A pattern-level tour of AI tools for your cybersecurity classroom — presented live on Day 5 (late afternoon). Architecture patterns and demos only; no production infrastructure is exposed. Each card describes the pattern, the tooling, and how you can adapt it.
Day 5 — Jul 24, late afternoon (if time permits after the exam and lab catch-up)These cards are reference material for the live showcase. Code, prompts, and configuration examples referenced here come from the workshop's own labs — nothing proprietary.
Lab Generators
Use an AI coding agent to draft hands-on lab scenarios from a structured prompt template that encodes your course objectives, constraints (CPU-only, no secrets, isolated network), and expected outputs. The agent drafts; you review and refine.
All four workshop labs (Days 1–4) were scaffolded using this exact pattern — the lab code, README, and expected outputs are fair game to adapt for your own curriculum.
AI Tutoring
A local LLM (Ollama) configured as a Socratic tutor: grounded on your course materials via RAG, rate-limited so it doesn't just give answers, no internet access. Runs on the same hardware as the labs — no API keys, no student data leaves the room.
Course material→Vector DB (RAG)→Ollama LLM→Socratic prompt→Student chat
OllamaChromaDBLiteLLM gateway
The Day 1 RAG lab is the direct foundation. Swap in your own course notes and adjust the system prompt to get a domain-specific tutor in <30 min.
MCP Exercise Environments
Model Context Protocol servers that let AI agents interact with simulated SOC tooling — log sources, CVE databases, rule editors — without live network access or real credentials. Students interact with a safe, bounded environment that behaves like the real thing.
The Day 4 lab ships a complete MCP server template. Key design constraint: no live NVD queries — all data is bundled to prevent hallucinated CVSS scores.
Coding-Agent Workflows
AI agents that generate security artifacts (detection rules, IaC snippets, lab scripts), then statically validate and repair them — closing the loop without a human in every iteration. Safe for classrooms: no secrets, isolated Docker network, bundled validators.
Day 4's Sigma/Snort generation lab uses exactly this pattern. The static validators (sigma-cli, Snort self-test) are the safety net that makes the generate-loop feasible without a security expert reviewing every output.
Hosted API vs. Local LLM — Trade-off Talk
The Day 5 PM session includes a structured discussion of when to use hosted APIs vs. local models for classroom deployments. Here's the comparison framework:
Dimension
Hosted API (OpenAI / Anthropic / Azure)
Local LLM (Ollama, CPU)
Cost
Per-token; scales with class size and usage
Hardware cost only; zero marginal cost per query
Privacy / data residency
Data leaves campus; check ToS + FERPA
All data stays on the box; FERPA-safe by design
Latency
Low (GPU datacenter), network-dependent
Higher on CPU (8–16 GB RAM); use cloud VM for parity
Capability ceiling
Frontier models (GPT-4o, Claude 3.7, etc.)
Limited to models that fit in RAM (1.5–7B typical)
Offline / demo resilience
Requires network; single point of failure
Fully offline; no network dependency during demo
Compliance constraints
Check institution acceptable-use policy; EU AI Act GPAI obligations
Workshop recommendation: local Ollama for all labs (guaranteed parity, no per-student API cost, offline-safe). Use hosted APIs for instructor demos of frontier capabilities (screenshare only — students stay on local path).
Adoption Roundtable
Discussion prompts for the Day 5 closing roundtable:
Which of these four patterns maps most directly to a course you teach or want to teach?
What's your institution's biggest blocker — budget, IT policy, hardware, or faculty capacity?
How would you handle a student who uses the AI tutor to get direct answers instead of thinking through the problem?
What safeguards would you put in place before deploying an AI coding-agent workflow in a student lab?
Would you use local LLM, hosted API, or institutional AI (e.g., Azure OpenAI via campus contract) for your first deployment?