Introduction

Start with the job, then the technology

Imagine a security team receiving 2,000 messages every morning. A computer can help find suspicious messages, but we must understand what its decision means.

Artificial intelligence, or AI, is a broad field. It includes computer systems that perform tasks such as recognising patterns, planning, or generating language. Machine learning, or ML, is one approach within AI. It builds useful patterns from examples. A model is the mathematical system that uses those patterns to produce an output.

The output might be a category, a number, or a paragraph. Each needs a different kind of check.

Your map for this room

Open the diagram for a larger view.

Read the map from the largest field to more specific methods. It is a useful simplified map, not a complete list of AI technologies.

You will explore learning with examples, neural networks, and language models. You will separate training, when a model learns, from inference, when a trained model is used.

The security connection

For any AI feature, ask three questions:

• What information enters it?
• What decision or content leaves it?
• What can happen because of that output?

A spam suggestion is different from automatically deleting a customer’s email. The same prediction can have different consequences depending on the application around it.

Read Google’s introduction to machine learning for a second explanation of models and their outputs.

Check your understanding

A program writes a fluent incident summary. What should you check before using it?

Compare the important claims with the original logs and other evidence. Clear writing tells you about the presentation. It does not prove the investigation is correct.