D01
Introduction to AI
- What AI is, and isn't
- Evolution & enterprise AI
- AI applications in security
Sixty days from “what is AI” to a working, agent-driven SOC assistant. Python, machine learning, deep learning, NLP, transformers, LLMs and RAG — with a security problem in frame every single day, not bolted on at the end.
Machine learning is the longest stretch at ten days — everything after it, from anomaly detection through deep learning to RAG and agents, leans on those ten.
What AI actually is, how it relates to ML/DL/NLP/GenAI, and where it already shows up in a SOC.
The Python you actually need to move from raw logs to features a model can use.
Turning messy security data into something a model can actually be trained on.
The longest module — from first model to a full phishing and malicious-activity classifier, with real evaluation along the way.
Finding what's abnormal when nothing is labelled — the core of behavioural security monitoring.
Neural networks from a single neuron up to CNNs, RNNs, LSTMs and autoencoders — always tied back to security data.
Turning threat reports and alerts into structured, actionable text.
The architecture behind every modern LLM, built up from the attention mechanism.
From how an LLM actually works to writing prompts and calling APIs for real security tasks.
Attacking and defending the models you just learned to build with.
Grounding an LLM in real security knowledge — MITRE ATT&CK, CVEs, incident-response docs.
Giving an LLM tools, memory and a way to act — with a human still in the loop.
Attacking your own models before someone else does, and designing systems that hold up.
Everything from the previous 59 days assembled into one build: a classifier that flags malicious activity, anomaly detection over network behaviour, a retrieval layer over security knowledge, an LLM that explains what it found, and an agent that can reach real security tools — with a human approving the final call.
Pick up the previous day's concepts before anything new lands on top of them.
The day's core ideas, explained from fundamentals with no assumed background.
Write the code together and watch it run — inputs, outputs, and what breaks.
Map the concept to a real security problem, then a short exercise to close the loop.
Read, clean and analyse logs, CSVs and JSON without reaching for a spreadsheet.
Classifiers, anomaly detectors and a deep learning model built end to end — plus the ability to judge whether they are any good.
Prompting, embeddings, retrieval, tool-calling and MCP applied to log analysis and threat intelligence.
Prompt injection, poisoning, adversarial attacks and model theft — and how to design against them.
Tell us your background and what you want to build, and we will map the 60 days to it.
Enquire about this course →