Simple explanation
This lesson catalogs the actual tools a security professional might reach for that put AI to work — the "what's available" before the next lesson covers "what you'd use each one for."
Technical explanation
- IDE/CLI AI copilot — an AI assistant embedded directly in a developer's coding environment, offering code suggestions, security linting, and inline help as code is written.
- Browser-based AI assistant — embedded in the browser, able to read page content and help with in-browser tasks, like summarizing a suspicious page during an investigation.
- Security chatbot — a conversational AI interface purpose-built to answer security questions or assist analysts with routine tasks, without needing to leave their normal workflow.
- MCP (Model Context Protocol) server — a standardized way for an AI assistant to connect to external tools and data sources (a SIEM, a ticketing system, a threat intel feed), extending what it can access and act on beyond its own built-in knowledge.
- Personal AI assistant — a general-purpose AI assistant a user relies on for day-to-day tasks, which may also get used (intentionally or not) for security-adjacent work when no dedicated tool is set up for the specific task at hand.
Choosing between them generally comes down to: is the task embedded in a specific workflow (code editor → IDE copilot), does it need live external data (SIEM/ticketing → MCP-connected assistant), is it a quick ad hoc question (security chatbot), or is nothing purpose-built available yet (personal assistant, as a fallback)?
Synonyms / related terms
| Term | Means | |---|---| | MCP | Model Context Protocol | | Copilot | Common informal term for an embedded coding AI assistant |
Concept Check
"A team wants their AI assistant to pull live data from an internal ticketing system and a threat intel feed using one consistent connection method, rather than custom one-off integrations for each." This describes exactly what an MCP server provides — a standardized connection layer to external tools/data — rather than a security chatbot or personal assistant, which don't inherently provide that kind of structured external tool integration on their own.
Interview-style Q&A
Q: Why might a SOC deliberately avoid using a personal AI assistant for security work, even when it's technically capable of helping? A: "Data handling and audit trail concerns, mainly. A personal assistant not sanctioned for security work may not have appropriate data retention policies, may log queries in ways that aren't reviewable by the security team, and creates an untracked channel for potentially sensitive incident details. A purpose-built, sanctioned tool — even if less familiar — gives the organization actual visibility and control over how AI is being used in security-sensitive contexts."
Memory trick
"Code needs a Copilot, Browsing needs a Browser assistant, Data needs MCP, Quick questions need a Chatbot" — four tools, each matched to the specific need that makes it the right choice.