.svg){kind=icon}
Learn
Real-time intelligence is exploitation delivered fast enough to affect the current decision or engagement; forensic intelligence is retrospective reconstruction, from the same data, to understand what happened and why.
Last updated: October 26, 2026
Why it matters to your mission. The same sensor feed has to answer two very different questions. In the moment, a commander needs to know what is happening now and what to do about it before the window closes. After the fact, an analyst needs to reconstruct what happened and why, so the force can attribute an action, map a pattern of life, and learn. These are the real-time and forensic uses of intelligence, and the costly mistake is treating them as two separate problems and building two separate pipelines. They need the same fused, provenance-preserved data. The only differences that matter are latency and purpose.
Real-time intelligence is exploitation delivered fast enough to affect the current decision or engagement; forensic intelligence is retrospective reconstruction, from the same data, to understand what happened and why. The distinction is latency and purpose, not source material: both are produced from the same collected, processed, and correlated intelligence.
This split maps onto a distinction joint doctrine already draws. Joint Publication 2-0, Joint Intelligence, separates current intelligence, which keeps a commander aware of the evolving situation, from the intelligence estimate and the broader analytic products that forecast, explain, and reconstruct. The doctrine is explicit that intelligence is defined by its use: it "allows anticipation or prediction of future situations" and "informs decisions by illuminating the differences in available courses of action." Real-time intelligence serves the decision in flight. Forensic intelligence serves understanding after the fact. The data underneath is the same body of collection.
Key takeaways
The two modes differ on latency and purpose while drawing on the same underlying data. The table below separates them on the dimensions that decide how you build for each.
| Dimension | Real-time intelligence | Forensic intelligence |
|---|---|---|
| Latency | Seconds to minutes; inside the decision or engagement window | Hours to months; after the event |
| Purpose | Act on what is happening now; shape the current decision | Understand what happened and why; attribute, reconstruct, learn |
| Data freshness | Live and streaming; most recent collection dominates | Complete and corroborated; historical depth over immediacy |
| Primary outputs | Alerts, cues, current tracks, time-sensitive indications and warning | Attribution assessments, pattern-of-life analysis, after-action reconstruction, lessons learned |
| Decision supported | The engagement or operational decision in flight | Strategy, policy, targeting development, accountability, future planning |
| Tolerance for incompleteness | High; a timely partial picture beats a perfect late one | Low; the reconstruction must be defensible and complete |
| Data foundation | The same fused, provenance-preserved collection | The same fused, provenance-preserved collection |
The last row is the point. Everything above it changes with the mission. The data foundation does not.
Same data, a different clock and purpose
The two modes differ on latency and purpose, not source material. Real-time intelligence serves the decision in flight; forensic intelligence serves understanding after the fact.
Build two pipelines and the after-action reconstruction never quite matches what the commander saw. One governed foundation makes speed and depth two queries against the same truth.
Real-time intelligence is intelligence exploited and delivered fast enough to influence a decision that is still open. The defining constraint is the clock, not the content. A track, an alert, or a correlation that arrives after the commander has already acted is not real-time intelligence in any useful sense, however accurate it turns out to be.
In doctrine this is the role of current intelligence: keeping the commander and staff aware of the evolving situation so they can act on it. In practice it depends on moving collected data through processing, exploitation, and dissemination at machine speed, because the bottleneck is almost never the sensor. It is the time spent normalizing, correlating, and routing what the sensor produced. That is the same problem described on our AI-enabled ISR PED page: the collection is abundant, and the limiting factor is how fast raw feeds become a decision-ready picture.
Real-time intelligence leans on indications and warning and on multi-INT fusion, because a single live feed rarely carries enough context to act on alone. The value comes from correlating streams fast enough that the fused picture still arrives inside the window.
Forensic intelligence analysis is the retrospective use of intelligence to reconstruct an event, determine who did what and why, and turn that understanding into attribution, pattern of life, and lessons. Where real-time intelligence is governed by the clock, forensic intelligence is governed by completeness and defensibility: the reconstruction has to hold up to scrutiny, because it feeds attribution, targeting development, accountability, and strategy.
The forensic mode is where historical depth matters more than immediacy. Reconstructing a pattern of life means correlating weeks or months of observations about the same entity. Attributing an action means tracing it back through corroborating sources to a defensible conclusion. Both depend on a complete, correlated record, not just the freshest feed. This is the analytic and estimative work that joint doctrine distinguishes from current intelligence, the part that explains and forecasts rather than simply reporting the now.
Forensic intelligence has the same dependency real-time intelligence does: it is only as trustworthy as the provenance behind it. A reconstruction an analyst cannot source is a story, not an assessment.
They differ on two axes and agree on a third.
The practical consequence: if the real-time path and the forensic path run on different data foundations, the after-action reconstruction will never quite match what the commander actually saw. Provenance diverges, entities are resolved differently, and the lesson you extract is about a picture no one acted on. One governed foundation keeps the two views consistent.
It is tempting to build a lightweight "live" path for speed and a heavier "analytic" path for depth. In a fragmented environment that choice is expensive in three ways.
The alternative is one governed data foundation that preserves provenance end to end and serves both latencies from the same correlated record. Speed and depth become two queries against the same truth, not two systems.
Both modes live on the same timeline; they just read it at different points. The U.S. Government Accountability Office, in Defense Command and Control, GAO-25-106454 (2025), describes the shift the Department of War is trying to make: away from a "swivel chair" approach where "analysts collect, assess, and package the data by manually entering and transferring them into yet another system," and toward integrated flows that let warfighters "quickly transform vast amounts of data into actionable information."
That manual movement is what breaks both modes at once. It is too slow for the real-time decision, and because the hand-carried data loses its provenance along the way, it also degrades the forensic reconstruction. Fix the data movement, preserve provenance as you go, and the same pipeline that delivers the live picture also produces the record the analyst reconstructs from later. Real-time and forensic stop being separate programs and become early and late reads of one sensor-to-decision flow. For edge-constrained versions of this problem, see tactical edge AI.
Torch.AI builds government-owned reasoning infrastructure that turns fragmented, multi-source data into coherent understanding at machine speed, while keeping every element traceable to its source. The design principle that matters here is one governed data foundation serving both latencies, rather than a fast pipeline and a slow one that disagree. You can see how this is packaged as a capability on the Torch.AI software page.
Three public products carry the roles. ORCUS is the data-availability layer that connects to the sources, normalizes high-volume feeds, and preserves provenance end to end, so the same record serves a live query and a later reconstruction. NEXUS applies semantic representation and vectorization so unstructured, multilingual text becomes something you can query and correlate at speed, whether the query is "what is happening now" or "what happened and why." HALO fuses resolved entities into a graph an analyst can trust and trace, which is what both pattern-of-life reconstruction and real-time correlation depend on. Because the reasoning layer runs as a system of reason on top of existing systems of record, the authoritative sources stay intact, and in a government-owned deployment the customer keeps control of the layer where data becomes understanding, able to inspect, govern, and evolve it.
The result is that the forensic picture is built from exactly the data that drove the real-time decision, with the same provenance, the same entity resolution, and the same correlations. For evaluators, see the software page or request a technical walkthrough and we will run it against a sample of your sensor and multi-INT data, serving both a live query and a retrospective reconstruction from one foundation, with provenance traced end to end.
Use this as the backbone of an evaluation you can score against:
Evaluating a capability? Bring these seven requirements to a scoping call and we will walk each one against your environment: request a technical walkthrough.
Real-time intelligence is exploitation delivered fast enough to affect the current decision or engagement. Forensic intelligence is retrospective reconstruction, from the same data, to understand what happened and why. The difference is latency and purpose, not source material.
Real-time intelligence is intelligence processed, correlated, and delivered inside the decision window, fast enough to change what a commander does now. It corresponds to what joint doctrine calls current intelligence and depends on moving data through processing, exploitation, and dissemination at machine speed.
Forensic intelligence analysis is the retrospective use of intelligence to reconstruct an event, attribute an action, build pattern of life, and extract lessons. It is governed by completeness and defensibility rather than the clock, and it depends on a complete, provenance-preserved record.
Yes. Both are produced from the same fused, provenance-preserved collection. The difference is latency and purpose, not the underlying material, which is why serving both from one governed data foundation keeps the two views consistent.
Two pipelines duplicate ingestion cost, fracture provenance, and resolve entities differently, so the forensic reconstruction never matches the picture the commander acted on. One governed foundation makes speed and depth two queries against the same truth.
Both modes read the same timeline at different points. The manual, swivel chair data movement the GAO describes is too slow for the real-time decision and loses the provenance the forensic reconstruction needs, so fixing data movement improves both at once.
Describe the problem.
Define the constraints. We will structure the session.
No demo.
No slide deck.
Real work.
Describe your real-time and forensic intelligence needs. We will scope a session around your sensors and data. No two-pipeline pitch. Your multi-INT data. Real work.
