//Train your people
AI training from the person who built it.
Matt Aubin, AI investigation expert and cybercrime specialist, teaches AI to the people who cannot afford to get it wrong. He built the AI his own investigation firms run on, so every workflow in the room is one he runs. Training and keynotes are one of the four things he sells.
By Matt Aubin, Founder, Southern Recon Agency and E3 Legacy Intel. CDFE, FBCI. Investigating since 2009. Updated .
AI in investigations training, taught by a licensed investigator who builds and runs the AI his own firms use on live cases.
Two tracks, one for the people who do the work and one for the people who have to defend it. Four formats, from a conference keynote to a full working day inside your firm. The named rooms it has been delivered in are listed further down this page.
//The two tracks
AI in investigations training, for two very different rooms.
Investigators and security teams need to know what AI can carry and how to prove what it produced. Counsel needs to know what to do when AI has already touched the evidence. He does not run one session at both.
Track one
Investigation and security firms
For investigators, analysts and security operations staff. Where AI genuinely moves a case or an incident: open source work, identifying who is behind an account or an attack, cross referencing at scale, and first draft reporting a human then owns. Then the part most training skips, how to validate what came back, what the record has to show, and where the legal line sits. It ends with the rules your staff can follow on Monday.
Track two
Counsel and legal teams
For litigators, in house counsel and the people who supervise investigators. What AI assisted and AI generated evidence actually is, what to ask for in discovery, how to read an expert disclosure that leans on a model, and what the rules of evidence already require today. It ends with the questions to put to the other side and to your own vendors.
//Formats
Four formats, and who each one is for.
The format is chosen from what the room has to be able to do afterwards, not from a menu. Every one of them is delivered virtually or on site, and every one is scoped to the audience before it is written.
Forty five to sixty minutes
Keynote
One talk to put a whole room on the same page about what AI is already doing to their work.
For a conference or an association meeting, where the audience is mixed and nobody is at a keyboard.
Three to four hours
Half day training
The room works. Live workflows, the checks that make a finding hold up, and the failure modes that get work thrown out.
For one team at a time: investigators, security staff, a legal department, or a leadership group.
A full working day
Full day training
The morning on what AI does and where it fails. The afternoon on your own casework or your own operation, hands on.
For a firm putting AI in front of its whole staff, or an association running a training day.
Sixty to ninety minutes
Executive briefing
The decisions only leadership can make: build or buy, what staff may put into a chatbot, and what gets asked for later.
For owners, partners, directors and boards deciding how AI enters the business.
The executive briefing is the session that most often comes before a monthly advisory seat or a signed AI evidence audit, because it is where leadership works out how big the question is.
//Rooms on record
The named rooms this training has been delivered in.
Every room is named, and where a date is on record it is printed. Two of the four carry one. Nothing here is a client case study, and no attendee or firm is identified.
Orlando, Florida
World Orlando
The State Department sponsored conference where he trained a delegation of Brazilian prosecutors in Orlando.
April 15, 2026
Intellenet 2026
He delivered “A-I for the Modern Private Investigator” at Intellenet's 2026 conference on April 15, 2026. Intellenet is the International Intelligence Network.
Las Vegas, 2019
White Label World Expo 2019
Keynote on the feature stage, The Prism Group, Las Vegas, an event with more than 7,500 in attendance.
Security Conference
Church Facilities Expo
The security conference track.
Ask about a session.
Say who is in the room, how long you have and whether it is virtual or on site. A tailored outline comes back.
//Delivered
Sessions he has taught.
- ->AI 2.0: The Private Investigator Edition
- ->Everything a PI Needs to Know About AI
- ->AI for the Modern Private Investigator
- ->Introduction to Artificial Intelligence
- ->AI Cyber Threats
The course written for licensed investigators is AI training for private investigators. Keynote booking is on the teaching and speaking page.
//Audiences
The organizations he has taught for.
Statewide, regional, national and international investigative and industry organizations. He also serves on the board of the Florida Association of Licensed Investigators, which is how he sees what association education committees are actually being asked for.
//Continuing education
Does it count for CE, CLE or CPE credit?
No accreditation is in place today and none is claimed. The training can be built to fit what your body requires, including session length, written learning objectives and a record of attendance, and a certificate of completion and full syllabus come with it. If your body will not approve it, you will be told that rather than sold around it.
That is the whole answer, and it is deliberately the same answer given on every training page on this site. An education chair comparing this to an accredited program is comparing two different things, and being told so is more useful than being sold around it.
//Why it lands
Nothing in the room is theory.
Every workflow he teaches runs inside his own firms, and every failure mode he covers is one he has paid for and engineered around. He is a Certified Digital Forensics Examiner and a Florida Board Certified Investigator, a board member of the Florida Association of Licensed Investigators, and Founder, Southern Recon Agency and E3 Legacy Intel. Investigating since 2009. Founded his first firm in 2010 and built it into Southern Recon Agency in 2014. Your team learns from someone held to the same standard they are.
The other half of it is that he will say what a room does not want to hear. If your people should be using a free course from a model maker before they use him, he says so. If a workflow should not be automated at all, he says that too, in the room, in front of the person who wanted it automated.
//Questions people ask
What firms and education chairs ask before they book.
What is AI in investigations training?
It is training on how AI is actually used inside investigative and security work, taught by somebody who runs it on live cases. It covers where AI earns its place in a case, how to validate what it produces, what record has to exist behind a finding, and where the legal and ethical lines sit. It is not a tour of chatbot features.
Who is each track for?
Track one is for investigators, analysts and security operations staff, the people who do the work. Track two is for litigators, in house counsel and the people who supervise investigators, the people who have to defend the work. He does not run one session at both, because the two rooms need opposite things from the same subject.
Does it count for continuing education credit?
No accreditation is in place today and none is claimed. The training can be built to fit what your body requires, including session length, written learning objectives and a record of attendance, and a certificate of completion and full syllabus come with it. If your body will not approve it, you will be told that rather than sold around it.
The practical version of that is a short conversation. Tell him which body you answer to, what its rules require, and what evidence of attendance it wants, and the session is built to fit. If the body will not approve it, you hear that before you book rather than afterwards.
How is this different from a free AI course from a model maker?
A free course from a model maker teaches that company's product. This teaches the work. The difference shows up the moment somebody asks how a finding was reached, what was checked, and who is accountable for it, because a product tour has no answer to any of those and a working investigator does. Take the free course as well; it is a good use of an afternoon.
Which AI models and tools does the training work on?
All of them, because the training is not built on one. Your people will be using whatever your firm has licensed, and that will change. The session is built around what the room already has in front of it, and what it teaches survives the next model release, because the discipline is about sourcing, checking and recording rather than about buttons.
Can the training be run in house, on our own cases?
Yes, and that is the version that changes the most behavior. A full day run inside a firm spends the afternoon on the firm's own casework or its own security operation, with the firm's own tools, so people leave having done the thing rather than having watched it. Case material stays with the firm. Nothing from the room becomes a case study anywhere.
What do people actually leave with?
A written rule set they can follow the next working day: what may go into which tool, what has to be checked before anything leaves the building, and what has to be recorded while it happens. Plus the questions to put to a vendor, and the failure modes that cost other firms money, named so they are recognizable.
Is training the same thing as the advisory seat or the audit?
No. Training teaches your people. The monthly advisory seat is a standing advisor for the firm. The signed AI evidence audit is one dated document stating how your firm uses, checks and discloses AI. Training is often the first of the three a firm buys, because it is the one that shows leadership how big the question actually is.
The seat is on the advisory page and the document is on the signed AI evidence audit page. All four things he sells are described together on the consulting hub.
How are training fees set?
Scoped in writing after one conversation about the room, the format and what your people have to be able to do afterwards. There is no rate card on this page and no hourly meter. The retainer is paid in full before the work starts, and the scope states exactly what the room gets.
The session that goes deepest on operating the models themselves, on any model and at any level, is prompting training. Security directors booking track one for an operations team should start at AI for security operations, and the single keynote is set out on the keynote page.
Set up a session.
Virtual or on site, scoped to the room and to what your people actually do.