AI-Assisted Security Operations

Verify the answer. Not the prompt.

An assistant will write you a query in four seconds that would have taken you fifteen minutes. It will run. It will return a plausible number of rows. And roughly one time in five it answers a question slightly different from the one you asked, in a way you cannot see from the output alone. This course is about that one time in five.

Included with Premium, from $19.99/month, or $179/year and save 25%. Preview the first module free, no account needed.

Your subscription also includes the Practice Hub: graded scenarios, forensic cases, query drills and the response playbooks.

Start with the orientation See Pricing

IN BUILD

This course is being written. Modules 0 and 1 are complete and readable now. The remaining nine are in progress and the exam is not yet live. The card is hidden from the catalog until the build finishes.

What this course is

Every other course on this platform grades your reasoning about evidence. This one grades your reasoning about somebody else's answer, and specifically an answer that is fluent, confident and wrong.

That is a different skill from prompting. Prompting is a week of learning that the tool vendors give away, and it gets easier every release. Deciding whether the answer you were handed is true does not get easier, and nobody teaches it.

How it works

You are shown a generated artifact: a query, a detection rule, an interpretation of a log, an incident summary. It is realistic, because each one is a failure mode these systems genuinely produce rather than a strawman written to be caught. You commit to a judgment before anything is revealed. Where the artifact is a query, you run it against the Northgate Engineering corpus and watch real rows come back.

Then the finding tells you what was wrong and, more usefully, what signal would have told you.

The six failure modes

Every generated error in this course is one of six shapes, named in Module 0 and drilled in every module after it.

Plausible field

A column that exists and means something else

Silent window

A time filter that excludes the event and still returns rows

Wrong join key

A correlation on a field that is not unique

Confident absence

Zero rows read as a finding

Right answer, wrong question

A correct query answering something adjacent

Invented precision

A figure that was generated rather than measured

Who it is for

Practicing analysts and engineers. No AI background is assumed and none is taught: this is not a course about machine learning. If you already use an assistant and have a quiet suspicion you are not checking its output properly, or you are about to introduce these tools to a team and need to know what you are signing up for, it is aimed at you.

It is not an argument for or against using AI in security work. The tools are in your estate already, or they will be. The question this answers is how to use them without eventually being embarrassed by one.