Observe
Ingest alerts, code findings, asset context, CVEs or network events.
AGENTIC AI2026Cybersecurity HackathonTrack 01
Agentic Cyber Defence
Move from alert overload to explainable, controlled action.
Read the brief ↓
01The opportunity
Why this matters.
Security teams work across noisy alerts, vulnerable code, threat intelligence and incomplete context. A useful defensive agent does more than classify an event: it gathers evidence, prioritises risk, proposes a response and keeps a human in control of consequential actions.
Agent behaviour
From signal to safe action.
Reason
Correlate evidence, rank urgency, explain confidence and identify missing context.
Defend
Recommend containment, draft a patch or create an incident action—with approval before impact.
What to develop
A focused, testable defensive agent.
Build a defensive agent that investigates a security problem and produces an evidence-backed next step. It may analyse sample network flows, source code, vulnerability records or incident logs. Show its boundaries, approval points and a clear record of why it acted.
Recommended structure
01Problem & user
02Inputs & evidence
03Agent workflow
04Defensive action
05Human approval
06Result & limitations
Starter concepts
Four ways in.
SOC triage agent
Group related alerts, reconstruct an incident timeline and recommend the next investigation step.
Vulnerability prioritiser
Combine exploit evidence, asset importance and exposure to rank what should be fixed first.
Secure-code reviewer
Find a defensible class of code flaws, validate the finding and propose a focused patch.
Incident response planner
Turn logs and a playbook into a contained response plan with explicit approval gates.
Data & references
Start with credible inputs.
Use these as a starting point, or create a clearly documented synthetic dataset. Never test on systems or people without permission.
Anthropic
Claude Security — industry example
An example of an AI security workflow that scans, validates findings and prepares targeted fixes.
Open official source ↗University of New BrunswickCIC-IDS2017
Labelled benign and attack network flows in PCAP and CSV formats.
Open official source ↗CISAKnown Exploited Vulnerabilities
An authoritative catalogue for testing risk-aware vulnerability prioritisation.
Open official source ↗Your submission should prove
The agent can observe, reason and defend—responsibly.
Clear problemWorking flow or prototypeEvidence of valueHuman oversightKnown limitations
Register your team↗