A few weeks ago, I completed AntiSyphon’s Build Your Own AI Security Agent course.
I have been thinking a lot about how AI actually fits into cybersecurity. Not the hype version of it, but the practical version. The version where systems need to be useful, reliable, explainable, and safe enough to trust in real workflows.
Taking a bunch of logs and throwing them at an LLM is a bad idea for many reasons.
The course helped me understand that problem more clearly. It also gave me a better mental model for where LLMs are useful, where they are not, and what needs to exist around them for AI security systems to actually work.
Not Everything Should Be Handled by an LLM
One of my biggest takeaways was that not every part of a system should rely on an LLM.
Some parts should be deterministic. Some parts benefit from LLM reasoning. And some parts still need carbon-based life forms making judgment calls.
That may sound obvious, but it changed how I think about building these systems. The goal is not to force AI into every step. The goal is to understand which parts of the workflow need structure, which parts need reasoning, and which parts need human context.
The System Around the Model Matters More
The model matters, but the system around it matters more.
A smaller model with the right context, tools, skills, workflows, and guardrails can outperform a much larger model that is used poorly.
That is especially important in cybersecurity, where accuracy, context, and clear boundaries matter. A model on its own is not a security analyst. But a model inside a well-designed workflow can become a useful part of the investigation process.
Understand One Layer Below the Abstraction
Another lesson that stood out to me is the value of understanding one layer below the abstraction you are working with.
I have found this to be true in my own work as well. Working directly with containers, networking, and deployment configs made it much easier for me to understand what deployment platforms are doing under the hood. It also made troubleshooting faster when something broke.
The same applies to AI agents.
Understanding the basics of how LLMs work makes it easier to design better prompts, choose better tools, reason about failures, and build workflows that are more reliable.
The Bigger Lesson
Building effective AI systems is not just about picking the newest or largest model.
It is about understanding what should stay deterministic, what benefits from LLM reasoning, and where human judgment is still needed.
That balance is where AI becomes genuinely useful instead of just impressive in a demo.
A big shoutout to AntiSyphon Training and Faan Rossouw for the excellent course.
Also, a shoutout to The Carbon Layer, a YouTube channel I recently came across with some incredible content.