Workshop: Build Your Own AI Security Agent

AI agents are rapidly becoming part of how defensive security teams operate. But using an off-the-shelf agent product and building your own are fundamentally different skills. The teams who understand the architecture underneath, what the field calls “harness engineering,” are the ones who can adapt agentic systems to their own environment, tooling, and security problems, rather than being locked into whatever capabilities a vendor ships.

This workshop teaches the foundations of building your own AI security agent from the ground up. You’ll learn why harness engineering, not prompt engineering or model selection, is where the real leverage lives, and you’ll build the core components of a working, model-agnostic agent framework you can extend to any defensive security use case.

The workshop uses threat hunting as its running example. You’ll build an agent that investigates a security scenario end-to-end. But the architecture, patterns, and principles you learn apply equally to any security agent you want to build: detection engineering, incident response, vulnerability triage, alert enrichment, compliance checking, and more.

Specifically, over four hours, we’ll cover:

• Why harness engineering matters more than the model you pick

• The core state pattern every agentic system needs (immutable, traceable, auditable)

• Model-agnostic design – decoupling your agent from any one vendor so you can run on Anthropic, OpenAI, Google, local open-weight models, or your existing Claude Code subscription without changing your code

• Skills as executable, testable investigation procedures rather than ad-hoc prompts

• Orchestration patterns for coordinating multiple agents in sequence and parallel

• A working, end-to-end security investigation you can extend to your own use cases

This is not a course about prompting a chatbot to analyze logs. This is a course about the engineering decisions behind systems that agents can actually perform useful security work in. You leave with a working agent framework, yours to modify, extend, and adapt to whatever security problems you face in your environment.

The security field is moving toward agentic AI faster than most teams planned for. The practitioners who understand how these systems actually work, how to architect them, adapt them, and debug them when they misbehave, are the ones who’ll be equipped to lead their teams through that shift. Harness engineering is the kind of capability that compounds. The earlier you invest, the more leverage you have as the field continues to move.