# AI for Cybersecurity & Information Security URL: https://justuju.org/role/cybersecurity/ For your role Security teams have two jobs with AI. One is using it: triage, investigation and hunting at machine speed. The other is securing it: every assistant and agent the company deploys is a new system that takes instructions from text. ## How AI is changing this work - The SOC gets agents that triage alerts and draft investigations, with analysts handling what is new or serious. - The attack surface grows: prompts, tools, model files and agent identities are all things to protect. - Attackers use the same tools, so phishing, recon and exploit work get cheaper for them too. ## Key layers, most important first ### 1. Layer 8 · Agents URL: https://justuju.org/layer/agents/ Why it matters: An agent acts with real permissions. Most serious AI incidents come down to an agent that could do more than its task needed. What to do here: - Identity per agent: Give every agent its own identity, so you can scope, log and disable it like a user. (see https://justuju.org/concept/agent-permissions/) - Sandbox and approve: Limit files, network and commands by default; require approval for anything destructive. (see https://justuju.org/concept/agent-permissions/) - A kill switch and a playbook: Know how to stop an agent, revoke its access and review what it did. (see https://justuju.org/concept/compromised-agent-response/) Examples as of 2026-11-11: Microsoft Entra Agent ID (https://learn.microsoft.com/en-us/entra/agent-id/disable-agent-identities); Claude Code sandboxing (https://code.claude.com/docs/en/sandboxing); OWASP Top 10 for Agentic Applications (https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/) ### 2. Layer 7 · Orchestration & Tooling URL: https://justuju.org/layer/orchestration-tooling/ Why it matters: This is where text becomes action. A model cannot reliably tell instructions from data, so anything it reads can try to steer it. What to do here: - Treat all content as untrusted: Emails, pages, files and tool results can carry hidden instructions. Screen them and limit what follows. (see https://justuju.org/concept/prompt-injection/) - Vet tool servers: Allow-list the tool servers agents may use, and review their descriptions as you would code. (see https://justuju.org/concept/mcp-tool-poisoning/) - Red-team before launch: Probe each AI app for injection, leakage and jailbreaks, and repeat after changes. (see https://justuju.org/concept/guardrails-evals/) Examples as of 2026-11-11: Prompt Shields (Azure AI Content Safety) (https://learn.microsoft.com/en-us/azure/ai-services/content-safety/whats-new); garak (NVIDIA) (https://github.com/NVIDIA/garak); PyRIT (Microsoft) (https://github.com/microsoft/PyRIT); OWASP Top 10 for LLM Applications (https://genai.owasp.org/llm-top-10/) ### 3. Layer 9 · Applications & Interfaces URL: https://justuju.org/layer/applications-interfaces/ Why it matters: This is where AI works for you: assistants and agents inside the security console that read alerts and logs faster than a person can. What to do here: - Alert triage: An agent sorts alerts, closes clear false positives with its reasons and escalates the rest. (see https://justuju.org/concept/ai-in-the-soc/) - Investigation drafts: Ask in plain words what happened on a host or account; verify the evidence it cites. (see https://justuju.org/concept/ai-in-the-soc/) - Set the autonomy level: Decide per action what the AI may do alone, such as tag or enrich, and what needs an analyst. (see https://justuju.org/concept/copilots/) Examples as of 2026-11-11: Microsoft Security Copilot (https://www.microsoft.com/en-us/security/business/ai-machine-learning/microsoft-security-copilot); Google Security Operations (https://cloud.google.com/security/products/security-operations); CrowdStrike Charlotte AI (https://www.crowdstrike.com/en-us/solutions/agentic-soc-transformation/) ### 4. Layer 6 · Inference & Optimization URL: https://justuju.org/layer/inference-optimization/ Why it matters: Model files are software you download and run. They need the same supply-chain care as any other dependency, and exposed model servers are a common finding. What to do here: - Safe formats only: Prefer weight formats that cannot run code on load, and scan the rest. (see https://justuju.org/concept/model-supply-chain/) - Verify the source: Pin model versions and check signatures, as you do for packages. (see https://justuju.org/concept/model-supply-chain/) - Do not expose model servers: Local and self-hosted model servers often ship without authentication. Keep them off the internet. (see https://justuju.org/concept/local-inference/) Examples as of 2026-11-11: safetensors (Hugging Face) (https://huggingface.co/docs/safetensors/index); Hugging Face Hub pickle scanning (https://huggingface.co/docs/hub/security-pickle); model-transparency signing (Sigstore) (https://github.com/sigstore/model-transparency) ## High-leverage use cases - Alert triage: Agents handle the first pass on high-volume alerts and explain each verdict. - Investigation and reporting: Timeline, affected assets and a draft incident report from logs, for an analyst to verify. - AI inventory: A register of every assistant, agent, model and tool server in the company, with owner and access. - Red-teaming AI apps: Automated probes for injection, data leakage and unsafe tool use before each release. - Detection writing: Draft detection rules and queries from a threat report, then test them. ## Start here: the next 30 to 60 days - Week 1 to 2: Inventory the AI already in use: assistants, agents, tool servers and who approved them. - Week 3 to 4: Run an open-source scanner against one internal AI app and fix what it finds. - Day 30 to 60: Set agent rules: own identity, least access, logging, and a tested way to shut one down. - Day 30 to 60: Pilot AI triage on one alert type and measure it against analyst verdicts. ## Risks and pitfalls - Prompt injection has no full fix: It is the first item in the OWASP list for a reason. Assume it will sometimes work and limit what a steered model can do. Source: https://genai.owasp.org/llm-top-10/ - Over-trusting the triage agent: A wrongly closed alert is a missed intrusion. Sample closed alerts and track misses. - Shadow AI: Staff connect assistants and tool servers faster than you can review them. Make the approved path the easy one. - Excessive agency: Agents given broad standing access turn a small trick into a large incident. Source: https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/ - Sensitive data in prompts and logs: Prompts, transcripts and agent logs hold secrets and personal data. Protect and expire them like any other log. ## Sources - Microsoft Entra Agent ID (learn.microsoft.com): https://learn.microsoft.com/en-us/entra/agent-id/disable-agent-identities - Claude Code sandboxing (code.claude.com): https://code.claude.com/docs/en/sandboxing - OWASP Top 10 for Agentic Applications (genai.owasp.org): https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/ - Prompt Shields (Azure AI Content Safety) (learn.microsoft.com): https://learn.microsoft.com/en-us/azure/ai-services/content-safety/whats-new - garak (NVIDIA) (github.com): https://github.com/NVIDIA/garak - PyRIT (Microsoft) (github.com): https://github.com/microsoft/PyRIT - OWASP Top 10 for LLM Applications (genai.owasp.org): https://genai.owasp.org/llm-top-10/ - Microsoft Security Copilot (microsoft.com): https://www.microsoft.com/en-us/security/business/ai-machine-learning/microsoft-security-copilot - Google Security Operations (cloud.google.com): https://cloud.google.com/security/products/security-operations - CrowdStrike Charlotte AI (crowdstrike.com): https://www.crowdstrike.com/en-us/solutions/agentic-soc-transformation/ - safetensors (Hugging Face) (huggingface.co): https://huggingface.co/docs/safetensors/index - Hugging Face Hub pickle scanning (huggingface.co): https://huggingface.co/docs/hub/security-pickle - model-transparency signing (Sigstore) (github.com): https://github.com/sigstore/model-transparency - NIST AI Risk Management Framework (AI RMF 1.0): https://www.nist.gov/itl/ai-risk-management-framework --- Justuju · https://justuju.org/ · Content CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Quote with a link to the page.