CoWorker Lectures at Metropolitan Police Department's "Cybersecurity Expert Training" - The Forefront of AI Agents and Threat Intelligence Transforming Operations for Advanced Cyber Investigations

CoWorker Inc. (Headquarters: Shinjuku-ku, Tokyo; Representative Director: Kazuki Yamasato; hereinafter "the Company" or "CoWorker"), which develops and provides AI security solutions, conducted a lecture on "AI-Era Cyber Investigation Techniques" for police officers, primarily cybercrime investigators, as part of the Metropolitan Police Department's specialized training "Reiwa 7th Year Special Investigator Research Group," aimed at advancing cyber investigations. This training targets police officers engaged in cybercrime investigation and cybersecurity measures, assuming highly specialized personnel with knowledge equivalent to a national examination (Applied Information Technology Engineer Examination). The lecture explained the latest methods of malware analysis and attack analysis utilizing generative AI, taking into account the reality of increasingly sophisticated cyberattacks due to the spread of generative AI, and provided practical insights for strengthening investigative capabilities required in the AI era. ## Background **Sophistication of Cyberattacks in the AI Era** In recent years, the democratization of generative AI has rapidly advanced cyberattack methods. With AI, even a small number of people can carry out sophisticated attacks, creating a situation where traditional defense systems are difficult to cope with. In fact, a 2026 survey reported that AI attacks increased by approximately 89% from the previous year, and intrusion time was shortened to an average of 29 minutes. It was also reported that there were cases of a single person stealing 150GB of data, and 82% of attacks did not use viruses. Furthermore, the mass production of malware and ransomware generation exploiting LLMs, and supply chain attacks targeting developer tools are also increasing, making traditional countermeasures less effective. To respond to these changes, the introduction of new analysis and response methods based on AI is required even in the field of cyber investigation. ## Overview of "AI-Era Cyber Investigation Techniques" Lecture This lecture aimed to explain and foster understanding of investigation and analysis methods that can be applied in practice, taking into account the changes in cyberattacks in the AI era. **・The Reality of Cyberattacks Entering an Era Where Anyone Can Be an Attacker** This training first explained that the premise of cyberattacks has significantly changed due to the spread of generative AI. Individuals without specialized knowledge can now execute sophisticated attacks, ushering in an "era where anyone can be an attacker." Attacks that bypass traditional countermeasures, such as the mass production of malware exploiting LLMs and defense evasion through prompt injection, are rapidly increasing, forcing a reevaluation of the very nature of investigation and defense. This creates a situation where it is difficult to respond with investigations and defenses based on traditional premises. **・AI Accelerates Investigations**