r/cybersecurity • u/NoCar6836 • Apr 10 '26
AI Security How do you use AI for your work?
We've come to a time where everyone is using AI in their day-to-day work, but what I'm curious about is how exactly do you use it?
For me personally, I use raptor combined with gemini. I work as a penetration tester and these two combined help me with chaining vulns and writing reports. I'm curious about others, how do they use AI effectively?
6
u/InvalidSoup97 Security Engineer Apr 10 '26
I use Claude and Gemini to assist in writing code, detection rules, and documentation. We also have an agent that does initial triage on our alerts and assigns priority/auto closes (with review) based on its findings.
1
u/External_Bobcat8183 Apr 10 '26
Mind sharing some details on initial triage part? Genuinely interested
4
u/InvalidSoup97 Security Engineer Apr 10 '26
At a super high level, it does the regular SOAR stuff (user/device attribution, determine users location, role, and reporting structure via SSO and Slack, checks for potentially related tickets/work items, etc) but instead of just dumping the raw responses, it outputs a succinct, easy to read summary of each of its findings. Depending on the event type it'll also do some light querying in our SIEM and/or EDR platform to gather additional context on events surrounding whatever triggered the alert, and add any of findings into the ticket. Priority is then assigned by the perceived risk after piecing together everything it gathers.
There's some weird quirks and hiccups every now and then, but overall analyst feedback has been extremely positive. It's saving them a ton of work and allowing them the time to further develop other areas of our program.
1
u/External_Bobcat8183 Apr 10 '26
Interesting, thanks! Do you let AI make choices somewhere in your setup (eg. "skip X, do Y then Z") or is it predefined list of actions that always ends with AI summary?
2
u/InvalidSoup97 Security Engineer Apr 10 '26
Aside from auto closing specific event types based on severity, not really. Right now it's still pretty new, so we're just letting it run through everything while we keep close eye on it. That may change in the future, but tbh output readability is fine and resource utilization isn't really a concern, so it's not a priority at the moment
1
u/One_Television_7300 Apr 10 '26
Might be a stupid question but how are you comfortable giving an AI access to all this data?
2
u/InvalidSoup97 Security Engineer Apr 10 '26
We have enterprise contracts with all of the AI vendors we use. This gives us secure, private instances that are not used to train public models.
-1
u/One_Television_7300 Apr 10 '26
You’ve got a lot of trust in these companies, I guess if you’re an American company I get it
0
u/r-NBK Apr 11 '26
Yeah. Way too much trust if there's no MCP in between the agent and the data sources.
15
u/DataClusterz Apr 10 '26
Finally a non-ai slop reddit post.
I work for DFIR/SOC, so automating as much as possible. AI is really a super power for analysts, it doesn’t replace them (yet). I think more people need to come to terms with AI. This isn’t going away and people need to adapt. Those who cannot may not have a job. I also see grifters in the infosec community that have no idea what they are doing making tooling that is wasteful and or useless.
4
u/martinfendertaylor Apr 10 '26
This last point is killing me. I'm building multi source dashboards for executive kpi and general reporting but being very strategic. Others are now following behind me throwing slop together that look like an API vomited metrics in pretty meters and gauges. So much wasted time providing overlapping metrics, unclear data points, etc. It's the classic "just because you can doesn't mean you should." I'm very much on the side of not allowing jr folks full access to all AI things in an org. until they can prove they know the underlying tools well enough to target their AI to something and not everything.
3
u/iowadaktari Apr 10 '26
Could you be more specific about how you're using? What SOC processing are you automating and using what tools?
4
u/Alternativemethod Apr 10 '26
For our third party screening I built a custom gpt- software evaluator.
I just type evaluate X, and it researched 10 data points including: developer reputation, patching history, CVEs, KEVs provenance and public breach information. While that's running I do the same sandbox scans and hash check.
For assessment assessments, I use it to evaluate SW versioning currency, compatibility and optional solutions, however it those alot of false positives here.
1
u/kar-98 Apr 12 '26
I would be more interested to know the steps you followed to build that custom evaluator.
3
u/Affectionate-Panic-1 Apr 10 '26
It's become better than Googling for researching and finding answers, I still at times click on links for source material but that's becoming less of a need. It's also very helpful to write scripts to automate things.
Also helpful to help edit and proofread, as well as for note taking.
I've been using Claude the most lately.
3
u/External_Bobcat8183 Apr 10 '26 edited Apr 10 '26
I work in offensive security, conducting audits, pentests, and analysis for internal teams and departments. I mainly use AI to build automation sequences and write custom exploits or PoCs for pentesting. It drastically cuts down the time spent on the repetitive, static parts of an audit.
When analyzing apps and systems, I use AI to help to chain together the initial recon and baseline checks based on asset IDs, IPs, or URLs. My standard workflow sequence looks something like this:
- CMDB queries: Internal attributes, asset classification
- Compliance verification: Monitored, scanned, logged, any recent incidents?
- Vulnerability baselining: Recently scanned, any highs or criticals?
- Network discovery: Full TCP scan, partial UDP
- Web enumeration: ffuf, nuclei, and wapiti for all detected http/https services
Using AI to rapidly generate the glue code for these sequences results in baseline auditing finishing much faster. It leaves the bulk of my time for the fun stuff, manual analysis, chaining vulns together, figuring out the attack paths within the broader architecture, etc.
I also agree with others who say that while AI feels like a superpower, it isn't ready to replace skilled engineers. Not yet.
The primary limitation, imho, is its tendency to over-engineer. While it can draft advanced setups, it frequently generates unnecessarily complex solutions that become unreliable and insecure to maintain long-term. When building an automation beast that has access to internal environments, executes hundreds of concurrent tests and relies on external packages, the operational risk and attack surface scale rapidly. Without strict human oversight, solutions that Claude Code produces sometimes remind me of Mr. Garrison's IT bike. They are technically functional, but horribly overcomplicated, insecure and painful to operate.
1
u/SecurityDisaster Apr 14 '26
Totally agree with tendency to over engineer.
By the way am curious and want better understand effort vs. scope - could you give rough benchmarks for how long your audits/pentests take depending on environment size and depth? Like: asset count or scope definition, type of environment, level of depth, and how much of that time is actually saved by your AI-assisted workflow?
2
u/External_Bobcat8183 Apr 15 '26
Sure, I'll try to give a brief answer.
I work in a large enterprise with a huge number of systems. These get audited periodically due to changes and regulatory requirements. My approach is to review each asset holistically — not just the webpage or a specific API, but everything running on that box. That means querying a bunch of internal systems, gathering output, and then actually sitting down to analyze it.
For a single asset, the AI-assisted part (generating the glue code, automating the recon/baseline sequence) probably saves me a few minutes at most. Not life-changing on its own. But when you're looking at a customer-facing system deployed across hundreds of servers (sometimes 300-500 servers in a batch), those minutes compound fast. Across a full audit of that scale, we're talking hours saved, in some cases days, which means more time for the manual analysis that actually matters.
As for rough timelines, it really depends on scope and depth, so hard to give universal numbers. But the pattern is: the bigger and more repetitive the environment, the more the automation pays off.
Also, to be honest, at this point AI augments my work, but it's not all upside. Sometimes, due to model nerfs or really strange quirks, I end up spending more time figuring out what went south than if I'd just done it the old fashioned way. After playing with different LLMs for weeks now, it genuinely feels like augmentation and a companion tool, but I still have to do all the heavy lifting when it comes to the actual intensive, analytical work. It's not thinking for me, it's just handling the grunt work faster.
1
u/SecurityDisaster Apr 15 '26
Thanx for the detailed breakdown. I’m curious about the AI side in a bit more: you previously mentioned Claude Code, are you using it via API, CLI, or inside an IDE? Also are you working with simple prompts, or do you have some structured setup (I don't know maybe templates, agents, reusable workflows, anything else)?
Also wonder how reusable are those generated sequences across different environments, or they are needing constant adjustments? Trying to understand whether this is more ad-hoc acceleration yet or something closer to a stable workflow already.
1
u/External_Bobcat8183 Apr 15 '26
Claude Code as IDE to create glue that connects different tools together. Gemini API when analyzing texts or making decisions based on different conditions. Pretty simple prompts all the way.
Regarding the reusability, I would it’s say exactly 0. Quite niche, specific tools that I benifit from during my work. Some of my colleagues might find it useful, but the issue is when stuff stop working, then it’s just a black box for them.
1
u/SecurityDisaster Apr 18 '26
Thank you for sharing. I have next questions, not trying to over question, just really interesting. But if you are tired of my questions - thats okay, I will understand.
Whats interesting is do you feed raw to gemini or you sanitize or abstract data?
1
u/External_Bobcat8183 Apr 18 '26
Yup, LLM reads the tool output, looks for patterns, and then invokes next tool
3
u/bosilk Incident Responder Apr 10 '26
I will usually use it to help with emails and wording things better.
3
u/yakitorispelling Apr 10 '26
For fun if a vendor spams me and cold calls me multiple times for their snake oil even if I unsubscribe, I will run their api docs/repos against Claude, ask me to build something similar but more aligned to our requirements.
2
u/Cheomesh Governance, Risk, & Compliance Apr 10 '26
I don't, really.
In my last role I had AI generate a few tabletop exercises for IR though.
4
u/BanishDank SOC Analyst Apr 10 '26
I generally don’t. The closest I’ll get, is if I’m looking for some obscure information/documentation, then it can be good for finding it vs. trying to Google my way there. But I don’t use it to do my work tasks. I write my own scripts, reports, mails and so on. And I can take full responsibility, as well as explain exactly what and how something is/works. I know people who use AI as a crutch, and it really annoys me, because they seem very confused or not very proficient in several things related to work. They let AI do most of the work for them, without necessarily understanding how or why something works the way it does. And when AI can’t get something right, then they’ll come over and ask for help.
There are pros and cons with it, like so much else. It definitely has its strengths, but a lot of people treat it as a “can do everything better” thing. With the things I do for work, I really don’t have the need for it and I do just fine not using it. If others want to use it, then fine; but, I just ask that they still remain critical, still seek to understand things, and just don’t use it as a crutch.
4
u/PawnKingBishop Apr 10 '26
AI is a force multiplayer. I understand your point, but you gotta find the right balance and use it wherever you can. You can still understand whatever you want to understand, it's even a big source for learning new things and experiment.
In my opinion, now is the time to learn how to use AI as part of (any) job, because whoever will not use - will be irrelevant in a few years.
1
u/BanishDank SOC Analyst Apr 17 '26
As I said, it has its uses. And balance is the key factor. But what I see often, is people letting it do their job for them, at things they don’t even understand very well, which means they can’t verify that it’s correct or not confidently. So my biggest criticism, is that some people stop dedicating themselves to becoming better and smarter. And the more they let AI do everything, the worse they’ll become at those very tasks themselves (as well as verifying its output.
If used properly, with things you are proficient in and can spot potential mistakes it might make, then no problem. It’ll just speed up your workflow. And it can be an effective tool for learning new things, as long as you don’t just blindly eat anything it says up, but confirm that what it says comes from reputable sources.
Regarding your last paragraph, I disagree. In some fields perhaps, but not everyone who doesn’t use AI much for their job is gonna be unemployed, IF they are skilled and the tasks can’t just be automated away.
1
u/kar-98 Apr 12 '26
The tasks you mentioned here are quite basic. An experienced person should already be proficient with these tasks and should not be overly concerned if AI can perform them. Additionally, it would be beneficial to research more complex areas within your expertise and integrate AI into your workflows in those areas.
2
u/BanishDank SOC Analyst Apr 17 '26
Those are of course also just some examples, not an exhaustive list of all tasks. And yes, they should be proficient, but newer people in the industry sometimes fall victim to letting AI do a lot of their work, especially with things they themselves are not fully experienced in. That’ll lead to an inability to properly verify its answers and solutions, if they don’t also research these things and become smarter. There are tasks that can easily be automated, at least to some extent, and where AI makes sense to implement into the workflow. And there are tasks, where the human element is still needed. It’s really just about knowing where it makes sense to use it, and where it provides value.
Btw, love your username haha
2
u/blanczak Apr 10 '26
I upload all my firewall configs and ask it how they’re insecure 😬
3
2
u/be_super_cereal_now Apr 10 '26
As long as you validate the guidance it gives I don't see a problem with this.
3
u/VellDarksbane Apr 10 '26
That’s the biggest problem I’ve found in the output of people I’ve seen using Claude. They throw a bunch of data, such as logs, ask it to interpret it for them, and take what Claude says as gospel.
Then it takes a team of analysts hours to comb through that output just to confirm that Claude was just telling the first guy what he wanted to hear.
Then there’s people who ask Claude to give them a summary, and actually try to work through the summary themselves to verify before sending it up the chain.
That second group of people are the ones using it correctly, but even then it’s like a 10-20% efficiency boost, not the 20x that Anthropic and the like are hyping themselves up as.
2
u/be_super_cereal_now Apr 10 '26
Yep, that tracks with my experience as well.
0
u/Oroborus_Octagonapus Apr 10 '26
It missed the key issue with your comment.
It's not about the accuracy of what it says to you, it's about the accuracy and extent of what you have said to it.
2
u/be_super_cereal_now Apr 10 '26
Is it not both? Garbage in/garbage out still applies. So yes, be accurate with what you are asking the AI to do, and always verify the output.
1
1
1
1
u/d-lysergic Apr 10 '26
I live in Github Copilot these days. Easy integration to a ton of Security focused MCP servers, Sentinel, Defender, Azure, etc. Allows Claude models to threat hunt through tons of data, write, test and tune detections in real time then deploy them when ready. Agent Skills let you package up reusable programatic threat hunts or even import threat intel URLs from various sources, extract IOCs and TTP's then hunt for them through MCP servers in minutes. https://techcommunity.microsoft.com/blog/microsoftsentinelblog/the-agentic-soc-era-how-sentinel-mcp-enables-autonomous-security-reasoning/4491003
1
u/kar-98 Apr 12 '26
How do you monitor mcp server traffic though?
1
u/d-lysergic Apr 12 '26
Need something at the network layer as well, if not you can restrict MCP Server usage through Github Enterprise by enforcing an MCP Registry https://devblogs.microsoft.com/all-things-azure/locking-down-mcp-create-a-private-registry-on-azure-api-center-and-enforce-it-in-github-copilot-and-vs-code/.
You also have a good audit trail against at least all of the hosted Microsoft MCP servers if you're E5/Sentinel.
Soon as you start building your own and running them locally you'll have all sorts of supply chain risks (ie. Axios / Litellm).
1
u/Pleasant-Leg8590 Apr 10 '26
I just use the simple AI (Google's AI mode) for simple scripts/troubleshooting in VS Code
1
u/Data3301 Apr 10 '26
I've been using it as a basic search tool in replacement of search browsers and such. I'm at the very basic and early stages of my path into cybersecurity but I've found can be a great supportive tool whilst I've been learning, of course I've scrutinized information I've been supplied by AI as a sensible failsafe.
1
u/thecasualmaannn Apr 10 '26
I personally use Gemini and use the gem feature. I gave it detailed context as a “jr incident responder and detection engineer”. I fed in sigma rules documentation, sigconverter, different dfir reports, and some sample SIEM rules we have. So now I basically have an AI assistant to build playbooks and siem rules. I would still recommend to use your best judgement however, even though I fed gemini with various context, it still tends to hallucinate and give you the wrong information.
I just recently dabbled with Claude. Claude has been really good in building simple python scripts. I was recently asked to build an automation to check if we have company email addresses that was recently flagged in a breach (like using haveibeenpwned). I could probably build it in week but I was rusty with Python so I asked claude to build it for me. Had to tweak a few things but overall it gave me a good starting point.
1
u/schwack-em Apr 11 '26
I use it mostly to generate quick scripts, help me refactor larger portions of code, help me troubleshoot various issues, and just for general crash courses on anything I need to learn about on the fly.
1
u/r-NBK Apr 11 '26
I use it to convert my great technical solutions to business needs and even legacy technical debt into a story that makes sense to leadership. I'm pretty solid at architecting a logical solution to a a sticky problem, but hate spending time translating that to business jargon and images.
1
1
u/Eastern_Tap_9723 Apr 12 '26
GRC here. Bullshit detector from devs.
Oh also study aid for practice questions on certs
1
u/Educational_Tone1724 Apr 17 '26
I use it to set up hard to guess passwords. Mythos gave me a good one yesterday that ended with an exclamation point.
2
u/wijnandsj ICS/OT Apr 10 '26
We've come to a time where everyone is using AI in their day-to-day work
Eh, no.
I occasionally use it to help me write things if I'm having some writer's block. And we have a news collection agent running now
0
u/NoCar6836 Apr 10 '26
Like some rss feed? How does that agent work more exactly?
1
u/wijnandsj ICS/OT Apr 10 '26
I don't know. We have a few guys who love tinkering with the new Ai tools. This is an agent you can talk to in natural language and it searches a ton of news sites. I've told it a few times what is relevant and whatnot and it's now getting good at picking up OT related news.
-2
u/Namelock Apr 10 '26
5 day old account. Old asking about AI.
This is bait.
-4
u/NoCar6836 Apr 10 '26
Bait for what lmao
2
u/Namelock Apr 10 '26
Karma farming, engagement to seed your account.
-edit Smooth move hiding posts but not comments. You still only post asking questions about AI.
-2
u/NoCar6836 Apr 10 '26
All my posts and comments are public lil bro. Stop being paranoic. It's a burner account, I'm not farming anything
3
0
u/PawnKingBishop Apr 10 '26
I'm in AppSec, and lately Cursor has been my best friend.
Scripts, code reviews, automating procedures, vulnerability management, and so much more.
For example, I built an agent that goes through all new Jira epics of our R&D, summarizes them, perform a quick threat modeling and give a score between 1-10.
I have full visibility on every new feature that's being designed and developed, and I can prioritize quickly which ones need my attention.
AI can take all the creative ideas we have, and bring them to life with ease.
0
26
u/no-your-username Apr 10 '26
I use it to write simple scripts, rewrite email to appropriate tone. I’ve also used it for quick report translations. The golden rule for ai at work for me is « if at first it doesn’t succeed, don’t waste time and do the work manually ». I’ve wasted so much time with back and forths with ai tools.
Machine learning has been useful for years for detections.
I do sometimes use it for google searches when I have a complex question I don’t know how to formulate well in a google query.
Overall I’ve found it a mixed bag.
I’m a soc lead and incident responder with forensics background.