AI exposure: Digital Forensics Analysts
Conduct investigations on computer-based crimes establishing documentary or physical evidence, such as digital media and logs associated with cyber intrusion incidents. Analyze digital evidence and investigate computer security incidents to derive information in support of system and network vulnerability mitigation. Preserve and present computer-related evidence in support of criminal, fraud, counterintelligence, or law enforcement investigations.
Reading this score
computed48.8% of this occupation's weighted task load is exposed, which puts Digital Forensics Analysts at the 87th percentile of 923 occupations. The capability is largely there. Its average task scores 3.1 out of 4 on what a current system can produce, and the frictions that hold other jobs in place are comparatively weak here.
What holds the line here is context. Across this occupation's 20 tasks it averages 1.80 out of 3, the highest of the five friction dimensions. In plain terms, the work depends on knowledge the model cannot hold. Much of this job runs on things that were never written down: what this particular organisation does, what happened last week, what the person across the table actually meant. That context is the barrier, and it erodes as systems are given more access.
The most exposed thing this job does is Preserve and maintain digital forensic evidence for analysis, at 80.0%. The least is Duplicate digital evidence to use for data recovery and analysis procedures, at 15.0%. A gap of 65.0% between two parts of the same job is the reason this index publishes at task level. An occupation-wide number would have hidden both.
Within computer and mathematical occupations, this one is less exposed than the median of 57.8% across the group's 36 roles, with 28 scoring higher. Being in an exposed family does not make a particular job exposed, and the reverse holds too.
What would move this score. Of 20 tasks, 15 are currently banded exposed, 4 assisted and 1 untouched. For that distribution to shift materially would take cheaper ways to verify output, since the cost of checking is currently doing more to hold this work in place than the cost of producing it. The score is re-computed every quarter against a fresh capability reference, and the change is published rather than quietly applied.
Task by task
20 tasks, O*NET 31.0| Task | Exposed | Assisted | Untouched | Importance | Band |
|---|---|---|---|---|---|
| Preserve and maintain digital forensic evidence for analysis. | 80.0% | 20.0% | 0.0% | 4.85 | exposed |
| Write and execute scripts to automate tasks, such as parsing large data files. | 80.0% | 20.0% | 0.0% | 2.95 | exposed |
| Create system images or capture network settings from information technology environments to preserve as evidence. | 73.3% | 26.7% | 0.0% | 4.48 | exposed |
| Write technical summaries to report findings. | 73.3% | 26.7% | 0.0% | 4.28 | exposed |
| Recommend cyber defense software or hardware to support responses to cyber incidents. | 64.2% | 23.3% | 12.5% | 2.89 | exposed |
| Write cyber defense recommendations, reports, or white papers using research or experience. | 61.3% | 26.2% | 12.5% | 3.16 | exposed |
| Recover data or decrypt seized data. | 60.0% | 40.0% | 0.0% | 4.12 | exposed |
| Perform web service network traffic analysis or waveform analysis to detect anomalies, such as unusual events or trends. | 58.3% | 29.2% | 12.5% | 3.60 | exposed |
| Develop plans for investigating alleged computer crimes, violations, or suspicious activity. | 55.0% | 20.0% | 25.0% | 3.92 | exposed |
| Maintain knowledge of laws, regulations, policies or other issuances pertaining to digital forensics or information privacy. | 50.0% | 25.0% | 25.0% | 4.31 | exposed |
| Identify or develop reverse-engineering tools to improve system capabilities or detect vulnerabilities. | 50.0% | 25.0% | 25.0% | 3.11 | exposed |
| Develop policies or requirements for data collection, processing, or reporting. | 45.0% | 30.0% | 25.0% | 3.52 | exposed |
| Adhere to legal policies and procedures related to handling digital media. | 40.0% | 35.0% | 25.0% | 4.81 | exposed |
| Conduct predictive or reactive analyses on security measures to support cyber security initiatives. | 40.0% | 35.0% | 25.0% | 3.06 | exposed |
| Perform forensic investigations of operating or file systems. | 35.0% | 40.0% | 25.0% | 4.50 | assisted |
| Perform file signature analysis to verify files on storage media or discover potential hidden files. | 35.0% | 40.0% | 25.0% | 4.12 | assisted |
| Analyze log files or other digital information to identify the perpetrators of network intrusions. | 35.0% | 40.0% | 25.0% | 3.70 | assisted |
| Maintain cyber defense software or hardware to support responses to cyber incidents. | 26.7% | 23.3% | 50.0% | 3.62 | exposed |
| Write reports, sign affidavits, or give depositions for legal proceedings. | 20.0% | 30.0% | 50.0% | 4.50 | assisted |
| Duplicate digital evidence to use for data recovery and analysis procedures. | 15.0% | 10.0% | 75.0% | 4.88 | untouched |
Task text and importance ratings sourced from O*NET 31.0. Shares computed. The occupation score is the importance-weighted mean.
Where the score comes from
judgedEvery task is scored through the standardised work activities it maps to. These are this occupation’s averages on the six rubric dimensions. Capability is what AI can do; the other five are what stands in the way.
| Dimension | Mean | Scale |
|---|---|---|
| Capability | 3.12 | 0-4 |
| Embodiment | 0.38 | 0-3 |
| Presence | 0.45 | 0-3 |
| Accountability | 1.25 | 0-3 |
| Context | 1.80 | 0-3 |
| Verification cost | 1.80 | 0-3 |
What this means in practice
Where most of a role's weighted task load is exposed, the work that survives is usually the part of the job nobody wrote into the job description: deciding what should be produced rather than producing it, and being answerable for the result. The tasks lowest on this page are a better guide to where to spend your time than any general advice about the future of work.
Occupations either side of this one
The four closest scores in the same occupational family, then the four closest anywhere in the index.
Read this carefully. Exposure is not displacement. A high score means current AI systems can produce this work, not that anyone will stop paying a person to do it. Adoption depends on economics, regulation and inertia that this index deliberately does not model. How the score is built.