was exposed. Regulators and cyber insurers increasingly expect organisations to demonstrate this forensic capability as part of AI governance.