Cyacomb blog

Triage vs Analysis: What is the Difference in Digital Forensics? | Cyacomb

Jeffrey Bell — Mon, 13 Jul 2026 13:18:47 GMT

Digital forensic investigations often involve the examination of large volumes of data, which require careful planning and effective tools to streamline the process. Two crucial approaches used in digital forensics are triage and full forensic analysis. While they are both key components of investigations, they serve distinct purposes and are applied in different contexts. In this blog, we will explore the definitions, purposes, applications, timeframes, and outcomes of triage and analysis, as well as highlight the key differences between the two approaches. We’ll discuss how leveraging triage can enhance the analysis process and introduce Cyacomb Forensics as an effective tool for digital forensic investigators.

Triage

Definition:
Triage in digital forensics refers to the process of quickly assessing and prioritizing digital evidence based on its relevance and urgency. This process focuses on identifying critical data points that may require immediate attention.

Purpose:
The primary goal of triage is to identify the most critical data, such as key CSAM images and videos, running processes, or active network connections, that may be highly relevant to an ongoing investigation or incident. This can include situations where immediate actions are necessary to secure evidence, stop malicious activity, and focus on key devices for seizure (1)

Application:
Triage is often used in time-sensitive scenarios such as live incident responses or cases involving large volumes of digital evidence. For example, in child exploitation cases, where time is of the essence, triage can help investigators quickly narrow down important leads or identify and rescue a victim of a crime (1)

Timeframe:
Triage is designed for speed and efficiency. Often used in time-sensitive scenarios (e.g., child exploitation cases)

Outcome:
Triage provides a preliminary understanding of the evidence and helps prioritize which data should undergo further, more detailed analysis. It offers a snapshot of key insights without delving into the full depth of the data (2)

Analysis

Definition:
Analysis in digital forensics involves a thorough and in-depth examination of digital evidence to understand its origin, content, and significance in an investigation.

Purpose:
The purpose of analysis is to uncover detailed insights, patterns, and relationships within the data. This phase often involves time-consuming and comprehensive methods to extract and interpret digital evidence, ultimately producing findings that can be used in legal proceedings or further investigative steps.

Application:
Full forensic analysis is typically conducted after triage has been completed. Investigators utilize specialized forensic tools to examine file systems, recover deleted files, analyze metadata, and reconstruct timelines of events. It is essential for uncovering deeper, more conclusive insights into a case (3)

Timeframe:
Unlike triage, analysis is a more time-intensive process. Depending on the complexity of the data and the investigation, this phase can take days, weeks, or even longer. It is a meticulous process that leaves no stone unturned.

Outcome:
The outcome of forensic analysis is a complete and comprehensive understanding of digital evidence, often used to support legal proceedings or guide further investigative actions. This phase ensures the evidence is thoroughly examined, interpreted, and documented.

Key Differences Between Triage and Analysis

Depth:
Triage is a surface-level process aimed at quickly identifying key evidence, while analysis is a deep, comprehensive examination that uncovers detailed insights and patterns.
Time:
Triage is rapid, designed to provide quick results within a short timeframe, whereas forensic analysis is time-consuming and can extend over several days or weeks depending on the complexity.
Purpose:
The purpose of triage is to guide investigators toward critical evidence and prioritize further investigation, while forensic analysis seeks to answer specific investigative questions and provide conclusive findings.
Data Collection:
Triage often involves selective data collection, focusing only on high-priority evidence, while forensic analysis usually entails complete disk imaging and the examination of all available data (4)
Resource Intensity:
Triage is less resource-intensive and is ideal for rapidly assessing multiple systems or devices. Forensic analysis, on the other hand, requires more resources such as time, manpower, and advanced tools to produce a thorough examination.

Enhancing the Analysis Process with Effective Triage

Triage plays a vital role in enhancing the overall efficiency of digital forensic investigations. By helping investigators quickly focus on the most relevant data, triage can significantly reduce the time and resources required for full forensic analysis. A well-executed triage process allows investigators to prioritize the evidence that is most critical to the case, ensuring that in-depth analysis is applied to the most valuable data.

In many cases, effective triage can prevent investigators from wasting time on irrelevant or low-priority data. This streamlined approach not only improves the overall quality of the investigation but also enables investigators to address more cases in less time.

A Powerful Tool for Digital Investigators

Cyacomb Forensics is a leading solution that provides investigators with the ability to quickly and effectively triage multiple digital devices, whether on-site or in a forensic lab. Cyacomb’ s fast, simple, and thorough approach to digital forensics makes it an essential tool in modern investigations.

With Cyacomb, investigators can dramatically reduce the time spent on devices, allowing resources and manpower to be reallocated to other cases. By incorporating Cyacomb into your digital forensic toolkit, you can enhance your ability to swiftly prioritize critical evidence and improve the efficiency of your investigations.

In conclusion, both triage and full forensic analysis play important roles in digital forensic investigations. While triage helps investigators quickly identify key evidence, full forensic analysis provides the in-depth understanding needed for legal proceedings and comprehensive case resolution. Combining the strengths of both approaches, and using tools like Cyacomb Forensics, can dramatically enhance the effectiveness of any digital forensic investigation.

(1)www.forensicfocus.com/articles/the-differences-between-full-disk-and-triage-acquisition

(2) www.paraben.com/why-is-triage-a-good-step-in-digital-forensics

(3) www.iacpcybercenter.org/investigators/digital-evidence/understanding-digital-evidence

(4) www.cybertriage.com/features/digital-forensics-data-collection

Chris Noble joins Cyacomb as VP of Product & Design | Cyacomb

Stephen Hughes — Mon, 13 Jul 2026 13:18:46 GMT

Cyacomb is further strengthening its team with the addition of Chris Noble, an experienced product leader, in the new role of VP Product and Design.

Chris joins Cyacomb from Facebook (META) where he led product initiatives across Facebook, Messenger and Meta VR.

Across all his roles, Chris has been key in driving product growth at scale, and his work at Facebook touched over 2.7 billion users.

Chris is a 15-year high-impact B2B and Software as a Service (SaaS) veteran and consumer product leader. Chris has spent his career building popular and unique products that change the market or that were “new to market” solutions.

This experience and skillset is ideally suited to leading the next stage of Cyacomb’s product growth in the Digital Forensics and now also Online Safety markets.

“I’m passionate about the integrity of people’s experiences online, and when using technical products. I’m looking forward to driving greater communication and research with our customers, working with law enforcement to catch perpetrators of illegal imagery, and social media and messaging apps to block and prevent harmful content.” - Chris Noble

Ian Stevenson, CEO Cyacomb, said: “We’re delighted to appoint Chris to lead the evolution of Cyacomb’s global product strategy. Chris brings direct experience of working in the markets we seek to serve. I’m looking forward to Chris’ input in developing our strategic thinking and building our product team to support our vision of a world where no harmful digital content can be hidden or shared.”

Introducing our new name…Cyacomb | Cyacomb

Ian Stevenson — Mon, 13 Jul 2026 13:18:45 GMT

Our company has come a long way since starting out in 2016. We’ve seen fantastic success and growth over the last few years and built up an incredibly talented and committed team.

We’re all delighted with the ever-increasing impact our technology is having in counter-terror and child sexual abuse investigations. Seeing our tools making a difference, not just in the UK, but in the US and Canada too, has been really exciting.

It’s because of this growth, and our ongoing product diversification, that we have made the decision to officially change our name from Cyan Forensics to Cyacomb.

The new name retains much of our existing brand heritage, but this change was made to ensure the company has the right identity and brand to take us to the next level of our growth, as we expand into new international territories and enter new product markets.

Cyacomb’s suite of products will adopt our new name, with Cyan Forensics becoming Cyacomb Forensics; and Cyan Protect becoming Cyacomb Safety.

Our new name is now in use with immediate effect and is reflected across our online assets, including our new website and our various social media channels.

Our customers will also soon see a transition in the branding of our tools, as with our presence at upcoming events and trade shows at home and abroad.

As we look ahead to the future, we’ve so many fantastic opportunities to take the company forward, and we’re really excited to be starting this new chapter as Cyacomb.

Start-of-the-Year Online Safety Overview | Cyacomb

Ian Stevenson — Mon, 13 Jul 2026 13:18:44 GMT

It's an extremely busy start to the year in the world of Online Safety.

In the UK Ofcom continues to publish new codes and consultations as the Online Safety Act takes effect, generating hundreds (or even thousands of pages) for us all to try to make sense of, and respond to where appropriate. The government is revisiting the recommendations of the Independent Inquiry into Child Sexual Abuse, and considering new legislation to implement them.

In the EU we continue to see progress in implementation of the Digital Services Act, and debate about the long awaited new regulation on Child Sexual Abuse Material.

In the US President Trump takes a very different stance seeing Online Safety measures as unnecessary and undesirable, and in response we're seeing platforms withdraw fact checking and moderation from certain areas. At the same time state rules about protecting children from pornographic content with age assurance technology are being tested in the supreme court.

Amidst all of this activity on the government and regulatory side, the Safety Tech sector continues to grow. PUBLIC published the International State of Safety Tech 2024 report highlighting activity in the sector, and it's great to see the growth and success stories captured there. It also highlights significant challenges. Key amongst these is that now regulation is in progress it has become likely it will be the major driver of safety tech adoption, the corollary.

However, overall many platforms still lack what seem like even the most basic safety technology to keep their users and the wider population safe.

In some cases there have been genuine barriers, and safety tech companies are helping address them. Cyacomb recently published work in partnership with the Internet Watch Foundation demonstrating how we can provide far lower cost blocking of Child Sexual Abuse Material. It also uses Privacy-by-Design to ensure that users data is fully protected, simplifying integration from a data protection perspective. This work is highlighted in the International State of Safety Tech report.

In other areas technologies aren't yet in use because there is still a policy debate happening about what we should do. Cyacomb has demonstrated a secure, privacy protecting solution for detecting Child Sexual Abuse Material in End to End Encrypted Messaging. We developed Cyacomb Safety as part of a UK Government funded Safety Tech Challenge Fund project, and we continue to speak regularly with governments and regulators (in the UK, EU and beyond) to explain what technical capability this provides, supporting the efforts of other cybersecurity experts. In the UK, Ofcom's Technology Notices Consultation explores the powers that apply in this area.

We've already had a busy start to the year, and at Cyacomb we are delighted to see increasing recognition of the problems - a vital first step towards a solution. Humankind discovered fire as a source of warmth, heat for cooking and later energy to power an industrial revolution. Over the centuries, fire has caused horrendous destruction but from this we learned to tame it, at first in simple ways and then ever more sophisticated ones. Technology connects us, educates us, and powers endless innovation. Alongside benefits, dangers lurk. Child sexual abuse, grooming, sextortion, fraud, scams, all causing real harm and often focusing it on the most vulnerable in society. Ignoring these threats is like pretending a leaking roof will stop on its own. To start the new year we've created a new video to highlight our digital world's triumphs, illuminate its dangers, and remind everyone that we can start to overcome these if only we have the will.

Block Child Abuse Online. Save lives.

To learn more, contact us here.

Ian Stevenson customer conversations at Techno and in DC | Cyacomb

Ian Stevenson — Mon, 13 Jul 2026 13:18:44 GMT

I love getting out and meeting our customers, and people who I think our technology could help. This means I meet a lot of people working in law enforcement, and specifically in units dealing with Child Sexual Abuse and Exploitation. This is not a career choice that people make for money or glory. This is something people are driven to do by a desire to make the world safer for children, and inhospitable for those who prey on them. This is a job people want to do properly, and I couldn't agree with them more. Supporting this mission, even just as a software vendor, is a privilege and a responsibility.

Investigators recognise that any triage activity, whether it's scrolling through a suspect’s pictures to see what you can find or using a special purpose tool, is going to be a compromise. For some, this draws into question whether triage is a useful step, or whether it introduces a risk of missing vital evidence. Missing evidence that could safeguard a child or convict an offender is, of course, a disastrous outcome and one that no-one wants to risk. So should modern rapid triage techniques have a place in this kind of investigation at all?

First do no harm

Every customer we work with had a process in place before we meet them. These processes vary widely. Some agencies dealing with serious cases are able to deploy significant forensics resources on-scene every time they serve a warrant. Other agencies rely on detectives to serve warrants and "bag and tag" digital devices for later analysis in a lab. In every case agencies are doing the best with the workload and resources they have available, and have designed these processes to balance risk in their investigations.

We have a number of former police forensic analysts in our customer success team. When we start working with a new customer this team works to support them in fully understanding our technology and adapting that process to use modern rapid triage effectively. We help our customers put in place updated processes on the principle of "Do no harm". The new process should offer opportunities to get evidence faster, make better decisions, and direct resources. It should never result in a situation where a child is put in danger or an offender slips through the net as a result of the triage process. The "fail safe" if triage doesn't find anything should be to revert to the existing process exactly as it stood before.

A waste of effort?

This approach often gives rise to the question "If we're doing all the steps from the existing process anyway, isn't triage just a waste of time?". That depends on whether timing is important.

If every person involved in an accident is going to be seen in the emergency room anyway, why triage? The answer is that the person with a serious bleed needs to be seen immediately or they will die, while the person with whiplash can safely wait a little longer. The ultimate outcome of triage is that everyone is still seen, but the sequence of events matters.

The same applies in digital forensic triage. Our customers tell us that by getting evidence fast they can act fast, and those actions can make a big difference to the course of an investigation.

Timing matters

In one case fast action saved a child who was being actively trafficked. Their previous process involved sending equipment to a lab for analysis. Without triage, that child would have been moved on before they could be rescued.

In another case triage showed that not only was the father in a family accessing triage CSAM, a teenage son was too. This led to an interview with the son that identified him as a victim of contact abuse and enabled immediate safeguarding and support. Their previous process would not have uncovered this for days or weeks, leaving a vulnerable teenager unsupported and at risk.

In each case the existing process would have found the same things we pointed to at triage (as well as many things we didn't), but getting that fast initial look at devices had, in the opinion and experience of the officers concerned, a profound impact on outcomes.

Trade-offs in risk

We always start with a "first do no harm" approach at the investigation level, but as customers become more familiar with our capabilities (and limitations) some choose to take a broader view on risk that includes the work they are not doing.

For example, some customers have a significant backlog of cases where they have intelligence sufficient to get a search warrant, but lack the digital forensics capacity to carry out those investigations. They see opportunities to carry out more investigations if they could seize fewer devices on each case. They see that when they seize every electronic device at an address, many of them tie up lab time without yielding anything useful - especially when they belong to partners, children or room-mates. Appreciating this they look at how they can build risk based approaches to reducing the number of devices seized, often incorporating Cyacomb as part of that process.

This can free up capacity in the lab to take on more investigations, or allow lab-based expertise to be focussed efficiently on detailed work. It also reduces collateral intrusion (loss of privacy arising from searching devices belonging to people who have committed no crime) and the victimisation of people who have done no more than share a home with an offender. Where a suspect is arrested on suspicion of child related offences, their family members are in a horrific situation already. Depriving them of the devices they use to socialise, connect and work can only make an already horrific situation worse.

Any such trade-off has to be at the discretion of officers. It should never be as simple as "a clear triage result means no further action" for a device or person, as we emphasize in our training. However if an officer has no concerns and thinks family members are low risk after interacting with or interviewing them and triage gives a clear result, is clogging up the lab with these devices "just in case we missed something" a better outcome than leaving that capacity to take on another investigation?

That is not a question we, as a vendor, can ever answer. We can only ever support that conversation with transparency about both the capabilities and limitations of our tools. However, we recognise that in some situations it may be reasonable to trade off the risk from the investigations NOT being carried out due to lack of capacity against the risks of missing something in

Digital triage does no harm

Digital Forensics Triage, correctly deployed, does no harm.  It takes an existing process and creates new opportunities some of which can save lives.  At worst triage identifies nothing, and the investigation falls back to whatever that process was before. 

For organisations already suffering under severe constraints and struggling to cope with the corresponding risk, triage can offer alternative trade-offs between time spent on individual cases and the number of cases processed.  There is no "one size fits all" approach to quantifying these risks, but Cyacomb works with customers to ensure an appropriately high level of rigor in implementing any such trade-off.

“Cyacomb Examiner Plus is super easy to use and the ability to scan multiple devices at once saves my team time on scene. It definitely helps us to prioritize devices which ultimately saves us time, potentially weeks"

- Southern Californian Agency

If you'd like to explore how Cyacomb can help save you time so you can save lives, please get in touch.

Email - sales@cyacomb.com

Call - +1 214-218-0630 (US) | +44 131 608 0195 (UK & EU)

Trial - request a trial.

Cyacomb's Jeffrey Bell, Brandon Gardner, Alan McConnell on the Facets of Digital Forensic Triage | Cyacomb

Cyacomb — Mon, 13 Jul 2026 13:18:43 GMT

This week Cyacomb's Jeffrey Bell, Brandon Gardner & Alan McConnell, joined Si Biles and Christa Miller on the Forensic Focus podcast.

The podcast covers our background, our technology, our values and the facets of digital forensic triage

A big thank you to Christa and Si for having us on the podcast. You can find the podcast below.

Charge and prosecute faster with Contraband Export | Cyacomb

Cyacomb — Mon, 13 Jul 2026 13:18:42 GMT

Cyacomb Forensics tools were created to support users in finding evidence in seconds in order to safeguard victims and bring offenders to justice as quickly as possible.

The new Contraband Export feature allows users to export supporting evidential material and helps expedite charging and prosecution. In many legal jurisdictions, copies of the illegal material found by Cyacomb Examiner Plus need to be submitted alongside reports when the suspect is charged. The new Contraband Export feature makes this possible as users no longer need to rely on additional resources, which ultimately optimises the forensic process.

The 3.2 release also introduces reporting improvements which simplify workflow for creating multiple reports and different report types tailored to specific audiences. These new features offer more flexibility, speed and efficiency, enabling users to quickly gather evidence to support convictions and safeguard more victims.

What does 3.2 offer users?

Quicker prosecutions – the ability to export supporting evidence improves speed and efficiency for users
Free up resources – allowing investigators to handle basic evidence collection can free up overwhelmed specialized units
Cost-effective solution – reducing the reliance on specialized units can lower the financial burden of forensic analysis
Preservation of evidence – ensure evidential material is exported on-scene before potentially being lost
Reporting workflow – straightforward reporting workflow with ‘single save’ option for multiple files
Reporting flexibility – reports for different use cases such as Standard, easy-to-understand, Reports for Prosecutors and Technical Reports for lab-based investigators

Charge and prosecute faster with Contraband Export

Watch the above demo to learn more or request a tailored trial and see how the tool can address the challenges that matter to you most.

Portable Digital Forensics: Navigating Frontline Investigations | Cyacomb

Ian Stevenson — Mon, 13 Jul 2026 13:18:41 GMT

Portable Digital Forensics

When the world was simpler, in a bygone era, few cases involved digital evidence. Those that did concerned very few devices, and those devices had limited storage and complexity.  As a result, the science of Digital Forensics developed with a focus on understanding every single artefact on a device.

As volume and complexity increased, digital forensics software evolved from presenting the 1s and 0s to providing sophisticated ways to extract, view and manage larger volumes of evidence.  Automation came into workflows to ensure analyst's time was not wasted on routine tasks, and content analysis (from "pink filters" to advanced AI) arrived to help focus analyst's efforts on the most relevant content.  

In some cases, speed at the front line is important, and portable or triage versions of a number of forensics tools were created, to support the work of an analyst who has gone out with a team serving a search warrant, and to enable them to get results in the field.   

Some of these tools focus on doing things that can only be done in the field (such as RAM capture or probing home networks).  Most were conceived by looking at what an analyst does in the lab and trying to translate it into a portable and abbreviated format.  As a result, they struggle with a fundamental compromises.  Fast or thorough?  Fast or accurate?  Portable or complete?  For experts or field users?  

While these tools are often described as being used for "triage", what they offer is actually a pale shadow of the original meaning of triage. 

What is Triage?

 The Oxford English Dictionary describes triage in its original medical context:

"To perform a preliminary assessment (of a patient) in order to determine the nature and degree of urgency of treatment required"

Looking across the Atlantic, Merriam-Webster follows a very similar pattern:

"The sorting of and allocation of treatment to patients and especially battle and disaster victims according to a system of priorities designed to maximize the number of survivors"

The concept is clear.  Triage is not about diagnosing or treating patients. It is about prioritising patients for more detailed diagnosis and treatment.  Triage identifies where immediate attention is needed and where it is not.  It should identify those who will bleed or suffocate if not helped immediately.  It is not about determining precisely how a patient with serious bleeding should be treated, or for those at no immediate risk, diagnosing whether someone's ankle is sprained or broken.

The output of the triage process is prioritisation for medics to come in and take immediate action with the patients that need it most.

These definitions of triage don't fit very comfortably with the classic Digital Forensics approach to triage.  What is often called triage in Digital Forensics seems more like a doctor sitting down with a patient and taking the first steps towards diagnosis.

Triage that works

Triage is about prioritisation, and a key aspect is being able to make decisions about many devices in a short space of time, right at the start of a process.

Medical triage is a process that allows a first responder to separate those needing immediate attention from those who can wait for attention, and those who might need no attention at all.  In some cases that first responder may be a doctor, but they might also be a nurse, first aider, police officer or medical corpsman.

By analogy, the job of digital forensics triage should be to find the devices and evidence that can drive immediate action (arrest, safeguarding), those that are suspicious (perhaps due to high levels of encryption or other indications of offending behaviour) and those that don't offer immediate results.

This is what Cyacomb Forensics aims to accomplish.  We strive to empower people at the front line (whether they are investigators, probation officers, border officials or digital forensic analysts) with the information they need to act, and to do so in a time-frame compatible with their role (seconds or minutes, not hours or days).

Start with Outcomes

To deliver effective triage we start by looking at the operations and processes we support, and look at the key questions that need to be answered.  Those questions can vary depending on the situation:

 Is this person offending?
Is this person re-offending?
Which person in this home is offending?
Which devices is this person using to offend?

Answering these questions helps to direct the search or investigation.  Often our users are working to a process which can be expressed as a flowchart.  Our objective is to align our outputs with the decision points on that flowchart, or to enable new decision points that improve the overall process.

Powering Decisions

While we align our tools with those decision points, we are not in the business of trying to automate decisions.  At the simplest level we present a result that is Red / Amber / Green. 

Red indicates we found strong evidence of offending.

For example a match against a database of known CSAM.  In some scenarios this may be sufficient to enable a decision, however, we provide the ability to manually verify this result before making a decision (assuming the situation is appropriate and user qualified to do so).

Amber indicates we found something that requires further consideration.

This may be something indicative of or concealing offending and could include matches against non-CSAM images which usually circulate as part of a CSAM series, filenames often associated with CSAM, or indications of unexpected encryption.  Again, in some scenarios this will enable a decision (usually to seize the device for further analysis).  We also allow the user to see more detail, which is carefully prioritised to highlight exactly what they need to know.  We try to avoid providing long lists of highly technical artefacts (although they are there if you need them) in favour of clear prioritisation and flagging.

A green result indicates we didn't find anything. 

That doesn't mean there's nothing there.  We're looking for information to enable fast decisions, and there are many categories of data that we can't access at speed.  For example, a device could contain first generation content or grooming chats that we're not going to find.  This doesn't mean we ignore these devices - it just means they aren't yielding information to enable decisions in a triage timescale.  Just like in medical triage an apparently well patient could have a slow internal bleed or high risk of secondary drowning.  This may be less urgent, but cannot be ignored.

An Extra Opportunity

Medical triage doesn’t necessarily change the number of people seen by a doctor or admitted to hospital, but it does ensure that resources are directed where they are needed most urgently and can do the most good.  It is this model of triage that Cyacomb embraces.

Time and time again our customers come to us with examples of how real triage helps them make decisions that accelerate investigations and power safeguarding.  Just a few very quick examples:

Cyacomb helped triage out several devices and associated residents. This allowed detectives to quickly focus on the devices and resident that mattered and led to freeing of a live victim from being actively trafficked.  Speed allowed officers to intervene before the victim could be moved on.
In a search at a family home, Cyacomb identified CSAM on devices belonging to both a man and his teenage son. Officers recognised the son was a victim of sexual abuse who had become addicted to CSAM, and were able to take prompt safeguarding action in a situation where they saw a high risk of suicide.
Cyacomb identified CSAM during a routine offender management visit, triggering arrest and further digital investigation.  This uncovered nude images of children from a hidden camera in a sports club changing room.  These images were being used to blackmail children into sending more images and meeting the offender.

 In each case the officers were using Cyacomb to provide evidence fast in ways that their previous workflows would not have been able to deliver.

 "The time saved through using Cyacomb is a remarkable efficiency improvement for our unit and adopting it is a no brainer." ICAC Investigator

To find out more about how Cyacomb can help transform your digital investigations contact sales@cyacomb.com

To see Cyacomb in action watch our demo video or to try it for yourself request a trial.

To tackle online harm, you must define it first | Cyacomb

Ian Stevenson — Mon, 13 Jul 2026 13:18:41 GMT

Cyan CEO Ian Stevenson discusses why defining ‘harmful’ online content continues to be a difficult area for regulators

“I think what’s happening in social media is already worse than Chernobyl.” – on the face of it a startling claim to make about the technology we all use every day. Yet Professor Stuart Russell, Professor of Computer Science at the University of California in the United States, made exactly this claim as part of the first of this year’s prestigious Reith Lectures from the BBC.

To state that social media has already had its “Chernobyl event” and is “already worse” is a damning indictment. If this is the case, why has social media not yet seen the level of regulation needed against the harms it causes?

Comparing social media with the Chernobyl disaster, which caused devastation and direct fatalities through tangible totems of fear in the form of an explosion and radiation, may seem extreme. But a closer look at the devastation caused by social media in the form of mental illness, self-harm, abuse, suicide and suicide-related behaviour, tells a different story. Research is beginning to show that social media appears to contribute to increased risk for a variety of mental health symptoms and poor wellbeing, especially among young people, while the prevalence of internet users is positively correlated with general population suicide rates.

According to the UK Government’s Online Harms White Paper last year, two-thirds of adults in the UK are “concerned about content online” with almost half saying that they’ve seen harmful content online in the past year. This is against a background of nearly nine in ten UK adults and 99% of 12- to 15-year-olds regularly spending time online.

Concurrently, the Report Harmful Content (RHC)’s 2021 Annual Report highlighted a 225% rise in reported hate speech online. While a sobering stat, the same report details improved public understanding of identifying and reporting incidents to official bodies, meaning at least some of these incidents may be attributed to greater numbers of people reporting ‘hate’ online. In a poll by Opinium earlier this year, nearly two thirds (60%) of Brits prioritised the right to be protected from violence and abuse over the right for people to say what they want online (24%). An EPCAT survey of EU citizens found that 76% of respondents said that allowing online service providers to be able to detect and flag any signs of child online sexual exploitation is more or as important as their privacy online.

It’s clear then that while most people want the internet to be a safe place for all, defining harmful content continues to be a difficult area for regulators.

Put simply: you can’t regulate against something you can’t describe. And this is the predicament Ofcom – the public body in charge of regulating online hate – finds itself in today. How do we define harm or hate and who decides what social media post is deemed racist, or just subconsciously biased?

The safety tech community does not yet have a standardised model for how various harmful behaviours are defined, which creates challenges for reliable moderation, modelling, and evaluation. This was brought to the fore in research titled ‘A Unified Typology of Harmful Content’ by Banko, MacKeen, and Ray of Sentropy Technologies in the US. The research details the most common types of abuse described by industry, policy, community and health experts, with a view to attaining a shared understanding of how online abuse may be modelled.

As part of an effort to tackle online hate, the UK Government introduced its Online Harms White Paper in 2019 and updated it earlier this year. In its current iteration, the bill states that social media sites must tackle content that is “lawful but still harmful”, including the promotion of self-harm, misinformation, and disinformation. The UK is also leading the G7 efforts in this area, putting technology at the heart of the global roadmap to tackle the global challenge of online safety.

In November, the UK culture secretary Nadine Dorries stepped up the rhetoric further and announced that internet trolls who threaten “serious harm” or post harmful misinformation could face jail sentences, in a marked escalation of sanctions in the draft bill. Also, the UK is also considering whether tech executives such as Mark Zuckerberg could face the threat of criminal prosecution if they do not tackle harmful algorithms.

This adds further pressure on social media platforms like Twitter and Facebook to take tougher stances on those spreading hate speech online. But should big tech companies be the ones who decide what is harmful or should the crucial task be the responsibility of society at large, through elected governments? One only needs to look at contentious debates played out in the public eye, such as that between J. K. Rowling and the trans community, to quickly see that one person’s harmful and offensive content can be considered another’s right to free speech.

Addressing online harm is still a relatively new concept, and so the debate is yet to mature. It’s further complicated by the technological domain it operates in. Most lawmakers, citizens and journalists have a limited understanding of how technology works and what is and isn’t possible when it comes to removing harmful content. That’s completely understandable – it’s a complex and technical area. However, this disconnect seriously hampers the quality of the debate and therefore our ability as a society to make good decisions.

The challenges of online harms are also inherently international. Big tech companies are often based in the US, but their users are all over the world and laws are made at a national or supra-national (or at EU) level. Certainly, the UK has demonstrated the value of engagement, innovation networks, industry associations and events, but this work needs to become international.

Moving forward, collective action and international collaboration will be vital to improving online safety; words that represent the efforts to save lives, safeguard children from sexual abuse and protect our social and democratic functions.

These issues are too big and the consequences of getting them wrong are too severe to be left to social media companies or lawmakers in isolation to tackle. As we have seen in the past decade, technology is accelerating cultural changes and it should be up to society to decide what it deems hateful or harmful.

We are approaching the cusp of fundamental change in terms of how we define and regulate the internet to make it a safer place. Especially for children and the vulnerable. If we are to make the right decisions moving forward, we need better collaboration across the spectrum to make clear specifications so harmful content is easily identifiable. Without it, the challenge may be too big to tackle.

If social media has indeed already had its “Chernobyl-type event”, it is critical that that fallout does not continue to pollute people’s lives for much longer.

This article was first published by Digital Forensics Magazine in Issue 47, published in January 2022. You can access the article on p48 here: Digital Forensics #47, Jan 2022 and follow Digital Forensics on Twitter @DFMag.

Internet Watch Foundation's 1.7 million file database now available with Cyacomb tools | Cyacomb

Cyacomb — Mon, 13 Jul 2026 13:18:40 GMT

Law enforcement agencies can now employ IWF's 1.7 million file database in their fight against CSAM, free with Cyacomb products

Protecting children is at the heart of everything Internet Watch Foundation (IWF) does. In the course of its work to remove online Child Sexual Abuse Material (CSAM), IWF has catalogued over 1.7 million files containing illegal images and videos. This collection will now be made available as a secure-by-design IWF Contraband Filter™, which can be used by law enforcement to quickly identify these illegal files on suspect devices. The Contraband Filter will be available to users of Cyacomb’s tools free of charge.

IWF Analysts remove a photo of a child suffering sexual abuse from the Internet every two minutes. Cyacomb empowers Law Enforcement Agencies (LEAs) through fast and thorough digital forensics triage. Both share the same spirit: the safeguarding of children and putting an end to the sharing of CSAM.

Our partnership, based on shared values, has resulted in the largest global Contraband Filter of CSAM available to date.

The Internet Watch Foundation’s annual report shows that, in 2022, a record-breaking 51,369 of the webpages it took action to remove or block from the internet contained Category A child sexual abuse material.

Why is the IWF Contraband Filter so significant?

Traditional hash lists are based on 1970s technology and are the established standard for identifying illegal content. These hash lists are vulnerable to abuse. In the wrong hands, and with basic internet access, they can be used to seek out and procure the same images we are working so hard to eradicate. This poses a significant security risk to Law Enforcement agencies and a further violation of privacy, causing a revictimization loop.

Contraband Filter technology is secure-by-design. Meaning that once a Contraband Filter has been created, it can be used to match content found on suspects’ devices, but cannot be used to recreate, search for, or otherwise link to the original material. This protects the security of the database and the privacy of victims, while making detection capabilities available where they are most needed.

Thanks to this, our users can identify CSAM in record time, whilst keeping the original and harmful data collected by IWF safe and secure.

Learn more about Cyacomb’s Contraband Filter technology

Through the partnership with IWF, Cyacomb built the IWF Contraband Filter. A secure matching capability of 1.7 million files is now available to law enforcement agencies globally. Freely accessible with any Cyacomb tool.

The importance of shared resources

Those fighting against Child Sexual Abuse Material need the best possible capabilities yet are often hampered when the data to do their jobs is trapped in silos by security and data protection. Contraband Filter™ lets users share capability without having to share data.

“This is the first time our data will be used in a tool of this kind – and it is an important step in ensuring our world-leading expertise can be quickly drawn upon by police and law enforcement the world over. "

- Dan Sexton, Chief Technical Officer at the IWF

What this means for our users

The IWF partnership is invaluable to our users, providing them with:

Proven and secured data, captured and verified by IWF expert analysts since 1996
The IWF Contraband Filter, already containing 1.7 million files, and updated monthly
An easily accessible global dataset, free to use with any of our tools

And we don't want to stop there

Cyacomb users are not only gaining access to the IWF Contraband Filter. Many different organisations are creating Contraband Filters. Most, like IWF, are sharing them for the benefit of the community through our secure "Cyacomb Contraband Filter Hub". If you have any questions about access or use of this Contraband Filter, or indeed the creation of contraband filters, or you would like to speak to us about anything else please contact us below.

Contact us to learn more about the Cyacomb Contraband Filter Hub

The sharing of resources among agencies and law enforcement worldwide is imperative. Let’s continue to work together to combat the spreading of CSAM material and keep children from harm.

Interested in our digital forensic technology? Book a Demo or a free 21-Day Trial today