Build AI-Powered Security Tools with Hands-On Labs
AI for the Win is a hands-on training program designed for security practitioners who want to develop AI-powered tools for threat detection, incident response, and security automation. The program includes over 50 labs, 18 CTF challenges, and four capstone projects, structured to guide users from foundational concepts to advanced techniques. The curriculum emphasizes practical applications, such as phishing detection, malware analysis, log parsing, and cloud security, ensuring that participants build tools directly applicable to real-world security challenges.
The program is designed to be accessible to practitioners with varying levels of experience. Labs 00-13 require no API keys and cover essential topics such as Python programming, machine learning fundamentals, and prompt engineering. These foundational labs are ideal for beginners or those new to AI concepts. Advanced labs, including those focused on LLM-powered log analysis, RAG systems, and adversarial machine learning, require API access but provide in-depth exploration of cutting-edge security tools. All labs include sample datasets, solution walkthroughs, and comprehensive tests to ensure learners can verify their implementations.
A key feature of AI for the Win is its integration with AI-assisted development tools like Cursor, Claude Code, and GitHub Copilot. These tools accelerate the learning process by providing real-time suggestions, debugging assistance, and code generation, allowing practitioners to focus on security logic rather than syntax. The program also supports local model inference using Ollama, enabling users to complete labs without incurring API costs. This approach ensures that learning remains cost-effective and accessible to a broad audience.
How It Works
The Foundations track (Labs 00-09) covers essential topics such as environment setup, Python programming, and security-focused machine learning concepts. These labs are designed to be completed without API keys, making them ideal for beginners or those looking to establish a baseline understanding of AI in security.
The Machine Learning track (Labs 10-13) introduces practical applications of ML in security, including phishing classification, malware clustering, and anomaly detection. Lab 10, for example, demonstrates how to build a phishing classifier using a Random Forest model and TF-IDF vectorization, achieving an accuracy of 96.2% on a dataset of 1,000 labeled emails. The lab highlights key features such as urgency indicators, domain spoofing, and URL mismatches, which are critical for identifying phishing attempts. These labs provide hands-on experience with supervised and unsupervised learning techniques, ensuring practitioners can apply ML models to real security challenges.
The Language Models & Agents track (Labs 14-18) focuses on leveraging large language models for security tasks such as log analysis, threat intelligence, and automated investigations. Lab 35, for instance, demonstrates an LLM-powered security log analysis pipeline that parses log entries, identifies threats, extracts indicators of compromise (IOCs), and generates incident reports. These labs require API access but offer deep dives into prompt engineering, agentic workflows, and retrieval-augmented generation (RAG).
The Detection & DFIR track (Labs 19-35) expands on these concepts by integrating ML and LLM capabilities into detection pipelines, forensic analysis, and incident response automation. These labs emphasize the integration of AI into existing security workflows, such as SIEM enrichment, log parsing, and forensic evidence collection.
The Expert Labs track (Labs 36-50) addresses advanced topics such as adversarial machine learning, cloud security, and red teaming automation. These labs are designed for practitioners with prior experience in AI and security, offering challenges that simulate real-world adversarial scenarios and advanced threat detection techniques. Each lab includes detailed documentation, solution code, and tests to ensure learners can validate their implementations.
Use Cases
AI for the Win is tailored to security practitioners who seek to integrate AI into their workflows for threat detection, incident response, and security automation. One primary use case is the development of AI-powered detection tools, such as phishing classifiers, malware analyzers, and anomaly detectors. Lab 10 demonstrates how a Random Forest model combined with TF-IDF can achieve high accuracy in identifying phishing emails, while Lab 12 explores unsupervised anomaly detection using Isolation Forest and Local Outlier Factor (LOF).
Another critical use case is incident response automation, where AI assists in log analysis, IOC extraction, and playbook execution. This capability is particularly valuable in environments with high volumes of logs, where manual analysis would be time-consuming and error-prone.
AI for the Win also supports digital forensics and incident response (DFIR) through labs focused on forensic analysis, memory forensics, and live response procedures. By combining AI with traditional DFIR techniques, the program enables practitioners to build tools that enhance investigative efficiency and improve the quality of forensic evidence.
Red teaming and adversary emulation are additional use cases addressed by AI for the Win. Lab 50, for example, focuses on automated attack simulation using AI, allowing red teams to emulate sophisticated adversary tactics, techniques, and procedures (TTPs). This capability is valuable for testing blue team defenses, validating detection capabilities, and improving incident response readiness. These labs ensure that practitioners can develop AI-driven tools that support both offensive and defensive security operations.
Cloud security is another major focus, with labs dedicated to container security, serverless architectures, and cloud incident response. These labs help practitioners build AI-powered tools for monitoring cloud environments, detecting anomalous behavior, and automating containment procedures. By addressing the unique challenges of cloud security, AI for the Win enables practitioners to extend their AI skills to modern, distributed infrastructures.
Key Features & Capabilities
AI for the Win provides a comprehensive Docker-based lab environment that simplifies setup and ensures consistency across all labs. The environment includes Jupyter Lab for interactive coding, Elasticsearch and Kibana for log analysis, PostgreSQL and Redis for data storage, Ollama for local LLM inference, and ChromaDB for vector storage in RAG labs. Users can launch the entire environment with a single command (docker compose up -d), eliminating the need for manual configuration and allowing them to focus on learning.
One of the standout features of AI for the Win is its integration with Google Colab notebooks, which allows users to run labs directly in their browser without requiring local setup. This capability is particularly useful for practitioners who may not have access to a local development environment or who prefer a cloud-based workflow. Each lab includes a Colab notebook, enabling users to execute code, visualize results, and interact with datasets in a familiar interface.
The program also includes 18 CTF challenges designed to test and reinforce learning through practical, game-like scenarios. These challenges cover a range of security topics, including phishing detection, malware analysis, and log parsing, and are structured to provide immediate feedback and measurable progress. The challenges are integrated into the curriculum, allowing users to transition seamlessly from theoretical learning to practical application.
AI for the Win supports multiple AI providers, including Anthropic Claude, OpenAI GPT-5.2, Google Gemini 3, and Ollama for local inference. This flexibility ensures that users can choose the tools that best fit their needs, whether they require high-performance models for complex tasks or cost-effective local solutions. The program provides guidance on prompt engineering, API usage, and cost optimization, helping practitioners maximize the value of their AI resources.
The curriculum is structured to accommodate learners at all levels, with labs categorized by difficulty and prerequisites clearly outlined. Beginners can start with Labs 00-09, which cover Python basics, ML fundamentals, and security concepts without requiring API access. Intermediate users can progress to Labs 10-13, which introduce practical ML applications such as phishing detection and malware clustering. Advanced practitioners can explore Labs 14-50, which delve into LLM-powered tools, adversarial machine learning, and cloud security.
Every lab in AI for the Win includes comprehensive solution code, step-by-step hints, and automated tests to validate implementations. Additionally, the program provides a Security-to-AI Glossary, translating machine learning jargon into security terms to help practitioners bridge the gap between AI concepts and security applications. This resource is particularly valuable for those new to AI, as it demystifies technical terminology and contextualizes it within the security domain.
AI for the Win also emphasizes AI-assisted development, integrating tools like Cursor, Claude Code, and GitHub Copilot to accelerate the learning process. By leveraging AI assistants, users can reduce development time, minimize errors, and explore creative solutions more efficiently. This integration reflects the modern workflow of security practitioners, who increasingly rely on AI to enhance productivity and innovation.
While the details of these projects are not fully specified in the provided sources, they are intended to simulate complex security challenges that practitioners may encounter in their careers. By completing capstone projects, users can demonstrate their mastery of AI-powered security tools and gain confidence in their ability to tackle advanced threats.
AI for the Win is licensed under a dual license model: the documentation and labs are released under CC BY-NC-SA 4.0 (non-commercial), while the code samples are licensed under MIT. This structure allows for broad sharing and collaboration within the security community while ensuring that commercial use requires explicit permission. The program is maintained by Raymond DePalma and is designed as a personal educational project, independent of any employer or vendor affiliation. This independence ensures that the content remains objective, focused on practical learning, and free from commercial biases.