Agentic AI Fundamentals for Cybersecurity Professionals

AI agents are moving from novelty to daily tooling, and security teams are being asked to both use and defend against them.

This hands-on, four-hour workshop takes you from “what is an agent” to running your own AI security agent against real data: real attack logs, a real malware sample, live threat intelligence, and a deliberately vulnerable web target.

You will build, extend, and command AI agents on genuine security work, and you will learn where they help, where they fail, and how they get attacked.

No prior AI or machine-learning experience required. Everything runs on a free inference tier, so there is no cloud bill and no GPU to buy.

Who Should Take This Workshop

Security practitioners who want practical, hands-on literacy with AI agents rather than vendor hype:

• SOC and detection analysts
• Penetration testers and red teamers
• Incident responders and threat hunters
• Security engineers and blue teams
• Security leaders and curious practitioners who want to understand what agents can and cannot do

What You’ll Learn

• Understand how agentic AI actually works — the tool-use loop and harness anatomy (Agent = Model + Harness), and how an agent differs from a chatbot.
• Drive an AI agent on real security data — triage lines of real log files and correlate a genuine compromise, evidence in hand, not by guesswork.
• Do real security work with agents — audit vulnerable source code for line-referenced findings and statically triage a real malware sample safely, without executing it.
• Extend an agent with skills, MCP, and memory — author a reusable skill, wire in a live threat-intelligence feed over MCP, and set standing policy in project memory, so the agent stops guessing and starts citing current sources.
• Command a team of specialist sub-agents — build and scope your own specialist, then run an orchestrator that delegates recon-to-exploitation and produces an attack plan plus a findings report.
• Run a capstone security assessment — point your agent at a live, deliberately vulnerable target, capture flags, prove each finding from the transcript, and generate a client-style report.
• Treat agents as an attack surface — understand prompt injection, trust boundaries, and supply-chain risk, and apply least-privilege scoping, sandboxing, and rules of engagement as guardrails-by-design.
• Leave with tools you will actually use — a working agent setup, reusable skills and agents, and lab data you can keep practicing with on Monday.