Cyacomb tool spots altered child abuse images faster

Cyacomb has added a new image-detection method, Similarity Matching, to its Examiner Plus digital triage platform for law enforcement teams investigating child sexual abuse material (CSAM) on mobile devices.

The Edinburgh-based company said the feature can identify known CSAM in minutes, including images shared via messaging apps and altered from their original form.

Messaging changes

Investigators often rely on hash matching when scanning seized phones and other devices. Hashing creates a unique digital signature for a file. If a file matches a known record, investigators can flag it quickly without manually reviewing every image.

That process is harder when images pass through consumer messaging services. Platforms often compress files or strip metadata during transmission. Those changes can alter the hash value and prevent exact-match detection against existing datasets.

Similarity Matching targets those altered images. Instead of relying on exact hash values, it compares images in a way that can still identify a match after a file has been shared, transcoded, or modified, Cyacomb said.

Cyacomb said the feature is intended to cut device triage times in child protection cases and reduce the number of images investigators need to view manually.

"Traditionally, identifying images of child sexual abuse that have been circulated via messaging applications has been extremely difficult and time-consuming for law enforcement because hash values change during transmission," said Chris Johnson, Cyacomb's CEO.

"This often forces investigators to manually review devices and images, which can take months whilst also rising the risk of officer wellbeing. Our new capability changes that entirely, enabling identification in minutes and supporting faster triage, safeguarding and justice," Johnson said.

Rising volumes

The announcement comes as police forces and specialist units report sustained pressure from the growing scale of online child sexual abuse. The Internet Watch Foundation reported 312,030 CSAM reports in 2025, a seven percent increase from 2024.

The foundation also reported a rise in AI-generated abuse. It said it identified 3,440 AI-created CSAM videos in 2025, up from 13 the previous year-an increase of 26,362 percent.

Generative AI has intensified scrutiny of manipulated imagery and synthetic content. Several consumer AI systems have faced criticism over potential misuse, including creating sexualised imagery from real-world photos. Industry and government bodies have discussed tighter controls for datasets, model access, and enforcement, while police and child protection organisations focus on practical detection and investigation workflows.

Cyacomb said these shifts add operational strain. Investigators may face a mix of known material, previously unseen imagery, and content transformed through re-sharing across platforms. Each change can complicate rapid identification when traditional systems depend on exact digital fingerprints.

Product context

Examiner Plus is part of Cyacomb's digital triage product line, designed to help officers or analysts identify priority evidence quickly while limiting unnecessary intrusion into personal data. Cyacomb said its approach focuses on detecting known illegal and harmful content without exposing unrelated material.

Cyacomb was founded in Edinburgh in 2016 and was previously known as Cyan Forensics. Its tools are used by law enforcement and border agencies in multiple countries, according to the company.

Cyacomb did not disclose pricing for the new capability, how it will be licensed within Examiner Plus, or which agencies are using it. It also did not publish performance metrics such as false positive rates, the size of reference datasets, or how similarity thresholds are set in operational use.

Law enforcement agencies have increasingly looked for triage tools that shorten the time from seizure to decision-making. Many forces face backlogs in digital forensics, which can delay charging decisions and safeguarding interventions. Vendors have also emphasised methods that reduce the need for full-device extraction and limit exposure to irrelevant personal data.

Cyacomb said Similarity Matching is now available in Examiner Plus for agencies using the platform for mobile device examinations.