Agentic AI is not a future capability for intelligence teams, Fivecast is actively building it into protective security, cyber and open-source investigation workflows today. The pattern holds across all three: agents take on the multi-source legwork, and judgment on intent, context and consequence stays with the human analyst.
I made this case last week at the AIPIO Intelligence Conference 2026, and I want to use this post to get specific about what “agentic AI in the intelligence cycle” actually looks like in practice, not as a concept, but as three investigations our data science team is actively building toward, with patents filed and product on the way.
Lesson one: agents assist, humans decide
The intelligence cycle breaks down into familiar stages: plan, find, collect, analyze, report. What’s changed is that each of those stages can now have a specialized agent attached to it. Orchestration agents break a mission into tasks. Collection agents go and retrieve the data. Inference agents draw preliminary conclusions from what comes back. And, critically, quality assurance agents check that work before it ever reaches a human.
That last category is the one I think gets underrated. As we build what I’d call agentic tradecraft, the real question isn’t what an agent can do, it’s whether you can trust what it produces. Can it validate its own assumptions? Can every claim be traced back to real data? Can you be confident there are no hallucinations in a report that’s about to inform a decision? We’re increasingly thinking of these as agents acting as judges, and I expect this layer, not the flashier collection work, to be what actually determines whether an organization can trust the output enough to act on it.
Three investigations, one pattern
- Protective security. A team leader asks for a risk assessment on a demonstration planned for a city center next week. The standard operating procedure an analyst would normally run through, building a collection plan, identifying sources, gathering the data, assessing it, drawing inferences, writing it up, can be codified into a sequence of autonomous agents. What gets compressed is the legwork. What doesn’t change is who signs off on what the assessment actually means.
A similar pattern is already at work in the field: see how a global resources company used the Fivecast Platform to accelerate threat detection and protect its people and operations worldwide. - Cyber investigation. A new vulnerability is disclosed, and the question is whether your organization has already been compromised by it. Agents can build a collection plan across logs, routers and endpoint data, and surface the evidence far faster than a human working through the same sources by hand. The call on how much risk that evidence represents, and what to do about it, stays a human one.
- OSINT and due diligence. An inquiry starts with a name, an email address, a phone number, and expands iteratively out across news, social media, the surface web and the deep web, building a picture piece by piece before the irrelevant material gets filtered out and the rest gets summarized into a risk assessment. Agents can do that expansion far faster and far more exhaustively than a person working alone. Deciding which of the people who share that name is actually the subject of the inquiry, and what a given piece of evidence actually implies, is still a human judgment call.
The takeaway: in every one of these, the pattern is identical. The machine does the multi-source legwork. Judgment on intent, context and consequence moves back up to the human. We are not removing analysts from these workflows, we’re giving them tools that mean they spend less time collecting and more time deciding, which is where a skilled analyst’s time is actually worth the most.
If you want the fuller argument for why this balance matters, we cover it in our ebook on the role of AI in OSINT.
What this takes to build properly
None of this works if the agent’s output can’t be trusted, and that’s the harder engineering problem. Our data science team has filed patents in this space and is building this quality assurance layer directly into our platform. Trust has to be engineered into the system, not bolted on afterward. That’s part of why more than 40 government agencies, 30+ police departments and Fortune 50 companies already work with us, and why organizations working with Fivecast report investigations running up to 80 percent faster, with one analyst producing the output of four.
The full detail on how we approach this sits in the Fivecast Trust Centre.
Everything I’ve described here is the response side of this technology. In my next post, I’ll cover the offensive side, misinformation, where the same capability curve got there first, and what it means for how detection needs to change.
About Fivecast
Fivecast delivers intelligence solutions built for clarity, powered by AI and trusted to surface what matters. Engineered to solve complex intelligence challenges our platform cuts through digital noise to help those protecting nations, borders, businesses and communities uncover critical insights – before risk becomes reality.
Trusted by agencies and enterprises across national security, law enforcement, defense, corporate security and financial crime, Fivecast was born from collaboration between governments and research institutions. Headquartered in Australia with a global footprint, we support the world’s most critical missions.
Fivecast. Engineered for Intelligence.
- Dr Brenton Cooper is Co-Founder and CEO of Fivecast. This is Part 1 of a two-part series following his presentation at the AIPIO Intelligence Conference 2026, “Misinformation in the age of AI”
- Fivecast delivers open-source intelligence solutions built for clarity, powered by AI, and trusted to surface what matters. Request a Demo.
- Read the series: Part 1 (this post) → Part 2: The New Economics of Misinformation (coming soon)
