AI Can Speed Up Security Work, But It Cannot Replace Judgment

AI can be useful in security work, but the value is usually speed rather than independent judgment.

It can summarize unfamiliar code, suggest hypotheses, generate test cases, and help organize notes. It can also be confidently wrong, miss business logic, invent exploitability, or bury the useful idea inside a pile of noise.

The pattern that works best for me is simple:

• Give the model a narrow question.
• Provide the specific context it needs.
• Treat the output as a hypothesis.
• Validate manually before escalating.
• Record why the finding is real or why it was rejected.

The validation step is the work. Without it, AI-assisted security becomes a noise generator with nicer prose.

A Better Loop

The useful loop is simple:

1. Ask a narrow question.
2. Give the model the exact context it needs.
3. Separate paths, controls, and assumptions.
4. Turn the best assumption into a small check.
5. Record what was confirmed, rejected, or still unknown.

That last step matters because AI can make weak notes look finished before the work is actually done. A polished paragraph is not evidence. A confident explanation is not reachability. A plausible impact claim still needs a path.

I like using AI for the messy middle: reading unfamiliar code, comparing similar paths, summarizing failed checks, and keeping a research log clean. I do not want it deciding scope, authorization, severity, or whether the evidence is enough to escalate.

For a longer version of the workflow, read Offensive Security With AI. For prompt patterns that keep the work scoped and evidence-based, use Better AI Research Steering.