Practical AI in Cyber Security: the series

This series is about how a small senior team covers security operations work that normally needs a much bigger roster. Everything we write about comes out of a platform we built and still run: more than 100 scheduled checks, executing around the clock, watching our own infrastructure and the services we depend on.

The checks themselves are not clever. They look at certificate expiry, exposed ports, patch levels, backup completion, unusual authentication patterns, and a long tail of things that only matter on the day they break. Automation of that kind has been available for years. The hard part has never been collecting signals. It is that a hundred checks running continuously produce far more output than two or three people can read properly, and the important item is usually buried under a pile of noise that is technically correct and completely uninteresting.

That is where we use language models. They read the raw output, group related events, strip the repetition, and write a short summary of what appears to have changed and why someone might care. Then a person looks at it and decides. We treat that split as a design rule rather than a preference. The model triages and explains. It does not close alerts, it does not change firewall rules, and it does not decide whether something is an incident. Models are confidently wrong often enough that giving one authority over a production environment would be a poor trade for the time it saves. Log data is also attacker-controlled input, which makes prompt injection a live concern rather than a theoretical one.

We are writing this for IT managers and executives in Australian health, though most of it applies anywhere. Health organisations tend to have a small internal team, a large amount of sensitive data, a lot of vendor-managed clinical software they cannot freely modify, and reporting obligations under the Notifiable Data Breaches scheme that turn a quiet Friday into a very loud week. The ACSC Essential Eight sits underneath all of it as the baseline people are measured against. None of that goes away because you add AI, and some of it gets harder.

So the posts will be concrete. What the check does, what the model is asked to do with it, what it costs to run per month, where it produced rubbish, and what we changed or switched off afterwards. Where something did not work, we will say so. There is enough vendor material promising autonomous security operations, and very little written by people describing what they actually operate.

PicNet has been building software in Sydney since 2001. Every one of our managers is an engineer, which is why this series reads like engineering notes rather than a product brochure.

PicNet builds production AI systems for Australian organisations. Talk to us about what a first project could look like.

Posts in this series

• An LLM-triaged SIEM: reviewing thousands of security events a day with a small team

Tagged: #cyber-security #llm #security-operations #essential-eight #monitoring