AI Cybersecurity Engineering

Make findings easier to investigate

Scan output, vulnerability references and network events arrive in different formats and at different levels of detail. An AI workflow can help normalize that information, retrieve context and prepare an analyst-facing explanation, provided the result remains grounded in the underlying evidence.

My public Agentic Cybersecurity AI Assistant combines planner, retriever and analyst responsibilities. My intrusion-detection work explores learning from network traffic. These are complementary capabilities: assisting investigation and evaluating detection models require different data, tests and review processes.

Inputs, outputs and scope

Inputs

Authorized findings or network data, asset context, permitted knowledge sources, data handling rules and analyst-reviewed examples.

Outputs

Normalized findings, an evidence retrieval workflow, analyst-facing summaries or model outputs, traceable reports and evaluation documentation.

Decisions to agree

Scope of authorization, which tools may run, how sensitive logs are processed and which conclusions or actions always require analyst approval.

Technical approach

1. Normalize findings and preserve evidence

   Keep original source identifiers, timestamps and relevant asset context when preparing data. Distinguish observed evidence from inferred explanations so a reviewer can trace a conclusion back to the input.

2. Retrieve relevant security knowledge

   Index permitted references and internal documentation with source metadata. Connect retrieved passages to findings and keep knowledge updates explicit so an older reference does not appear current by accident.

3. Bound agent and tool execution

   Use stateful orchestration for analysis, retrieval and report preparation. Expose only permitted tools, validate their arguments and record failures. Any active testing remains within the expressly authorized environment and scope.

4. Evaluate the right task

   Assess report grounding and citation correctness separately from detection performance. For traffic models, examine class-wise precision, recall, false positives, data leakage and behavior under distribution shift rather than relying on overall accuracy.

Delivery and evaluation

An initial milestone uses a controlled sample of findings or a defined dataset with agreed analyst expectations. The next milestone integrates retrieval and report structure, followed by error handling and the application interface. Access controls, secret handling and logging requirements belong in the implementation from the start.

Acceptance should include missing references, contradictory inputs, failed tool calls and unsupported conclusions. For anomaly or intrusion models, the evaluation report must identify the data split, class distribution and limitations. A human reviewer decides whether the evidence supports remediation or further investigation.

Relevant public work

These project pages provide concrete examples of related engineering and identify prototype or research scope where applicable.

Questions about this service

Does this replace a security analyst?

The intended role is to support investigation and reporting. Analysts still assess scope, evidence quality, risk and the appropriate action. The interface should make the source material and uncertainty easy to inspect.

Can an assistant work with our existing scan outputs?

Yes, after reviewing the formats, permissions and useful asset context. A small set of representative findings lets us define normalization, retrieval and report requirements before connecting a broader environment.

Can you promise a particular detection accuracy?

No responsible target can be set without the data and evaluation setup. We agree on the relevant error measures, establish a baseline and report measured results with their limitations.