Learn
AI in Network Defense
Where AI actually fits in a SOC
AI is genuinely changing how security teams operate, and it's worth cutting through both the hype and the dismissal to talk about it plainly. The honest version isn't "AI replaces analysts" and it isn't "AI is just marketing noise" either. It's narrower and more useful than both: AI is good at specific, bounded tasks that free up analyst time for the judgment calls that still require a person, and it's genuinely bad at the parts of the job that require accountability, context an organization doesn't have automated access to, or a decision someone has to stand behind.
That distinction, augmenting the analyst rather than replacing them, is the actual state of the field right now, not a hedge to sound responsible. Every serious use of AI in a SOC keeps a human in the loop for exactly the reasons below.
Where it genuinely helps
Alert triage and enrichment. A SOC's biggest volume problem is alerts, most of them low-value, some of them genuinely important, and not enough analyst hours to look closely at all of them. AI is well suited to a first pass: pulling in context automatically (is this IP known-bad, has this account triggered anything else recently, does this process hash match known malware), and surfacing the alerts most likely to matter so a human's attention goes where it's actually needed first. This doesn't replace triage judgment. It removes the tedious data-gathering that judgment depends on.
Playbook automation for response speed. Once an incident's confirmed, a lot of the response is mechanical: isolate a host, disable an account, pull a specific set of logs. Automating the mechanical steps of a well-defined playbook means response happens in seconds instead of the minutes it takes a human to manually execute the same steps, without changing who decides whether to trigger the playbook in the first place.
QA of analysis. A second set of eyes catches things a first pass misses, and AI can function as exactly that: checking an analyst's conclusion against the underlying evidence, flagging gaps or inconsistencies, without being the one who signs off on the finding. This is quality control, not a replacement for the original analysis.
Detection engineering assistance. Writing and tuning detection rules well is a real skill, and a lot of the work is iterative: draft a rule, check it against historical data, adjust for false positives, repeat. AI can accelerate that iteration loop, generating a first draft or suggesting tuning based on observed false-positive patterns, while the actual decision about what the detection should catch, and whether it's good enough to ship, stays with the engineer.
Incident report drafting. Writing up an incident clearly, for a technical audience or a non-technical one, is time-consuming and takes a different skill than the investigation itself. Drafting a first version from an analyst's raw notes and timeline, for a human to review, correct, and take ownership of, is a genuinely useful place for AI assistance that doesn't touch anything about the finding itself.
Where the limits are, and why they matter
None of the above works without a human checking the output. AI tools produce wrong answers with the same confident tone as right ones, and in security specifically, a wrong answer acted on without verification can mean containing the wrong host, missing the real one, or reporting a finding that doesn't hold up. The tools that make triage faster are also tools an adversary can study and try to evade or manipulate, which is its own emerging risk, not a hypothetical one.
There's a second-order risk worth naming directly: leaning on AI for the parts of the job that build judgment, actually reading raw logs, actually reconstructing a timeline by hand, is exactly how that judgment stops developing. The tools are most valuable to someone who could do the work manually and is using AI to go faster, not to someone using it as a substitute for learning to do the work at all.
What this means for you
Every scenario in this platform is deliberately hands-on-keyboard: you're reading the raw telemetry, not a summary something else generated for you. That's not an accident, and it isn't a stance against using AI tools on the job later. It's the opposite: the analysts who get the most out of AI-assisted tooling are the ones who already know what a correct answer looks like well enough to catch it when the tool is wrong. That's the skill this platform is built to develop, and it's the same skill that makes AI assistance actually useful rather than actually dangerous once you're using it for real.
You've read the ladder
Now go find it live.
Launch a real, breached range and put everything from Foundations to here to work: detect it, investigate it, write it up.