Just defended my capstone project for the AI in Cybersecurity programme, and I'm still excited about how it…
HOROIHEOMA C. — Cybersecurity Analyst
Just defended my capstone project for the AI in Cybersecurity programme, and I'm still excited about how it went.
The project simulated an end-to-end security assessment for a fictional fintech, working across four areas: researching a real threat actor and its history of targeting financial platforms, running passive reconnaissance with shodan.io and ollama to uncover exposed systems, triaging a live looking credential-stuffing incident and building an AI-augmented incident response playbook, and closing it out with a compliance gap analysis against recognized security frameworks(ISO 27001).
Throughout, I worked hands-on with Ollama (running local models) and Claude Code, using them the way I'd expect to in a real SOC — as a research and drafting accelerant, never as the final word.
That's exactly why AI matters so much across this field right now:
In threat intelligence, it can turn hours of research into a structured briefing in minutes — but every claim still needs a human to check the source.
In a SOC, it can triage and rank alerts faster than any analyst — but it can't yet tell a real account takeover apart from a legitimate customer having a bad login day(false positives).
In incident response, it can draft the playbook, the timeline, the customer notice — but every action that actually locks an account or freezes a transfer still needs a named human to approve it.
In compliance, it compared our policies against two ISO 27001 controls — Authentication Information/Access control and Logging/monitoring — and flagged real gaps in minutes: no multi-factor authentication or password rotation requirement, no least-privilege access model, no formal incident response plan, and no clearly defined incident-response roles.
Fast and useful, but the legal and regulatory judgment call still belongs to people.
AI didn't replace the analyst anywhere in this project. It just moved the human's attention from typing to thinking — which, if used right, is exactly where it should go.
A few things that stuck with me:
A weak prompt gets you a guess. A structured one that spells out the role, the context, the objective, and clear constraints — gets you something detailed and comprehensive.
"The AI said so" is never the end of an investigation always bearing in mind ai hallucinations and overreacting) .
The best security work still starts and ends with a human asking, "wait, is that actually true?"
Huge thanks to Brixgate for building a programme that didn't just teach AI tools, but taught how to think critically alongside them. That's the skill that is going to matter most as this field keeps moving.
Looking forward to putting this into practice.
#Cybersecurity #AI #ThreatIntelligence #IncidentResponse #SOC #GRC #BrixgateAcademy #Ollama #ClaudeCode
6 reactions · 0 comments
Topics: #claudecode, #brixgateacademy, #ollama, #ai, #threatintelligence, #incidentresponse, #cybersecurity, #soc, #grc