Writing an incident report under a 72-hour deadline is hard. The facts are still emerging, the team is exhausted, and the report has to be clear enough for a regulator who wasn't there. AI can help, but only if it is used carefully.
The risk: confident fiction
Large language models are very good at producing fluent, plausible text. That is exactly the problem in an incident report. Asked to "write a NIS2 report about this ransomware attack", a model will happily fill gaps with details that sound right but were never established. In a document sent to a regulator, a plausible guess is worse than a blank.
Principle 1: evidence in, evidence out
An AI draft should be built only from evidence that has actually been collected, and every statement in it should trace back to that evidence. If the evidence doesn't say when the attacker first got in, the draft shouldn't either; it should say that it is not yet known.
Principle 2: a draft, not a submission
The output is a starting point for the people accountable for the report. They add context the evidence can't give, such as business impact and actions taken, correct anything that is wrong, and decide what to send. Under NIS2, management is responsible for cyber risk; an AI cannot take that responsibility for them.
Principle 3: be clear about what was shared
Incident evidence can contain sensitive information. Before using any AI service, know what data is sent, where it is processed and how long it is kept, and make sure that fits your own data protection obligations.
How Tracknosis approaches it
Tracknosis drafts a NIS2 or CIRCIA incident report from the changes it collected: the files and registry keys that were added, edited or deleted, their risk ratings, and tampering findings such as cleared logs. The draft is meant to be reviewed and completed by your team before it goes anywhere. Used that way, AI saves hours of writing without putting a single unchecked claim in front of a regulator.
Writing reports by hand? Get our free NIS2 & CIRCIA incident report templates, with guidance on the evidence each report needs and a worked example.
See what changed on your Windows machines
Tracknosis gives you proactive forensic monitoring and continuous forensic observability for Windows Infrastructure.
Contact Us More articles