The following transcript was generated by AI and may contain inaccuracies.
Matt Goeckel: Welcome everyone to our Spring 2026 release webinar. In this webinar, we’ll talk about some of the innovations that we’ve released over the past few months and why we’re doing that. At the end, we’ll put it all together in a fun scenario to see how some of these innovations and how Cellebrite’s solutions as a whole can work together to help you better solve your cases.
To start, we want to begin with the industry survey that we do every year. We put this out and it goes to you, the customer, and what we’re trying to do is understand the industry and what the issues are. We leverage that information to help us understand what we can do as a company to make your job easier. We definitely respond and develop based on your needs.
This year’s industry survey results are altogether unsurprising. We still see that devices are coming into the lab locked and that backlogs are high — on average by multiple weeks. We know that review time is the top challenge, with 68% of investigators saying that is their top challenge when it comes to digital evidence.
This is where we see an opportunity to empower the examiners and investigators with some of our products and with the application of artificial intelligence, as we’ll see in a little bit. And then court clarity — another 68%, the same number, struggle to make digital evidence clear in court.
None of these are edge cases; they’re systemic issues that we see across the full investigative life cycle. Those challenges are exactly why we create the products that we create, but it’s also why we like to share these major updates twice a year — once in the spring, and once again in the autumn.
The digital world is constantly evolving, and our products evolve with it to better serve you. You’ll continue to see releases throughout the year. This is not us moving to a twice-a-year release cadence. We’ll still do our regular releases and we’ll provide updates and release notes. But this gives us a chance to step back, connect the dots, and highlight the bigger picture: what’s new now, and what’s coming next across the Cellebrite ecosystem.
Today we’re focusing on the spring release. Spring 2026 primarily focuses on three themes: access more, moving faster and moving with confidence, and stronger outcomes together. As we work through the next few slides, we’ll see how those themes come to life.
In the “access more” theme, first off, looking at more insight: Cellebrite Insights advances mobile intelligence and digital extraction with enhanced access, faster decoding, and strengthened media authenticity validation, including deep fake detection. This will give you faster defensible insight into the digital evidence and help you act with confidence.
We have expanded device and OS access — improved access across the widest range of devices and operating systems, including the iPhone 17, as well as support for devices up to the latest iOS version, including 26.4. This enables more successful extractions, helping teams keep pace with rapidly evolving environments, and that is available now.
Second is Safeguard mode. Safeguard mode combats device inactivity timers, giving you time to seek judicial authorization prior to performing the extraction. I really like this feature. Safeguard mode makes the AFU, or the inactivity timer, irrelevant.
Even if the device does reboot, with Safeguard mode you will maintain your AFU state and be able to access and then extract that device. Kiosks are here. Built for deployment outside of the lab, the kiosk provides secure guided self-service intake for consistent collection — meaning you can enable patrol and detectives to do extractions, as well as extractions at strategic locations like borders and interview areas. Kiosk will enable a complete extraction-to-report workflow and maintain chain of custody while providing faster processing.
And then the Covert Forensic Imaging Device. Drone forensic capabilities to enable the extraction, decoding, and visualization of critical data from commonly used unmanned aerial systems, including flight logs, video, geolocation artifacts, and drone telemetry. It’s a portable field-ready solution, so you can rapidly access and interpret the drone data at the point of collection.
We’re seeing an increase in drone usage, and this data is becoming increasingly valuable as a source of digital evidence. It supports faster and more informed decisions across security, defense, and regulated environments. When I say portable, I mean it — that CFID will fit in your pocket. It’s a grab-and-go option.
Moving quickly with confidence: Guardian Investigate is here and fully available. It’s an AI-powered investigative platform to help you solve your cases. It gives you a centralized collaborative location to manage your investigation by giving you one place to store and view tasks, data, locations, and subject information, while providing collaborative access to every member of your investigative team. We’ll look at that in action in just a few minutes.
In Insights Physical Analyzer, on the Media Intelligence tab, you can find media modifications. This will give you an indication if an image location or timestamp has been adjusted, as well as any other modification indicators, and will help you detect images that are generated by AI, as you can see in the Gen AI indicator section on that screen.
Pathfinder just got an upgrade. Graph enhancements allow you to group individuals together, label them, and save the graph state to preserve any work that you’ve done for later. With advanced reporting now included in Pathfinder, you can build more robust reports from Pathfinder data, as well as bringing in data from other sources to provide a full picture of the investigative and analytical work that gets performed.
And Genesis — agentic AI for the investigator. This is currently in early access. AI-powered insights from multiple data sources to quickly surface evidence and key connections. This is natural language search, which means the words that are in your head can be put directly into Genesis, and Genesis will search for and find the answers.
It provides visual outputs and direct artifact sourcing, allowing you to instantly verify and validate the data that Genesis is drawing from. The early access program is closing soon, and we expect it to be generally available shortly. I have to tell you, this is something that you all should be looking forward to.
The reports that have come in from our early users have been really encouraging, including one user who told us that Genesis is the finest digital evidence product they’ve ever used and has the potential to be of life-saving value. That is a direct quote — I didn’t make that one up. I didn’t make any of them up.
And then stronger outcomes together. Insights is now fully integrated with Guardian, which means you can extract out of UFED directly into the Guardian platform, or push your extraction reports from Physical Analyzer directly into Guardian. This allows for instant access to that data.
And then Advanced Unlocks. Advanced Unlocks is Cellebrite’s next generation AFU, or After First Unlock, access solution. It’s designed to provide fast, reliable, and future-proof access to the newest iPhones and iOS versions. As we all see, device manufacturers are rapidly increasing security, and traditional AFU methods are starting to face more and more limitations.
Advanced Unlocks introduces a breakthrough method that unlocks devices quickly, safely, and with far greater resiliency against these OS-level changes. This new solution works alongside, not in place of, existing AFU methods and Insights. It adds a new capability tier to ensure long-term access coverage and gives agencies a reliable path forward to lawful access on modern iPhones.
Think of it like an insurance plan to help labs maintain operational readiness, overcome accelerating device security barriers, and future-proof their ability to extract critical digital evidence. Advanced Unlocks are available on a limited basis. Full solution details and prerequisites are shared exclusively during an in-person or virtual meeting with a Cellebrite representative, together with the customer’s authorized representatives.
This is really about security of the access, and it gives us a guided path towards solution eligibility. This service is also available at any of our Cellebrite advanced lab services locations — at our CAS labs worldwide for approved customers. And “approved” in this case is generally most any customer.
To start accessing the latest iOS devices with Advanced Unlock solutions, you can reach out to your dedicated sales representative. And we’re excited to announce Cellebrite Academics. Training the next generation of digital forensics experts, Cellebrite Academics provides training materials and access to our industry-leading software at the college and university level.
With Academics, we’ll help students build real-world skills and access our community to help prepare them to be the next generation of examiners and investigators. Speaking of community, in mid-June we’re launching an all-new 101 experience. This will be a secure, centralized hub for resources, insights, and opportunities to engage with our experts, where you’ll be able to connect with your peers in a trusted professional community.
Community, peer, and expert access is the recipe for success in your examinations and investigations, and Cellebrite is excited and very happy to provide the platform to ensure that success. So okay, let’s put this all together.
Two years from now, Los Angeles will host the world. 206 nations, over 10,000 athletes, millions of spectators — the biggest stage on Earth. But behind the spectacle, a different operation is already underway, because every global event of this scale attracts more than fans. This is the story of the people who make sure their child gets to walk in and walk out safely.
This is what protection looks like in 2028. The following scenario is fictional. The technology you’re about to see is real.
All right, back over to the slides. I want to take everyone through a scenario. It’s July 2028, and we’re watching a multi-agency task force supporting the LA Olympics. It’s federal, state, and local — the IOC, the Los Angeles Police Department, the Los Angeles Sheriff’s Department, the FBI, DHS. Everyone is involved, and the threat landscape is everything. The operation starts here with Guardian Investigate.
Investigate empowers teams to manage high-profile incidents, major crimes, and cold cases so they can quickly review evidence, summarize documents, spot inconsistencies, and connect the dots. For this task force, Investigate will be our command center. We’re collaborating by sharing access across agency lines to every agency on this task force.
With our centralized file repository, we’re uploading intelligence, threat assessments, briefings — any data that is part of this investigation, feeding the platform from day one, all in one place. With Guardian Investigate’s integrated task management, our task force can assign tasks online in the platform, reducing the need for stand-up meetings and letting investigators pick up their tasks in the field and actually get the work done.
Let’s see what’s going on with our task force. Seventy-two hours before the opening ceremony, restricted airspace is breached. A drone is running a surveillance pattern over the stadium. Security teams scramble. The drone is intercepted. A suspect is detained at the perimeter — phone, drone controller, and tablet.
We have a suspect, we have three devices, and we have zero time. We need intelligence now, on scene. That’s why we introduced the CFID, the Covert Forensic Imaging Device. Full phone and drone extraction capabilities, quite literally, in the palm of your hand. Let’s go back to our scenario.
Within minutes, our technical team arrives. They carry a CFID in their kit. Everything they need for a field extraction is packed and ready to go. With that CFID, we’re pulling flight logs, GPS coordinates, app data — everything that tells us where this drone has been and who sent it. It’s happening right now, right here at the perimeter.
They can review the flight log right on scene with the CFID Android app, or review the full data set back at the lab, like you see on screen, where our drone is flying a surveillance pattern over SoFi Stadium.
On to the phones. While still in the field, our investigators start a submission in Guardian Investigate. This will alert the lab that the device is coming. Here it is in our new updated interface. We describe the items to be submitted and where they were seized from. On the other side, the lab can review the submissions and formally receive the items by signing and counter-signing, just like you do today manually on paper. The platform will help maintain chain of custody throughout the entire process.
Okay, let’s extract those devices. We’ll use Insights — access, extract, and decode the data. With Insights 10.9, examiners can choose a workflow based on the urgency of the device. They can leverage the automatic flow, which will access and then extract the device automatically, sending it directly to Physical Analyzer. I can also choose to send the extraction straight to Guardian from UFED or Physical Analyzer.
With this option, the phone is extracted and uploaded directly into the Guardian case that we’ve already set up, and we’ve now got the full file system, deleted messages, location history, app data — and the platform is already working on this data before we even sit back down.
Let’s go through and analyze it. For that, we’ll use Pathfinder. Pathfinder is Cellebrite’s advanced investigative analytics platform. It’s available on-prem or in VPC. It leverages artificial intelligence to help surface connections and review data holistically. Whether it’s one or many devices, Pathfinder will get you through the mess and into the data that matters.
With Pathfinder’s new graph enhancements, we can now highlight and section off various connections. First, we can save the graph state — whatever your view is, if you like it, you can save it, and it will be that way when you come back. You can group connections together into organizations — gangs, victims, whatever you need — and understand how those groups are connected.
You can also label groups or nodes — individuals — for improved visibility amongst the thousands of connections. In our scenario, we’ve identified a cell of known terrorists. Our drone operator is connected to an organization that is known to attack large-scale events. Over here, a second thread: a human trafficking organization.
Our task force suspects this is a funding arm for the terrorists. And finally, Karl — a stadium employee. We’ll dig into Karl a little later. By the way, I will give kudos to the first person who sends in where Karl is from, without googling it.
With Cellebrite Build, Pathfinder’s reporting capabilities just took steroids. New enhanced reporting capabilities that I briefly touched on earlier — a report can be generated on this entire network, and that report is then fed into Guardian Investigate. As the analysts work the case, they can add data and intelligence as they discover it in Pathfinder, or pull from outside sources such as web pages, images, and other media — and output a comprehensive report with the collective data. The platform now has the full picture to analyze.
We have one drone, three threats — terrorism, trafficking, a corporate insider — all connected through data that we never would have seen without mapping the network. The task force splits, but the operation stays on one platform. Let’s look into the human trafficking thread. County teams and federal partners are now working this lead simultaneously.
A vehicle belonging to one of the traffickers is identified, located, and stopped. But here’s the thing: this lead takes us a couple of hours outside of Los Angeles. The agency working this stop isn’t part of the Olympic task force. They have devices to analyze, and they need intelligence and information now. This is active human trafficking, and time is of the essence.
So they use Genesis. Genesis is our standalone Cellebrite AI — agentic AI purpose-built for investigations, transforming UFDR reports, portable cases, CDRs, documents, images, video, and more into immediate actionable insight. It delivers in minutes what traditionally took a full day or longer. It accelerates case progression without increasing workload or headcount.
This analyst runs the extraction through Genesis. Plain language, in-depth analysis, and easy to use. If you’ve ever asked ChatGPT a question, you can use Genesis. You can see here, the prompt is asking for information about this particular device and any evidence related to human trafficking.
Genesis has identified that, in this case, Joey Quinn, the subject in the traffic stop, is directly involved in a coordinated human trafficking organization. We can see where it gives the explanation of key evidence, including recruitment and exploitation, communications, and discussion about an interstate transportation network.
From there, Genesis will provide you a confidence assessment. Genesis not only tells you the answers, it tells you why it’s giving you the answers it’s giving. And then finally, full sourcing for verification — so not only are you getting the why, but you’re getting the where. You can easily understand directly from the source of truth and verify and validate the findings, keeping you, the human, the primary investigator, in the loop on the process.
With that, we have more files and more tasks. Every agency working this operation is feeding this case in real time. OSINT reports, CDRs, extractions, field reports, photo, video — all of it flowing into one single place. The county, the FBI, the DHS — they’re all working this case together, and nobody’s waiting.
There’s no duplication of work, nobody’s emailing zip files, and nobody’s driving thumb drives around. Within hours, the trafficking lead produces names, locations, and a network that stretches beyond Los Angeles. Victims are identified, operations are disrupted, but the task force isn’t done.
Our third thread leads inside the Olympic venue itself. A stadium operations employee has been flagged. Communications with an external contact linked to the broader network, security blueprints, access schedules, and operational plans may have been compromised. Now we’re in different territory. This isn’t a street-level investigation.
This is a corporate insider threat. The stadium’s private security team needs to investigate, but they need the same intelligence tools that law enforcement is using. In this case, they have someone embedded with the task force, and in order to get access to our suspect’s computer, they don’t even need to be in the same building.
They’ll leverage Endpoint Inspector. Endpoint Inspector is for remote collection. The security team pulls the full picture from the employee’s corporate machine — communications, file transfers, deleted documents, timestamps showing exactly when the compromised files were accessed and where they were sent. It’s all done without tipping off the suspect.
The leak is confirmed, the insider is identified, and every piece of evidence is documented, preserved, and court-ready. Endpoint Inspector provides a single source for remote access and selective collection for computers. Let’s bring this home.
Three active cases, 20-plus subjects identified, evidence from a dozen devices, multiple agencies, and a private security team. Let’s talk about what’s holding this all together. Investigate has been running since day one, but now you can see what it’s actually doing. It’s case management across all three threads.
Tasks are assigned, evidence is organized, team collaboration is happening across agency lines, and every extraction, every file, and every report is uploaded and becomes tagged, searchable, and connected. Here’s where Investigate’s AI earns its keep. Not only are you organizing the evidence, the AI is analyzing it — summarizing hours of communications into actionable briefs, flagging patterns across cases that no human analyst would catch in time. It’s working with everything we fed it: the intel uploads from day one, the Insights extractions, the Pathfinder report, every document from every agency. And like Genesis, it’s telling you where it sourced the information that it’s using.
Investigate also has a built-in timeline feature. Create timelines here and memorialize them with your cases. Get rid of those whiteboards on your war room wall. Stop taking pictures of them before erasing them to make room for the next case. Memorialize that data here in your case. You can also leverage Investigate’s AI to help you build that timeline, like I did in this picture.
So let’s wrap this scenario up. 206 nations, 10,000 athletes, millions of families, and behind it all, the people and the technology that made sure every one of them could be there.
All right. You just watched a single drone detection become three simultaneous investigations — terrorism, trafficking, and corporate espionage — running on the same platform across the same evidence. Three crimes, three teams, but one operation. Every tool that you saw is available or coming soon. This is what we’ve built, and this is why we’ve built it.
With that, I want to address some of the questions that have come in over the last little bit of the webinar. We have had quite a few come in, so it’s going to take me a second to work through these. I want to thank everyone for your time on the webinar.
Let me cover the Karl Vreski thing, because we actually did get one response. The response I was looking for: Karl is one of the villains in Die Hard — the original Die Hard. He was the guy with the long blonde hair. Any of you that have seen that movie might remember Karl.
All right, back on to the actual questions. Steven, you asked a question about when you enter data into Guardian, where does that data physically exist? Guardian lives on the AWS platform, so it would live within your AWS tenant. Guardian tenants are individually tenanted, so it’s not shared data. It basically lives inside your bucket.
Josh, you asked about the Gen AI modifications — image modification section being in the next release of Insights PA. I believe it should be there already. I thought I saw it in 10.9. I’ll double-check on that and get with you. Just shoot me an email or send me a message on LinkedIn, and I’ll get a definitive answer for you and send that over.
Robert asked about data sources that we can import into Genesis. That’s a good question. I’m not sure if we published the full list online, but I can give you at least a little bit of an idea. UFDRs and portable cases, like I mentioned. You can do a zip folder, so if you have a batch of case media files or documents that you want to upload at one time, you can do that.
Documents in most every document format — DOCX, PDF, TXT, PowerPoint, Excel, CSV. Images in many formats — most of the common ones: JPEG, PNG, bitmaps, as well as HEICs. Videos — same thing, common video formats. And audio files. I’m going to sound like a broken record, but the common audio formats are capable of being uploaded into Guardian.
Let me see if there’s any other questions. One came in from Keith: “New to Cellebrite, definitely entry level. Are these software programs — Guardian Investigate, Pathfinder, Genesis — required for deciphering information shared with me via Cellebrite?”
To understand the information that gets shared with you via Cellebrite, there are a couple of different paths that can be provided. The traditional path, which is arguably slower but has been around for years, would be the reader path. That’s probably how most of you are getting the data today, in a reader file that you open up and then go through manually.
What Investigate, or the Guardian platform, allows is an easier way to share that data. Rather than having to put data on thumb drives or hard drives and do the “thumb drive shuffle” — or snail mail, whatever you want to call it — and get the data from point A to point B, Guardian allows you to upload that data and push a button to share it.
It also provides a viewer, and that viewer allows you to review the reader file in the cloud, in your web browser. It’s a much more simplified view, which will help you go through that data, make sense of it, understand it, and leverage AI to help parse out things like communications a little more effectively.
Pathfinder and Genesis: Pathfinder is for your investigative analytics. It’s primarily an on-prem or VPC platform, and excels at multi-device analytics. If I have a case of two, five, ten, a hundred devices, I’m going to put it in Pathfinder, because Pathfinder will visibly draw connections for me into graphs. It will do what we call identity resolution, taking multiple identifiers — like we all probably have at least one, maybe two phone numbers plus an email address or four, then a Facebook ID, an Instagram ID, and so on.
Pathfinder takes and resolves all those back into a single person, just to make it easier to deal with the data. The way I usually talk about Pathfinder: it’s really good at giving you threads in your investigation, and then helping you pull those threads to unravel pieces of the investigation. Showing you not only the known unknowns that you have, but it’ll also help you surface some unknown unknowns. It’ll help you find things in the data that you didn’t know about.
Genesis is a standalone AI platform that will help you more effectively decipher the information. Investigate and Genesis both have this — the ability to do plain text chat, kind of like a chatbot, if you will — talking to your evidence and being able to quickly get through the evidence and make sense of it a little more easily.
A question about Safeguard as it relates to the passcode. The presence of the passcode doesn’t really affect the ability to put Safeguard on a phone. What it does is maintain that After First Unlock state on the device, so that once you get your search authority into the device, you still have access to it. On modern iOS devices, if they’re not unlocked in a 72-hour period, they revert to BFU. That’s what Safeguard is protecting against, so you can still maintain that access into the device.
Another question about Genesis: can it be installed on-prem? Not at the moment. It is a SaaS offering. We are exploring different opportunities with Genesis on ways to deploy it, but right now it is solely a SaaS product.
Audrey asked about Safeguard mode’s availability. It is available to everyone. It will be included as part of Insights, so you’ll have it there. Once you access the device, there will be a button that says “Safeguard mode.” It takes, I think, about six minutes.
And yes, Jack at least got right that Karl was from Germany, in the movie. Thank you for that.
There’s a few other questions that I’m going to start tackling one by one that don’t necessarily go for the betterment of the group. But again, I want to thank everyone. I hope everyone’s okay with me ending about seven minutes early on this one.
I want to thank you all for your time and attention. I hope you enjoyed the presentation. We’re very excited to present our releases — our updates to you — and we’re excited to do it in this format where we can centralize everything and make sure that you, as the customer, are aware of what we offer. If nothing else, it’s not fair if you don’t know what power is available to you in Cellebrite’s platform.
With that, again, thank you everyone. If any of you have a question that we didn’t get to, we’ll follow up with you here or after the webinar. For the rest of you, if you have any other questions, you can always just reach out to us via Cellebrite, and we’ll be happy to answer your question, no matter what it is.
So with that, we’ll end the webinar, and everyone have a great day.
