Building AI-Literate Security Teams

Every phase in Chapter 6 assumes people who can run it. That assumption fails more often than any tool.

I have watched organizations buy excellent platforms that produced excellent findings, then fail to act on most of them because nobody had the time, the skill or the authority. AI makes that failure more expensive. It multiplies the volume of findings and shrinks the time available to respond.

This chapter covers the skills that matter, how to build them, and how to stand up an internal AI red team without a large budget.

The Skills Gap Is Specific

The general cybersecurity workforce shortage is well documented. ISC2 continues to estimate the global gap in the millions, and most security teams report budget pressure on top of it.

The AI security gap is narrower and sharper. It sits at the intersection of two fields that rarely share people:

• Security practitioners who understand exploitation, detection and incident response, but have not worked with agentic systems.
• AI engineers who understand models, prompts and tool use, but have not defended production infrastructure.

You will not hire your way out of that intersection quickly. You will mostly grow it. A useful first step is giving the whole team a shared baseline on how frontier models are evolving; my essay on the future of AI is written for exactly that audience.

The Skills That Matter Now

Skill	Why it matters	Where most teams are	How to build it
AI-driven attack patterns	Recognize agentic discovery, chaining and machine-speed lateral movement	Conceptual awareness at best	Workshops built on real incidents, CTF exercises
Operating AI security tools	Run scans, write effective prompts, configure agent scaffolds	Early	Hands-on labs against internal code
Attack path reasoning	Think in chains, not tickets	Rare outside red teams	Red team drills, joint review of merged findings
Machine identity governance	Manage the fastest-growing identity population	Often nobody owns it	Dedicated training, clear ownership assignment
AI incident investigation	Agent intrusions leave different artifacts and move faster	Very early	Simulations, updated playbooks
Triage at volume	Validate and route hundreds of AI findings without drowning	Underestimated	Process design, tooling, explicit capacity
AI governance and policy	Shadow AI, data exposure, vendor risk	Uneven	Cross-functional training with legal and procurement

Two of these deserve emphasis.

Triage at volume is the skill nobody plans for. When AI discovery is switched on, the first thing that breaks is the queue. Teams need clear rules for what gets validated first, who owns which systems, and when a finding gets closed as not exploitable.

AI incident investigation is different from traditional investigation. An agent can produce thousands of actions over a weekend from short-lived infrastructure. The Hugging Face responders reconstructed more than 17,000 recorded events. Your analysts need to work from high-volume telemetry and identity logs, and they need AI tools that will actually analyze attack artifacts. Plan for that capability before you need it.

Training in Three Tiers

Tier 1: Awareness (all security staff and engineering leads)

• How AI-driven attacks differ: speed, scale, chaining, identity abuse.
• Real cases from 2026, starting with Glasswing and Hugging Face.
• What changes in their own role and escalation paths.
• Duration: two to four hours, refreshed twice a year.

Tier 2: Practitioner (SOC analysts, AppSec and cloud security engineers)

• Running AI code review and interpreting its findings.
• Validating findings and estimating exploitability.
• Building candidate attack paths from merged findings.
• Monitoring machine identities and agent telemetry.
• Responding to a compromised agent or token.
• Duration: two to three days of hands-on labs, then monthly practice.

Tier 3: Specialist (red team, senior architects, detection engineers)

• Building and operating agentic discovery against internal systems.
• Writing detections for agent-driven intrusion patterns.
• Designing agent identity and runtime policy architecture.
• Leading investigations of AI-assisted incidents.
• Duration: one to two weeks of focused work, then continuous.

Standing Up an AI Red Team

You do not need a large program to start.

Month 1: One engineer, one target. Give a senior security engineer an AI security tool, an isolated environment and two weeks to run it against one important internal codebase. Ask for three things: confirmed findings, false positives, and what it took to operate.

Month 2: Compare. Put the results next to your last pentest and your existing scanner output on the same code. What did AI find that the others missed? What did it miss? This comparison is your business case.

Month 3: Make it routine. Schedule recurring runs against your top five systems. Route findings into the normal vulnerability workflow with an owner and an SLA.

Months 4-6: Expand scope. Add attack path analysis, agent identity testing (can one of your agents be talked into using its permissions for something it should not?), and purple team exercises with the SOC. If your agents use MCP or similar tool protocols, my comparison of MCP, RAG and ACP is a useful primer for the team on where those trust boundaries sit.

Set rules early. Written authorization for every target. No scanning of third-party systems without permission. Clear handling for sensitive findings. Responsible disclosure for anything found in open-source dependencies.

Practice at the New Speed

Exercises are where plans meet reality. Run a quarterly tabletop with two scenarios built for 2026:

Scenario A: The four-hour exploit. A critical flaw in a widely used component of your production stack is disclosed at 9 p.m. on a Friday. A working exploit is circulating by 1 a.m. Walk through the next 24 hours. Who is paged? Who can approve an emergency change? Which compensating controls go live first? How do you confirm you were not already hit?

Scenario B: The agent intrusion. Your telemetry shows an internal AI agent making unusual requests to a data store it has never touched, followed by a burst of token requests from new infrastructure. Who can suspend the agent? How do you scope which credentials it held? Which systems trust those credentials? How long until you know what was accessed?

Time every step. Write down where it broke. Fix the top three breaks before the next exercise.

Hiring

When you do hire, look for evidence of both halves:

• Security engineers who have built tooling with LLMs, not just used chat interfaces.
• ML engineers who have done security work, CTFs or bug bounties.
• Detection engineers comfortable with high-volume telemetry and identity logs.

Evaluate with practical exercises: give candidates a small codebase and an AI tool, and ask them to find, validate and explain a real flaw. Certifications in this area are still catching up to practice.

To keep people, give them interesting problems, time to learn, and a visible path to influence. AI security specialists are in high demand. The ones you grow internally, who already know your systems, are often the most valuable.

Culture

A few cultural choices make everything above work:

• Security as enabler. If AI review blocks every pull request with low-confidence noise, engineers will route around it. Tune for precision first.
• Blameless reporting. People need to report shadow AI, leaked keys and mistakes quickly. Punishment teaches silence.
• Shared ownership. Machine identities are created by engineering teams. Governance only works if those teams own their identities, with security setting the standard.
• Calm, factual communication. Fear sells products but exhausts teams. Present the data, the plan and the progress.

Key takeaways

• The AI security skills gap is an intersection problem. Grow it internally.
• Triage at volume and AI incident investigation are the most underestimated skills.
• Train in three tiers: awareness, practitioner and specialist.
• Start an AI red team with one engineer, one target and a comparison against existing tools.
• Exercise against a four-hour exploit and an agent intrusion every quarter.

You now have threat context, a framework and a people plan. Chapter 9 turns all of it into a scored checklist you can run with your team.