Congrats to Exterro for the announcement that Exterro launches ARMOUR for FTK! Here’s a portion of the press release, the full release is here!

Exterro Launches ARMOUR for FTK: Forensic Investigations That Start with a Question, Not a Stack of Tools

New agentic AI capability executes investigations across live endpoints, replacing the multi-tool, collection-first workflows that slow enterprise incident response.

PORTLAND, Ore. — July 9, 2026 – Exterro today launched ARMOUR for FTK, bringing agentic remote investigations to the FTK Central platform without sacrificing the forensic integrity that legal, regulatory, and compliance obligations demand. Investigators ask the question; Exterro’s AI performs forensics analysis across live endpoints, cloud services, identities, and communications, generating an auditable evidence record that is designed to withstand legal and regulatory scrutiny.

Unlike AI tools that stop at summarizing information, ARMOUR for FTK executes governed forensic work by connecting AI reasoning directly to Exterro’s forensic technology. The capability addresses one of the biggest barriers in enterprise incident response: investigation teams still coordinate evidence across three to six separate security and forensic tools, while many legacy endpoint agents poll for new evidence only once an hour, creating delays and gaps in the evidentiary chain. By reducing manual coordination and eliminating those bottlenecks, ARMOUR for FTK helps investigators move faster while preserving the defensible evidence record organizations need when legal, regulatory, and business risk are on the line. 

“Detection is only the beginning. The real difficulty comes when investigation teams need to determine what happened, understand the scope of the incident, and gather evidence to make business, legal, and regulatory decisions. We built ARMOUR for FTK  so investigators can start with the question they need to answer, not the manual processes required to answer it.” – Ajith Samuel, Chief Product Officer, Exterro 

How It Works

ARMOUR for FTK connects natural language to forensic execution through a single, governed workflow. Investigators describe the investigative goal; the AI determines the appropriate sequence of forensic actions; Exterro’s technology performs the work, evidence collection, memory acquisition, artifact analysis, event correlation, and timeline reconstruction – across live enterprise endpoints, with near-zero polling delay. Investigators receive structured findings with the full context needed to validate the incident and determine the appropriate response, while retaining complete responsibility for scope, findings, and all final decisions.

The impact becomes clear in the investigations where speed, scope, and defensibility matter most:

• Ransomware response – During an active attack, investigators at large financial institutions and insurers can determine which endpoints are compromised, whether lateral movement has occurred, and which systems require immediate containment from a single investigative prompt. Deleted artifacts are recovered, memory is acquired, and evidence is correlated across live endpoints, helping teams reconstruct attacker activity faster and act before the incident expands.
• Insider risk and data exfiltration –  Big organizations in energy, retail, and financial services managing tens of thousands of endpoints; investigators can ask whether sensitive data was accessed, copied, or moved outside sanctioned channels, and receive correlated findings across endpoints, cloud applications, identities, and communications, backed by a documented record built for legal and regulatory scrutiny. Investigation teams across these industries told Exterro they had been waiting five years or more for exactly this capability.

The outcomes speak for themselves: faster time to scope, expanded investigator capacity, improved investigative consistency, and a single evidence-grounded record that aligns security, legal, HR, compliance, and executive stakeholders from the start.

Part of a Larger AI Strategy 

ARMOUR for FTK has been shaped through an active design partner program with Fortune 500 organizations across financial services, insurance, energy, and retail – industries where the cost of a slow investigation is measured in regulatory exposure, operational disruption, and millions of affected records. A consistent theme: investigation teams have long had AI investment and endpoint reach, but no single platform that bridged the two with forensic-grade execution. ARMOUR for FTK closes that gap.

Exterro has already demonstrated the ARMOUR model in legal operations, reducing subpoena intake from 90 minutes to as little as five minutes. ARMOUR for FTK brings that same governed execution model to forensic investigations. According to Gartner®, “By 2030, more than 70% of the traditional models of manual, human-dependent forensic investigations will have been replaced by an agentic autonomous solution, which is almost entirely manual now”.  Rather than waiting for that future, Exterro is delivering governed AI for enterprise investigations today. To learn more about Exterro’s AI strategy and the ARMOUR framework, visit  https://www.exterro.com/armour

“Enterprise AI is moving from helping people find information to helping people complete governed work. Every finding must remain transparent, defensible, and investigator-verified. ARMOUR for FTK accelerates investigations without compromising the evidentiary standards that legal, compliance, and regulatory obligations demand.” – Harsh Behl, VP of DFIR Product Management, Exterro

Availability

ARMOUR for FTK is available now. To learn more, visit www.exterro.com.

Congrats again to Exterro for the announcement that Exterro launches ARMOUR for FTK! AI for forensics professionals!

So, what do you think? Please share any comments you might have or if you’d like to know more about a particular topic.

Disclosure: Exterro is an Educational Partner and sponsor of eDiscovery Today

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by my employer, my partners or my clients. eDiscovery Today is made available solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Today should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.