Intro & scope
The SEC family covers AI for defending organisations: detection (SEC.DETECT), prevention/hardening (SEC.PREVENT) and governance (SEC.GOVERN). It includes security with AI (SOC triage, phishing, malware, UEBA, NDR) and security of AI (SEC-010 guardrails, SEC-012 threat modelling, SEC-013 AI-SPM, SEC-014 red teaming, SEC-022 AI Act governance). EU focus: NIS2, DORA, CRA, GDPR, AI Act.
Scope boundaries: - SEC-001 is the investigation/orchestration layer; SEC-005, 006, 003, 015 and 011 are detectors feeding it. - SEC-005 (behavioural anomalies, runtime) vs SEC-020 (periodic access governance and role mining). - SEC-007 (attack the live estate, authorised) vs SEC-014 (attack models/LLM apps) vs SEC-004 (static findings and fixes). - SEC-010 (runtime guardrails) vs SEC-012 (design-time review) vs SEC-013 (inventory/posture). - SEC-017 (data discovery, DLP, technical) vs SEC-018 (GDPR records, DPIA, DSAR) vs SEC-022 (AI Act register). - SEC-002 (mailbox defence) vs SEC-024 (training/simulation) vs SEC-021 (external brand abuse). - SEC-004 (own code and dependencies) vs SEC-016 (third-party package/model malware). SEC-019 and SEC-023 are intentionally unused IDs.
Overview
| ID | Title | Pattern | Maturity | Path | HW tier | AI Act risk |
|---|---|---|---|---|---|---|
| SEC-001 | SOC alert triage & AI security analyst | DETECT | early-adopter | A | HW3 | minimal |
| SEC-002 | Phishing & email security | PREVENT | mainstream | A | HW2 | minimal |
| SEC-003 | Malware detection & analysis | DETECT | mainstream | A | HW2 | minimal |
| SEC-004 | Vulnerability management & code scanning auto-fix | PREVENT | early-adopter | A | HW3 | minimal |
| SEC-005 | Identity & user behaviour anomaly detection (UEBA) | DETECT | mainstream | A | HW1 | depends (employee monitoring) |
| SEC-006 | Network intrusion detection | DETECT | mainstream | A | HW1 | minimal |
| SEC-007 | Automated penetration testing (authorised) | PREVENT | early-adopter | A | HW3 | minimal |
| SEC-008 | Threat intelligence processing & summarisation | DETECT | early-adopter | A | HW3 | minimal |
| SEC-009 | Security compliance automation (ISO 27001, NIS2, DORA) | GOVERN | mainstream | A | HW2 | minimal |
| SEC-010 | LLM application security & guardrails | GOVERN | early-adopter | B | HW2 | minimal |
| SEC-011 | Deepfake detection | DETECT | early-adopter | A | HW2 | depends (biometrics) |
| SEC-012 | AI threat modelling & secure design review | PREVENT | early-adopter | B | HW3 | minimal |
| SEC-013 | Shadow-AI discovery & AI-SPM | GOVERN | early-adopter | A | HW1 | minimal |
| SEC-014 | AI red teaming & robustness testing | GOVERN | early-adopter | C | HW2 | minimal |
| SEC-015 | OT/ICS & IoT network security monitoring | DETECT | mainstream | A | HW1 | minimal |
| SEC-016 | Software supply-chain security | PREVENT | early-adopter | A | HW2 | minimal |
| SEC-017 | Sensitive data discovery & AI-DLP | PREVENT | mainstream | A | HW1 | minimal |
| SEC-018 | Privacy operations: RoPA & DSAR | GOVERN | early-adopter | A | HW2 | minimal |
| SEC-020 | Identity governance & access reviews | GOVERN | mainstream | A | HW1 | minimal |
| SEC-021 | Brand impersonation & digital risk protection | DETECT | mainstream | A | HW2 | minimal |
| SEC-022 | AI governance & EU AI Act compliance | GOVERN | early-adopter | A | HW2 | minimal |
| SEC-024 | AI phishing simulation & awareness training | PREVENT | early-adopter | A | HW2 | depends (employee evaluation) |
Tiers: HW1 = CPU/classic ML only; HW2 = single mid-size GPU (small/medium open LLM, 7-14B, classifiers, VLM); HW3 = multi-GPU or large reasoning/code model (30B+).
Shared stack
Common backbone for all tiers: a SIEM/data lake (OpenSearch or Elastic) as the single log store; Kafka/Redpanda for streaming; a workflow/SOAR engine (n8n, Shuffle or Temporal); a case system (TheHive/DFIR-IRIS); identity via Keycloak with non-human identities per agent; an LLM gateway (LiteLLM) with guardrail layer (Llama Guard / Prompt Guard, Presidio for PII masking) and audit logging. Everything runs in the EU, with log retention and access controls set per GDPR/NIS2.
HW1 (CPU, classic ML)
OpenSearch + Wazuh, Zeek/Suricata, scikit-learn/XGBoost/isolation forest, graph analytics (Neo4j or NetworkX), Presidio + small encoders for classification, optional hosted EU LLM API for summaries via the gateway. Serves SEC-005, 006, 013, 015, 017, 020 and the detector side of SEC-002/003.
HW2 (single 24-48 GB GPU)
HW1 plus vLLM or Ollama serving a 7-14B instruct model (Qwen/Mistral/Llama class), a small guard model, an embedding model (bge-m3/e5) with pgvector or Qdrant, a VLM (Qwen-VL class) for screenshots and documents, and audio models for deepfake detection. Serves SEC-002, 003, 009, 010, 011, 014, 016, 018, 021, 022, 024 (shared RAG index over policies, controls and records for SEC-009/018/022).
HW3 (multi-GPU or EU-hosted frontier API)
HW2 plus a 30B+ reasoning/code model (or EU-region managed API under DPA), agent framework (LangGraph) with MCP tools sandboxed per agent, and a gVisor/Firecracker sandbox for code and pentest execution. Serves SEC-001, 004, 007, 008, 012.
Cross-family sharing
- One vector store and embedding model for SEC-008 (threat intel), SEC-009/018/022 (compliance) and KNOW/DOC families.
- One LLM gateway with guardrails (SEC-010) in front of every LLM workload in the catalog; SEC-013 inventories those same endpoints.
- SEC-005/006/015 baselines feed ANOM-* use cases; the same Kafka and time-series stack serves PRED/ANOM.
- SEC-004/016 reuse the CODE family's code-model serving.