AI Didn't Replace My Cybersecurity Skills - It Changed How I Use Them

The Shift

Lately, I’ve noticed a shift during CTF challenges: more people are turning to AI assistants to churn through problems faster. That naturally sparked a question in my mind - if these models can automate so much of our work, where does that leave us as cybersecurity professionals?

Rather than speculate from the sidelines, I decided to test it myself.

My First AI Experiment

My first attempt was a lightweight project using the Gemini API from Google AI Studio. The concept was simple: feed the AI an IP address and let it determine which reconnaissance tools to run. Watching it work for the first time was genuinely exciting. It could reason about a target and suggest a sensible sequence of tools with minimal nudging.

That initial high didn't last long, though. Rate limits quickly choked the workflow, making the setup impractical for any real, continuous reconnaissance. It became obvious that if I wanted a practical AI assistant, I needed a far more robust setup.

Discovering MCP

The real breakthrough came when I stumbled onto the Model Context Protocol (MCP).

MCP offers a clean, standardized way for AI models to talk to external tools and execution environments. I built an MCP proxy on my Windows host and spun up a FastMCP server inside a Kali Linux VM to execute the actual security operations. To keep everything contained, I locked the setup down behind a host-only network so traffic never left my local machine.

The mechanics were simple: Claude Desktop talked to the proxy, which routed requests to the FastMCP server in Kali. I also plugged in an MCP Inspector as a diagnostic layer, giving me complete visibility to monitor and troubleshoot every message passing through the pipeline.

What made this architecture truly valuable was that the AI was no longer running wild as an unrestricted assistant. Instead, it was bound to a strict penetration testing methodology I designed. Every assessment had to start with broad network discovery before advancing to targeted enumeration. This stopped the AI from skipping foundational steps or chasing useless rabbit holes. The result was an automated partner that stayed disciplined, consistent, and completely aligned with proper security practices.

Keeping Humans in Control

Yet, despite all that automation power, one thing became crystal clear: human judgment is still the most critical part of the equation.

Next, I'm building a custom interface that acts as a true safety net - letting me review, tweak, approve, or outright veto any AI-suggested command before it touches a network. I’m also looking into parallel execution so we can run multiple tools at once without losing an ounce of control.

Final Thoughts

At the end of the day, AI is great at execution, but it doesn't do strategy. That responsibility still sits squarely on our shoulders.

For anyone worried about AI taking over cybersecurity roles, the real question isn't whether we'll be replaced, but how quickly we can adapt. Understanding how these systems work under the hood, recognizing their limits, and weaving them into our day-to-day workflow won't make us obsolete - it'll just make us far more effective.

AI is an incredibly powerful partner. But the strategy, critical thinking, and ultimate decision-making? That still belongs to the human behind the keyboard.