Build Your Own
Agentic Defense
A self-paced online course for defenders who want to use agents in their own work. It teaches the systems behind a working agent for defensive security: what each part does, and how they fit together.
The Complete Course to
Master Agents for Defensive Security
You learn the core primitives of an agent's harness, so you can design your own, for your own context. No rigid framework or vendor tool to depend on.
- What it sees
- What it may do
- How it reasons
- What it remembers
- How it's orchestrated
Anyone who works in defensive security, whatever the role.
No coding background required; it starts from the judgment you already have.
Learn it, drive it, run it, build it
Every lesson explains an idea in text and on video. Concept labs let you drive it step by step in a simulation. System labs run it for real, with a model reasoning on your own API key. Build It Yourself guides then hand you a piece to build with no guided path.
- Welcome to the Course
- Unpacking the Two Terms
- Course Goal
- How the Course Works
- Meet the Case
- The Threat Hunting Kernel
- What is Threat Hunting?
- Agent = Model + Harness
- How Do We Create the Harness?
- The Three Harness Principles
- The 9 Core Systems
- The Golden Rule
- Overview
- The Agent Skeleton
- Keys, Config, and Secrets Hygiene
- Find the Leak Concept lab
- State, Stage, Transition
- The Pipeline, by Hand Concept lab
- Our First Agent System lab
- Prompts and the Message Protocol
- Context Window and Memory
- Context Window System lab
- The Agent Loop and Control Flow
- Build It Yourself: The Skeleton Build It Yourself
- Overview
- The Problem with Consuming Raw Logs
- Find the Bad Stuff Concept lab
- Two Primary Axes
- Intro to Distillation
- Candidates
- Distillation Process Overview
- Build It Yourself: Athanor Build It Yourself
- Overview
- What Is a Tool?
- The TAO Loop
- Policies and Boundaries
- Interactive Triage System lab
- Access Mechanism
- Tool Surface Design
- Give the Agent a Shell System lab
- Build It Yourself: Tools Build It Yourself
- Overview
- MCP Introduction
- How It Works
- VirusTotal over MCP System lab
- When a Simpler Tool Is Enough
- Where MCP Earns Its Place
- Overview
- Introduction to Skills
- Why Use Skills
- Skills as the Foundation of the System
- Complete System Overview
- Build It Yourself: The Skill Loader Build It Yourself
- Overview
- Pre-Initiation
- Initiation: Seed to Hypothesis
- Initiation: The Laddered Plan
- Trigger to Plan Concept lab
- The Hunt Plan
- Detection Node Inputs
- Deterministic Gate Checks
- Ajv Gates
- Projection
- Reflection
- The Detection Node, Live System lab
- Build It Yourself: Creating Skills Build It Yourself
- Overview
- Introduction to Context Engineering
- What Context to Provide
- How to Provide Context
- Feeding the Starved Node System lab
- Overview
- Introduction to the Assessment Skill
- Columnar DBs
- Assessment Node Inputs
- Assessment Node Outputs
- The Assessment Node, Live System lab
- Overview
- Keyword vs Semantic Search
- Intro to RAG
- Institutional Memory, On Demand System lab
- Overview
- Intro to Orchestration
- Tips on Learning Orchestration
- Common Patterns
- The Board, All at Once System lab
- Orchestration Patterns Concept lab
- Overview
- Intro to Shared State
- The Storage Landscape
- Files and Logs
- Databases as Shared State
- Crash Night Concept lab
- Memory Across Hunts
- The Second Hunt Concept lab
- Overview
- Intro to Knowledge Graphs
- Neo4j
- Queries
- Knowledge Graph Concept lab
- Entity Resolution
- Edge Provenance
- Build It Yourself: The Graph Build It Yourself
- Overview
- Intro to Narrative Synthesis
- Two Distinct Phases
- Walk, Then Weave System lab
- One Hunt, End to End
- The Whole Machine, Running System lab
- Build It Yourself: The Departure Point Build It Yourself
- What You Can Now Do
- Where To From Here
- Parting Thoughts
- Feedback Node
- The Suggestion Queue Concept lab
- The Threat Hunter Playbook
- Beacon Definition
- Distillation Example
- Distillation Pipeline Concept lab
- Tool Security
- Where the Poison Lands Concept lab
- MCP Security
- RAG Setup
- RAG Use
- RAG 2.0
- Running the Labs Well
- The Knowledge Graph Landscape
- Graph Security
- Six Example Interfaces
- Candidate Types in Detail
- Skill: initiate-hunt
- Skill: hunt-c2-over-https
- Skill: assess-severity
- Skill: assess-behavioral-context
- Skill: assess-campaign-match
- Object: HuntTrigger
- Object: InitiationJudgment
- Object: HuntPlan
- Object: HuntCoverageEntry
- Context: Asset Record
- Context: Incident History
- Context: Campaign Profile
- Context: Compliance Baseline
- Contract: DetectionFinding
- Contract: AssessmentFinding
- Prompts: Detection Engagement
- Prompts: Assessment Engagement
- Scorer: beacon
- MCP Protocol Revision: July 2026
- Cloudflare Code Mode
Every lesson comes as both written text and video. Labs are hands-on activities, not videos.
Turn the security expertise you already have into a defense that can keep working. Design the processes agents follow, define what they’re allowed to do, and use what you learn to improve the system.
Develop the capability to meet the scale of the challenges that lie ahead.
Faan Rossouw
I’m a security researcher and instructor. I’ve taught thousands of defenders to find adversaries in network and endpoint telemetry, and earlier in my career I developed offensive security tooling and taught courses on that too.
When agents arrived, I went looking for a course that taught how to build with them from the foundations up. It didn’t exist, so I built my own agentic defense system and turned what I learned into AionSec: the course I couldn’t find.
it's just not evenly distributed.
One of the best training classes I've taken in years. As someone who has been using Agentic AI on a daily basis since late last year, I can confidently say this class is for all levels. The labs have a great flow. I paid for this class myself and I'm glad that I did.
Faan's in-depth knowledge and his amazing way of explaining things in the KISS format makes complex topics genuinely accessible. I highly recommend his trainings and will definitely be attending more sessions.
I've attended all of Faan's workshops, and you can tell he's passionate about what he's talking about. I'd participate in any of Faan's trainings with my eyes closed.
It's a rare pleasure to encounter a teacher with the alacrity, patience, and capacity to package such dense subject matter in such an accessible format as Faan.
The course is clear, well-structured, and presented with a strong, confident grasp of the material. If you want to learn agentic AI and apply it to security in a methodical and hands-on way, he's someone who can genuinely help you deepen your understanding and elevate your practice.
Each lesson is well designed to bring students of all levels up to speed and make complex concepts digestible. His experience and passion impart a contagious desire for learning—fun and thoughtful while maintaining lightheartedness through high-level technical material.
Very well presented. I would sign up for any future courses by Faan in a heartbeat.
Your passion for this is obvious, and it made the practical stuff actually stick. Thanks, Faan.
Not ready yet? Join the AionSec list for a free guide and $50 off.
The future belongs to those who build.
Take your first step to
mastering agents for defensive security
- $50 off With your code
Build Your Own Agentic Defense
$499$449 - Free guide PDF · 26 pages
Defense in the Age of Agents
- Newsletter Every two weeks
Every new article and video, in one email
