Siren 16 brings AI analysis of images, video and audio, natural-language investigation, simpler organisation and new financial crime workflows. The aim is for analysts to spend less time operating technology and more time following the evidence.
Investigators have more data than ever, and the hard part is making sense of it.
What matters might be buried in structured records, documents, transactions, images, video, audio or data pulled from a device. It might not contain the keyword you’d expect. And finding one relevant record is usually just the start, because the next question is what it connects to. The “what matters?” question has shaped Siren 16.
This release brings together semantic search, AI-powered Media Intelligence, deeper graph analysis and Siren K9, along with new capabilities for financial investigations, mobile forensics and everyday productivity.
For our Founder and Head of Product Renaud Delbru, this goes back to the original thinking behind Siren. His background in search has always centred on a deceptively simple challenge: how do you help people find what matters? Siren took that idea further by connecting the entities and relationships around the information rather than treating individual records or documents in isolation.
As Renaud Delbru says: “Siren has always been about helping people find what matters and understand how it all connects. Siren 16 takes that idea further, helping investigators see the wider context faster while keeping human judgement at the centre.”
It’s also a reminder of CEO John Randles’ vision for the Autonomous Analyst. At Siren Fusion 2026, he argued for AI that makes analysts more self-sufficient rather than autonomous AI that attempts to replace them.
“Siren 16 is about giving investigators greater autonomy. By making complex investigations easier and more intuitive, we’re removing friction while keeping the investigator firmly in control.”
The idea is that analysts should be able to bring in new information, connect datasets, ask questions, uncover relationships and move investigations forward without lengthy technical processes slowing them down.
We’re not trying to automate judgement. We’re trying to automate more of the first pass through complex information, so investigators can get to what matters faster and spend their time deciding where to go next.
Search that understands what matters
Siren 16 adds native semantic search. Keyword search is great when you know exactly what you’re looking for, but investigations rarely work that way. The same idea can be described in completely different words across different datasets.
Semantic search finds conceptually related information based on meaning and context, so you aren’t relying on exact matches. That’s especially useful across large, varied datasets where different sources describe the same thing differently.
It runs on Siren AI, using whichever model your organisation chooses, including locally hosted ones. Many of the organisations we work with treat sovereignty, security and control as basic requirements for AI, so we built this to fit that.
Images, video and audio you can actually search
Evidence is increasingly multimodal, and a lot of it never arrives neatly structured in a database.
Siren 16 uses AI to help investigators review and explore images, video and audio. It can identify vehicles and other objects of interest, describe scenes, read visible registration numbers, transcribe audio and video, and extract entities and keywords.
You can search indexed media using natural-language descriptions or visual similarity. The part I find most interesting is what happens next.
Information from media becomes part of the wider connected investigation, so an analyst can go from a vehicle, an object or a scene straight to the network around it.
Seeing how everything connects
Investigations are rarely about single records. They’re about relationships. A person connects to an organisation, which connects to an account, which connects to a transaction, which may lead to another account, a device, a location or an event.
Siren 16 gives investigators more freedom to explore those networks. You can start from one or more entities and expand the graph by entity type without specifying the relationship first. New node and edge connection counts show you quickly which entities and groups are highly connected and where to look next.
Relationships can carry their own context, such as dates, amounts or roles. Siren can also bring related external information, enrichment and geographic context directly into the graph, giving analysts more of the picture in one place.
Together, these capabilities help an analyst see not just what is connected, but what those connections say about the investigation.
K9 and the graph work together
Siren K9, our AI companion, works with the same connected graph. Investigators can talk to their data and graphs in natural language. K9 can help find insights across large networks, add, group and style nodes, and generate graph reports, all within the investigator’s existing permissions.
The two reinforce each other. A richer graph gives K9 more context to work with, while K9 turns complex graph work into simple natural-language requests. The result is less time operating the technology and more time understanding what the connections mean.
Surfacing connections you didn’t expect
Real investigations don’t follow a convenient A-to-B path. An important link might involve different relationship types, sit several steps from where you started or run in a direction you didn’t anticipate.
In Siren 16, graph queries can explore different relationship paths, follow relationships in either direction and match alternative relationship types along a path.
In practice, you can investigate how two entities are connected without knowing the route in advance. That’s closer to how investigations really go. You start with a lead, follow the relationships, test a hypothesis and surface connections you didn’t know to look for.
Following the money
The same approach pays off in financial investigations. Siren can now be configured for specialist workflows including Cryptocurrency Ransomware Payment Tracing and FIFO-Based Tainted Fund Tracing.
For ransomware cases, blockchain transaction data can be brought into Siren so analysts can see wallet addresses, transactions and fund movements in an interactive graph.
With K9 and graph link analysis, they can analyse transaction patterns, look into potential structuring and layering, trace payments through intermediary wallets and explore possible cash-out points at exchanges. A single transaction rarely tells the whole story. The network around it usually does.
Introducing Ledger Lens
Ledger Lens is new, and it’s there to make financial transaction ingestion simpler and support forensic fund tracing.
Investigators can process multiple bank statements in PDF, Excel and supported image formats. Ledger Lens extracts dates, transaction descriptions, debit and credit amounts and account information, and turns them into structured financial records. Analysts can check the extracted transactions against the original source and fix any errors before ingestion.
Once they’re in Siren, the transactions join the connected investigation, so you can explore account relationships, follow funds across multiple accounts and untangle complex financial networks. Siren can also be configured with risk scoring and suspicious activity records to support risk assessment and further investigation.
Mobile devices, connected to everything else
Siren’s Mobile Forensics processing links processed mobile-device extractions to the wider investigation. Rather than looking at a phone in isolation, analysts can relate phone numbers, email addresses, handles, call logs, messages, documents and media to information elsewhere in the case.
Advanced search and AI-assisted analysis help identify entities and themes, summarise material and surface relevant content. Device data becomes part of the picture instead of one more silo to work through separately.
Everyday things matter too
Not everything in Siren 16 is AI. Siren files and folders give investigators a clearer way to organise and find graphs, dashboards and other saved work, alongside our existing controlled sharing.
It’s a simple improvement, and that’s deliberate. As investigations grow, small bits of friction add up.
The engineering underneath
Some of the most significant work in this release won’t be visible to investigators. Siren 16 introduces a new patent-pending graph execution pipeline in Siren Federate, the engine behind our graph queries.
It can stop processing when no further results are possible and prune graph paths that can’t produce useful results. Graph requests can also run within a time budget, so a particularly demanding query can’t consume resources indefinitely.
This becomes increasingly important as investigative graphs grow in size and complexity.
A big investigation can contain an enormous number of potential relationships, and time spent following paths that can’t lead anywhere is wasted.
The same improvements make more flexible traversal possible, including moving through relationships in either direction and matching alternative relationship types.
We’ve also improved resilience. Siren Investigate can connect to multiple Elasticsearch hosts, with automatic failover between nodes to improve fault tolerance and reduce downtime risk.
There’s further work across graph exploration, query execution, memory use, task scheduling, resource management, security and platform stability.
Where this leaves investigators
Semantic search helps you find what matters even when you don’t know the right words. Media Intelligence makes hard-to-search content investigable.
The graph shows how it all connects, and K9 lets analysts work with complex data in natural language. The financial and mobile forensic workflows apply those capabilities to real cases. Files and folders, resilience and the engineering underneath help keep it manageable and reliable.
John Randles talks about the Autonomous Analyst, greater autonomy and less friction. His Siren Fusion vision was about AI serving people and helping analysts become more self-sufficient, rather than pursuing autonomous AI for its own sake. [
Renaud Delbru talks about finding what matters and understanding how it connects, an idea rooted in his long-standing work in search and the origins of Siren itself. I think those belong together.
AI should help investigators work across more information, make connections faster and get to the relevant evidence sooner.
The investigator is still the one who understands the context, interprets the evidence and decides what happens next.
That’s what Siren 16 is really about.
