How AI and Visualisation Make Security Investigations Explainable

AI can flag thousands of suspicious events and create a clear summary of each one. But the bigger question is whether security teams can understand how AI reached its conclusions. In this episode of the Security Strategist Podcast, Dan Williams from Cambridge Intelligence joins John Tolbert, Principal Analyst and Director of Cybersecurity Research at KuppingerCole Analysts, to discuss how AI and visualisation are changing cybersecurity investigations.

They look at how graph visualisation, AI and automation can help security teams make sense of complex data. Williams explains how visualisation can turn machine output into something analysts can understand, investigate and act on, while also helping them see what AI is doing behind the scenes.

Why Use Graph Visualisation in Security?

Graph visualisation maps the links between accounts, devices, IP addresses, malware and vulnerabilities. Analysts can see how an attack connects instead of reading a list of isolated events. Williams traces the idea back to his company's roots. Before cybersecurity, Cambridge Intelligence served law enforcement, anti-fraud teams and intelligence agencies, who have long relied on link analysis. Picture the detective's wall of photos and string. It looks theatrical, but it works because mapping a problem is the natural way to get your head around it.

The approach has since been applied well beyond network mapping. Security teams now use graphs to connect threat intelligence, cloud infrastructure, industrial control systems and software bills of materials. Tolbert also points to identity, where graphs can expose links between devices, accounts and potential insider threats.

Williams cites a Wiz presentation that described a security graph containing roughly a trillion links. “Everything is a graph, really,” he says. Attackers are looking for a route from A to B, while security teams need to see those connections and understand where they lead. With a trillion links in the picture, that is not something an analyst can work through manually. AI can help sift through that volume, but it raises another question: if the system identifies a connection, can a security team see why it matters?

How Does AI Help Investigations?

AI is most useful when each approach is doing a specific job. Traditional machine learning can flag anomalies and classify activity, while generative AI can summarise the results and explain them in plain English. Visualisation then gives analysts a way to see what those findings represent.

Williams says the industry has moved beyond simply asking where AI can be added. The more practical question is whether the cost can now be justified. How much are organisations spending on tokens, and what are they getting back? He describes this as a move from exploration to explanation. Experienced investigators may still spend hours working through data without knowing exactly what they are looking for. But, he argues, there are many more people who need a clear account of what happened.

This now creates another problem because there is too much information. Machine learning can generate a long list of alerts, while large language models can add pages of text to explain them. Neither necessarily makes an incident easier to understand. Williams believes visualisation needs to be part of that process, giving analysts a way to follow the AI's reasoning and see where its findings came from.

He compared it to when you use a maps app; you are not trying to examine every road in a city. You have somewhere to go and need to get to your destination. This is what a junior analyst needs: something similar, a way through the relevant data rather than an overview of everything available. It could be a playbook, a timeline or a short interactive narrative.

Williams compares the ideal experience to watching a film, where the sequence follows an attacker from the initial entry point through to the exposed data and the misconfiguration that made it possible. If presenting an incident that way helps people understand what happened and retain the important details, he sees real value in it.

Can Analysts Trust AI Tools?

Trust depends on being able to follow how an answer was reached. That means traceability, sensible guardrails and a human being able to intervene when necessary. Tolbert points to one of the obvious problems with generative AI: a model can produce a detailed and convincing explanation that is simply wrong. Williams agrees, but points to another issue security teams will have to contend with. Investigators are accustomed to asking what filters were applied when reviewing a finding. With AI, the equivalent question becomes: what prompt produced this result? Even then, the same prompt may not return the same answer twice.

That makes a record of the process important. Teams need to be able to see what the system did, retrace the steps, repeat the analysis and share the results with others. Williams compares it to saving a query rather than relying on someone to remember exactly how they reached a finding. The need for control becomes more complicated when several visual views are connected. A network graph, timeline and map might all respond to the same request, but an AI system could apply different filters or handle the information differently in each view. A high-risk node might stand out in one representation and be overlooked in another. For Williams, that changes the question vendors need to answer. It is no longer only about how a visualisation looks, but about how reliably an analyst can control the system behind it.

His advice to CISOs is to try to draw what the AI-enabled security tool did during the previous week. If that is difficult, ask the vendor to show you. The same applies to value. If the system can demonstrate its impact visually rather than producing another lengthy report, that gives security teams something they can actually work with.

AI is likely to take on more detection and drafting, with some routine analysis running outside normal working hours. People will still need to step in when something is unusual, consequential or unclear. The useful systems will be those that can surface what matters without taking away the analyst's ability to investigate further when needed.

If you would like to learn more, listen to the full episode on The Security Strategist podcast, follow Dan Williams on LinkedIn, and find out more at cambridge-intelligence.com. 

Takeaways

• The evolution of graph visualisation in cybersecurity.
• How AI enhances security investigations.
• The role of visualisation in understanding complex data.
• Challenges of trust and explainability in AI tools.
• The shift from exploration to explanation in security analysis.
• The impact of generative AI on incident narratives.
• Balancing automation with human oversight in investigations.