AI-Assisted Security Operations

AI-Assisted Security Operations

AI Security · Security Automation · SecOps · Human-in-the-Loop

Using AI to Accelerate Security Work Without Removing Human Judgment

Security teams spend a significant amount of time on repetitive work:

• Reviewing findings

• Correlating context

• Writing tickets

• Investigating alerts

• Troubleshooting controls

• Drafting scripts

• Creating documentation

• Summarizing technical risk for different audiences

AI can help reduce that overhead, but I do not view AI as a replacement for security judgment.

My approach has been to use AI as a force multiplier for analysis, automation, and documentation while keeping humans responsible for validation and production-impacting decisions.

The goal is simple:

Move faster without lowering the quality of the security decision.

The Problem

Security teams often have access to more data than they have time to review.

A single cloud finding can involve:

• Resource configuration

• Vulnerability details

• IAM permissions

• Network exposure

• Asset ownership

• Attack-path context

• Logging evidence

• Business criticality

• Remediation options

Manually reviewing all of that context is expensive.

At the same time, blindly automating remediation is risky.

AI sits in the middle of that problem.

It can help organize and accelerate analysis, but its output still needs to be validated against authoritative telemetry and the actual environment.

My Approach

I use AI in areas where it can reduce repetitive effort while preserving human control.

The model is:

Collect context

↓

Use AI to accelerate analysis

↓

Validate against source systems

↓

Make a human security decision

↓

Automate the repeatable portions

This keeps AI in an assistive role rather than treating it as an unquestioned source of truth.

Security Finding Analysis

One practical use of AI is helping analyze complex security findings.

A finding may include several dimensions:

Vulnerability severity

Internet exposure

IAM privileges

Sensitive data

Attack-path context

Business ownership

AI can help summarize how those pieces relate and identify which questions deserve further investigation.

For example, instead of reviewing each field independently, AI can help frame:

• Why the finding may be high risk

• Which permissions matter

• Whether the resource is exposed

• What information is missing

• What should be validated next

• Which remediation path appears most practical

The output is then checked against the source platform before action is taken.

Vulnerability Triage

AI is particularly useful for reducing the manual work involved in vulnerability triage.

It can assist with:

• Summarizing findings

• Comparing multiple vulnerabilities

• Identifying likely duplicates

• Grouping related issues

• Explaining attack paths

• Suggesting remediation priorities

• Converting technical findings into engineering language

• Drafting Jira context

The important distinction is that AI helps with interpretation, not final risk acceptance.

Severity and remediation decisions still require validation.

Cloud-Control Validation

Cloud security controls often involve several interconnected services.

AI can help reason through configurations such as:

Security service

↓

IAM permissions

↓

KMS

↓

S3

↓

Cross-account access

↓

Publishing status

When a control fails, AI can help analyze error messages, policy relationships, and expected configuration.

That reduces time spent manually parsing documentation and troubleshooting every failure from scratch.

Security Automation Development

I also use AI as an accelerator when building security automation.

This can include helping draft or refine:

• AWS CLI workflows

• Bash automation

• Validation logic

• Error handling

• Account and region enumeration

• IAM checks

• Reporting

• Dry-run modes

• Verification steps

AI can significantly speed up the first version of an automation workflow.

However, generated logic still needs to be:

• Reviewed

• Tested

• Scoped

• Validated

• Run safely

Especially when the automation can modify production security controls.

Troubleshooting

Cloud-security troubleshooting often involves several layers.

For example:

GuardDuty publishing is failing.

The root cause might actually be:

• KMS permissions

• S3 policy

• Cross-account trust

• Region mismatch

• Incorrect ARN

• Missing service permission

AI can help quickly generate a troubleshooting path based on the symptoms.

That can turn a vague problem into a structured investigation.

Incident Response Support

AI can also support incident response by helping organize information quickly.

Examples include:

• Summarizing timelines

• Organizing indicators

• Generating investigation questions

• Comparing log events

• Identifying missing evidence

• Drafting incident updates

• Converting technical details for leadership

• Creating post-incident action items

The key is that incident conclusions should still come from validated evidence.

AI should help organize the investigation, not invent certainty.

Jira and Engineering Communication

One of the most practical uses of AI is translating technical security findings into useful engineering tickets.

Scanner output often contains too much detail in the wrong format.

AI can help create a clearer structure:

What happened

Why it matters

Affected resource

Expected action

Recommended remediation

Validation criteria

This makes security findings easier for engineering teams to consume.

Documentation and Runbooks

Security documentation is another area where AI can save substantial time.

I use AI to help create and improve:

• Runbooks

• Troubleshooting guides

• Standard operating procedures

• Incident-response notes

• Security architecture summaries

• Deployment instructions

• Knowledge-transfer documentation

• Control descriptions

This is especially useful after building an automation workflow.

The engineer who created the process may understand it intuitively.

The rest of the team should not have to reverse-engineer it later.

Executive Summaries

Security teams regularly need to communicate the same problem at different levels.

An engineer may need:

• API errors

• IAM policy details

• Resource IDs

• Log evidence

A security leader may need:

• Risk

• Business impact

• Ownership

• Timeline

• Decision

AI can help convert highly technical findings into concise executive summaries while preserving the underlying technical context.

Human-in-the-Loop Security

My preferred model is not:

AI decides → system changes

It is:

AI recommends → human validates → controlled action occurs

This is especially important in areas such as:

• IAM changes

• Production remediation

• Vulnerability closure

• Incident containment

• Firewall changes

• Security-control deployment

• Credential rotation

The cost of a wrong security decision can be much higher than the cost of slowing down for validation.

Guardrails for AI Use

A useful AI-security workflow needs guardrails.

Examples include:

• Do not expose sensitive credentials

• Do not automatically trust generated commands

• Do not apply infrastructure changes without review

• Validate findings against authoritative systems

• Limit AI access to only the context required

• Maintain auditability

• Separate recommendation from execution

• Require approval for high-risk actions

The goal is to reduce operational risk while still benefiting from automation.

AI and Sensitive Data

Security workflows often contain sensitive information.

That means AI usage needs to consider:

• Credentials

• Secrets

• Internal architecture

• Customer data

• Incident details

• Vulnerability information

• Proprietary code

Before sending information to an AI system, the user should understand:

• Where the data goes

• How it is retained

• Whether it is used for training

• What contractual protections exist

• Whether the system is approved for that data classification

Security teams should apply the same data-governance standards to AI tools that they apply to other SaaS platforms.

Prompt Injection and Tool Abuse

As AI systems gain access to tools, prompt injection becomes more than a content problem.

An AI system with tool access may be able to:

• Query cloud resources

• Modify tickets

• Read repositories

• Access internal documentation

• Trigger workflows

• Modify infrastructure

That changes the risk model.

A malicious instruction embedded in an external source could potentially influence how the system uses those tools.

Controls should therefore consider:

• Tool permissions

• Input trust

• Action approval

• Data boundaries

• Logging

• Least privilege

Agentic Identity

AI agents increasingly behave like non-human users.

They may have:

• API credentials

• Cloud roles

• SaaS access

• Tool permissions

• Service accounts

That means agent security increasingly overlaps with IAM.

An AI agent should have:

• A defined owner

• A defined purpose

• Least-privilege permissions

• Audit logging

• Credential lifecycle

• Scope restrictions

• Revocation capability

In many cases, securing the identity of the agent may be more important than securing the model itself.

Practical Tips & Tricks

1. Use AI to summarize before using it to decide

Summarization is generally a safer first use case than automated remediation.

Let AI reduce the information load before giving it authority.

2. Provide structured context

AI performs better when information is structured.

Instead of:

What's wrong with this?

provide:

• Finding

• Resource

• Permissions

• Exposure

• Logs

• Expected state

Better context produces better analysis.

3. Ask for uncertainty

A useful prompt can ask:

What conclusions can be supported by this evidence, and what still needs to be verified?

This discourages overconfidence.

4. Ask for a validation checklist

Instead of asking AI:

Is this fixed?

ask:

What should I verify to determine whether this is fixed?

That keeps the model in a reasoning-support role.

5. Never blindly run generated security commands

AI-generated commands can be:

• Incorrect

• Overly broad

• Destructive

• Environment-specific

Review them first.

Use dry-run modes where practical.

6. Break large automation into stages

A safer pattern is:

Discover

↓

Report

↓

Dry run

↓

Remediate

↓

Verify

This is preferable to giving an AI-generated workflow immediate permission to change everything.

7. Use source systems as the truth

AI should not become your system of record.

Authoritative systems should remain things like:

• AWS

• Wiz

• CrowdStrike

• Okta

• Jira

• Git

• SIEM

AI helps interpret them.

8. Preserve human approval for high-impact actions

The more destructive an action could be, the stronger the approval requirement should be.

Examples:

Low impact: summarize findings

Medium impact: draft ticket

High impact: disable account or change firewall

9. Log what AI-driven workflows do

If AI is involved in operational security workflows, keep enough logging to answer:

• What context was supplied?

• What action was recommended?

• What action was approved?

• What changed?

• Who approved it?

10. Start with repetitive work

The best early AI-security use cases are often boring.

Examples:

• Formatting findings

• Drafting documentation

• Correlating metadata

• Generating troubleshooting steps

• Creating summaries

These can save significant time without introducing large amounts of operational risk.

Where AI Adds the Most Value

In my experience, AI is most useful when the work is:

High-volume

Context-heavy

Repetitive

Time-consuming

but still requires human judgment.

Security operations fits that description extremely well.

Where I Would Be More Conservative

I would be much more cautious about fully autonomous:

• Incident containment

• IAM modifications

• Production patching

• Firewall changes

• Resource deletion

• Credential revocation

• Risk acceptance

Those actions can have significant operational impact.

AI may help recommend the action.

A human should still own the decision.

AI Security as a New Attack Surface

Using AI for security also creates new security problems.

Areas I am particularly interested in include:

• Prompt injection

• Agentic tool abuse

• AI service-account security

• API key governance

• Model access controls

• Sensitive-data leakage

• AI-generated code risk

• Agent authorization

• Auditability

• Human approval boundaries

As AI becomes integrated with infrastructure, security teams will increasingly need to treat AI systems as both:

security tools

and

systems that require security themselves

Outcome

Using AI as part of security operations has helped reduce time spent on repetitive analysis, troubleshooting, documentation, and workflow creation.

That creates more time for higher-value work such as:

• Security engineering

• Risk validation

• Incident investigation

• Architecture

• Remediation

• Team development

The key has been using AI to increase the speed of security work without delegating accountability to the model.

Technologies & Concepts

Generative AI · Large Language Models · AWS · Cloud Security · Security Automation · Vulnerability Management · Incident Response · IAM · Jira · Human-in-the-Loop Security · Agentic Security

What This Demonstrates

This work demonstrates experience and interest in:

• AI-assisted security operations

• Security automation

• Cloud security

• Vulnerability triage

• Incident-response support

• Technical troubleshooting

• Security documentation

• Human-in-the-loop controls

• AI security risk

• Agentic identity

• Prompt-injection risk

• Emerging security architecture

Key Takeaway

The best use of AI in security is not removing the security engineer from the loop. It is removing the repetitive work that prevents the engineer from focusing on judgment.