Hackfest - Level UP

AI agents are arriving in defensive security faster than most teams planned for - and most practitioners are meeting them as a vendor product with a "buy" button, not as something they can build, open up, and bend to their own environment. Those are completely different skills. The teams who understand the architecture underneath - what the field now calls harness engineering - are the ones who can adapt agentic systems to their own tooling and threats instead of being locked into whatever capabilities a vendor decides to ship.

This hands-on workshop teaches you to build your own AI security agent from the ground up. Using threat hunting as the running example, you'll assemble a working, model-agnostic agent framework piece by piece: the immutable state core that makes a run traceable and auditable; an agnostic provider seam; the data–agent interface that shapes what the model actually sees; deliberate context-window management; the three ways to give an agent tools - inline functions, CLI wrappers, and MCP; and executable investigation skills, culminating in a detection skill you run against real telemetry from the scenario.

This is not a session about prompting a chatbot to read logs. It's about the engineering decisions behind systems that agents can do real defensive work inside - and you leave with the framework, yours to extend to detection engineering, incident response, vulnerability triage, or any security problem you face. Harness engineering is the kind of capability that compounds; the earlier you invest, the more leverage you carry as the field keeps moving.