[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 1 · 1.5.a
AP Cybersecurity · Introduction to Security
How Defenders Leverage AI
AI produces recommendations, never decisions — a qualified human approves before anything ships.
key ideaAI produces recommendations, never decisions. A qualified human approves before anything ships.
The idea
What AI is good at here
Reading more than a human can — thousands of firewall rules, a code base nobody has time to audit, months of alert history — and surfacing the parts that deserve attention. It is a scale tool.
Why review is non-negotiable
Each of these outputs changes a live security control. A wrong firewall rule opens a path; a wrong code fix introduces a bug; a wrong detection rule buries real alerts. The CED attaches a named human reviewer to all three for that reason.
Security configurationThe settings that decide what is permitted — firewall rules, access controls, service exposure.
Static code analysisExamining source code for flaws without running it. AI extends this to patterns a rule-based scanner would miss.
Detection ruleA condition that raises an alert. Too narrow and attacks pass; too broad and analysts drown.
Human in the loopA qualified person who must approve before a recommendation takes effect.
False positiveAn alert with no real attack behind it. Volume here is what makes analysts stop reading alerts at all.
| Defensive use | What AI contributes | Who must review | What goes wrong without review |
|---|
| configuration review | reads every rule; flags redundancy and over-permission | security technician | a rule change opens a path or breaks a service |
| code analysis | finds vulnerabilities, proposes mitigations | knowledgeable programmer | a fix that introduces a new bug or misreads intent |
| detection rules | suggests rules from observed patterns | detection engineer | alert flooding, or a rule that never fires |
The last column is the argument for the third. Each recommendation acts on a live control, so an unreviewed suggestion is a change made by something that cannot be held accountable.
Why it works that way
AI is strong at breadth and weak at context. It can read every rule in a firewall, but it does not know that one odd-looking exception exists because a medical device fails without it. The reviewer supplies exactly the context the model lacks.
the division of labor
- AI reviews at a scale no team can match — that is the entire value proposition.
- It does not know your business context, your exceptions, or your compensating controls.
- Confident output is not evidence; fluency and correctness are unrelated properties.
- Recommendation plus expert review is faster than expert review alone, which is why it wins.
Worked analysis
EX 1
The rule that looks wrong
An AI review flags a firewall rule permitting inbound traffic on an unusual port and recommends deleting it. What should the technician do?
1
Treat it as a question
The flag is a hypothesis — this rule looks unjustified.
2
Find the justification
Check change records: who added it, when, and for what system.
3
Consider the possibilities
It may be genuinely stale, or it may serve a device that fails without it.
4
Decide with context
If stale, remove it. If needed, narrow it to the specific source and document why.
5
State the principle
The model found the rule; the technician supplied the reason. Neither half is sufficient alone.
EX 2
The fix that broke something
An AI code review recommends a change that removes a vulnerability. A programmer applies it unreviewed and a feature stops working. What was skipped?
1
Name the omitted step
Review by a knowledgeable programmer before implementation.
2
Say what review would have caught
That the flagged code was load-bearing for a behavior the model could not see.
3
Note that the finding may still be right
The vulnerability can be real even when the proposed fix is wrong.
4
Give the correct workflow
Accept the finding, design the fix, test it — three separate decisions.
5
Generalize
Recommendations are input to engineering judgment, not a substitute for it.
EX 3
The rule that drowned the team
An AI-suggested detection rule is deployed directly and generates 4,000 alerts a day, almost all benign. What is the security impact?
1
Name the immediate effect
Alert fatigue — analysts stop reading a channel that is almost always wrong.
2
Name the second-order effect
Real detections are buried among the noise.
3
Judge the net result
Security got worse, even though a new detection was added.
4
Say what review would have done
A detection engineer would have tuned the threshold against historical data first.
5
State the lesson
A detection rule is judged by signal-to-noise, never by coverage alone.
Common traps
Treating a recommendation as a decision
All three CED uses attach a named reviewer. Skipping that step converts a helpful tool into an unaccountable change process.
Assuming the model knows your environment
It does not know which exceptions are deliberate or which systems are fragile. Context is exactly what the reviewer contributes.
Confusing fluency with correctness
A confident explanation of a wrong fix reads identically to a confident explanation of a right one. Verify against the system itself.
Measuring detection by coverage
A rule that alerts on everything detects everything and is useless. Tune before deploying, using real historical data.
Check yourself
Name the three defensive uses of AI in the CED and the reviewer each requires.
Show answer
Security configuration review → security technician; application code analysis → knowledgeable programmer; detection rule suggestion → detection engineer.
Why is human review required in every case?
Show answer
Each recommendation changes a live security control. A wrong firewall rule opens a path, a wrong fix introduces a bug, a wrong detection rule buries real alerts.
What can AI do here that a human team cannot?
Show answer
Review at scale — every firewall rule, an entire code base, months of alert history — and surface the items worth a human's attention.
Why can a new detection rule make security worse?
Show answer
If it fires constantly on benign activity it causes alert fatigue, and genuine detections get buried. Coverage without signal-to-noise is a net loss.