New agentic AI capability executes investigations across live endpoints, replacing the multi-tool, collection-first workflows that slow enterprise incident response

PORTLAND, Ore., July 09, 2026 (GLOBE NEWSWIRE) -- Exterro today launched ARMOUR for FTK, bringing agentic remote investigations to the FTK Central platform without sacrificing the forensic integrity that legal, regulatory, and compliance obligations demand. Investigators ask the question; Exterro's AI performs forensics analysis across live endpoints, cloud services, identities, and communications, generating an auditable evidence record that is designed to withstand legal and regulatory scrutiny.

Unlike AI tools that stop at summarizing information, ARMOUR for FTK executes governed forensic work by connecting AI reasoning directly to Exterro's forensic technology. The capability addresses one of the biggest barriers in enterprise incident response: investigation teams still coordinate evidence across three to six separate security and forensic tools, while many legacy endpoint agents poll for new evidence only once an hour, creating delays and gaps in the evidentiary chain. By reducing manual coordination and eliminating those bottlenecks, ARMOUR for FTK helps investigators move faster while preserving the defensible evidence record organizations need when legal, regulatory, and business risk are on the line.

"Detection is only the beginning. The real difficulty comes when investigation teams need to determine what happened, understand the scope of the incident, and gather evidence to make business, legal, and regulatory decisions. We built ARMOUR for FTK so investigators can start with the question they need to answer, not the manual processes required to answer it." - Ajith Samuel, Chief Product Officer, Exterro

How It Works

ARMOUR for FTK connects natural language to forensic execution through a single, governed workflow. Investigators describe the investigative goal; the AI determines the appropriate sequence of forensic actions; Exterro's technology performs the work, evidence collection, memory acquisition, artifact analysis, event correlation, and timeline reconstruction - across live enterprise endpoints, with near-zero polling delay. Investigators receive structured findings with the full context needed to validate the incident and determine the appropriate response, while retaining complete responsibility for scope, findings, and all final decisions.

The impact becomes clear in the investigations where speed, scope, and defensibility matter most:

Ransomware response - During an active attack, investigators at large financial institutions and insurers can determine which endpoints are compromised, whether lateral movement has occurred, and which systems require immediate containment from a single investigative prompt. Deleted artifacts are recovered, memory is acquired, and evidence is correlated across live endpoints, helping teams reconstruct attacker activity faster and act before the incident expands.
Insider risk and data exfiltration - Big organizations in energy, retail, and financial services managing tens of thousands of endpoints; investigators can ask whether sensitive data was accessed, copied, or moved outside sanctioned channels, and receive correlated findings across endpoints, cloud applications, identities, and communications, backed by a documented record built for legal and regulatory scrutiny. Investigation teams across these industries told Exterro they had been waiting five years or more for exactly this capability.

The outcomes speak for themselves: faster time to scope, expanded investigator capacity, improved investigative consistency, and a single evidence-grounded record that aligns security, legal, HR, compliance, and executive stakeholders from the start.

Part of a Larger AI Strategy

ARMOUR for FTK has been shaped through an active design partner program with Fortune 500 organizations across financial services, insurance, energy, and retail - industries where the cost of a slow investigation is measured in regulatory exposure, operational disruption, and millions of affected records. A consistent theme: investigation teams have long had AI investment and endpoint reach, but no single platform that bridged the two with forensic-grade execution. ARMOUR for FTK closes that gap.

Exterro has already demonstrated the ARMOUR model in legal operations, reducing subpoena intake from 90 minutes to as little as five minutes. ARMOUR for FTK brings that same governed execution model to forensic investigations. According to Gartner®, “By 2030, more than 70% of the traditional models of manual, human-dependent forensic investigations will have been replaced by an agentic autonomous solution, which is almost entirely manual now". Rather than waiting for that future, Exterro is delivering governed AI for enterprise investigations today. To learn more about Exterro's AI strategy and the ARMOUR framework, visit https://www.exterro.com/armour

"Enterprise AI is moving from helping people find information to helping people complete governed work. Every finding must remain transparent, defensible, and investigator-verified. ARMOUR for FTK accelerates investigations without compromising the evidentiary standards that legal, compliance, and regulatory obligations demand." - Harsh Behl, VP of DFIR Product Management, Exterro

Availability

ARMOUR for FTK is available now. To learn more, visit www.exterro.com.

Source: Gartner Report, Agentic AI Is Set to Revolutionize Digital Forensics and Incident Response, By Zane West, April 2026.
Gartner is a trademark of Gartner, Inc. and/or its affiliates.

About Exterro

Exterro empowers organizations to manage data risks with a complete platform for e-discovery, data privacy, cybersecurity and governance, and digital forensics. Unlike any other software provider, Exterro makes it easy for organizations to understand their data and take swift action. Exterro's AI-driven solutions provide accurate, actionable insights, enabling businesses to support compliance efforts, reduce risks, and streamline operations while lowering costs. With Exterro, organizations gain the clarity and confidence needed to address their most critical data challenges. For more information, visit www.exterro.com.

Media Contact

Hazel Ramirez

hazel@plat4orm.com

Anamika Dhirendrakumar

anamika.dhirendrakumar@exterro.com

This item of content is a press release from a third party provider who make no warranties or representations in connection with this content and therefore PA can make no warranties in respect of its use.

Tags

More Like This

Exterro FTK Forensic Toolkit Named Winner of 2024 Fortress Cybersecurity Award

Exterro Revolutionizes Forensic Investigations with the Launch of FTK 8.0

Newly Launched Exterro FTK 8.1 Delivers Crucial Intelligence by Investigating Windows, Mobile and Mac Data on Unified Platform

Exterro Unveils ARMOUR: A Vision for Autonomous Risk Management That Redefines the Future of Enterprise Legal and Data Governance

Exterro Launches FTK Imager Pro, Unlocking Faster Access to Encrypted Evidence for Investigators Worldwide

Exterro Changes the Rules of the AI Game with Introduction of Exterro Intelligence for Legal Review and Investigations

Exterro Announces Generative-AI Powered Assistant for E-Discovery

Exterro Disrupts the Status Quo for Mobile Device Investigations