AI for cybersecurity students: learn faster, inside the law

By the tiswa editorial team, from the official sources listed at the end of this guide. How we write our guides

AI for cybersecurity students cuts both ways, literally: the same tool that explains a firewall log in a minute can invent a vulnerability that does not exist, or nudge you to try something on a system that is not yours. This guide is about using it to learn faster, in environments you are authorised to use, tied to the roles the Saudi job market asks for.

Start from the NCA framework

The National Cybersecurity Authority (NCA) developed the Saudi Cybersecurity Workforce Framework (SCyWF) as a foundational step in building national cybersecurity capacity. It sorts cybersecurity work into five categories, twelve specialty areas and forty job roles, each with defined tasks, knowledge, skills and abilities. It follows the methodology of the U.S. NICE framework, but its categories and roles are built around demand in Saudi Arabia. The five categories:

Protection and Defense alone includes roles such as Cybersecurity Defense Analyst, Cryptography Specialist, Identity and Access Management Specialist, Vulnerability Assessment Specialist, Penetration Tester, Digital Forensics Specialist and Cyber Crime Investigator. The first smart use of AI is working out which role fits you.

I am a cybersecurity student in Saudi Arabia. Here are the courses I have taken and what I enjoyed most: [list courses and interests]. Here are descriptions of three roles from the Saudi Cybersecurity Workforce Framework: [paste role descriptions from the NCA document]. Compare my interests with each role, list the skills I am missing for each, and suggest one small, legal project I can build in my home lab for each skill.

Notice the prompt asks you to paste the role descriptions from the NCA document itself instead of relying on what the tool remembers. You will need that habit in all of your work.

Reading logs and alerts

In the framework, a Cybersecurity Defense Analyst uses data from cyber defense tools to analyse events and detect threats. In your courses and lab you will read server logs, firewall logs and Wireshark captures. AI can explain an odd line, but the judgement is yours:

1. Use data from your own lab only

   Logs from your own virtual machine or files published for teaching.

2. Scrub anything sensitive

   Replace real IP addresses, usernames and domains with placeholders.

3. Ask for the pattern, not a verdict

   Ask what this pattern of requests could mean, both benign and malicious.

4. Check it yourself

   Test each possibility against other logs and the tool's official documentation.

5. Write the incident summary

   As a short report: what happened, when, the evidence and your recommendation.

Here are lines from a web server log in my home lab, with addresses replaced by placeholders: [paste log]. Explain the pattern you see and give two benign and two suspicious explanations. Do not give a final verdict. Tell me which other lines or logs I should check to tell the explanations apart.

Code review against the OWASP Top 10

The OWASP Top 10 is the best-known reference for the most critical web application security risks, and its current edition is the OWASP Top 10 2025, after the 2021 and 2017 editions. Use AI as a second reviewer on your own code, not anyone else's:

Here is code for [a PHP login page] I wrote for a university project: [paste code]. Review it against the OWASP Top 10 2025 categories, and for each issue give the line, the category, why it is a problem and how I can test it myself in my local environment. Do not rewrite the whole file; I want to fix it myself.

Building your coding base? See how to learn programming from scratch and ChatGPT for computer science students.

CTFs: learn from the solution, do not copy it

Capture The Flag challenges are the best legal hands-on practice, because the platform gives you permission. The common mistake is asking for the answer. Ask for graded hints instead, and once you solve it, write a short write-up of your method. That write-up also belongs in your portfolio when you apply for co-op training.

I am working on a CTF challenge on a training platform in the [network forensics] category. Here is the challenge and what I have tried so far: [describe]. Give me one small hint toward the next step, without the solution. If I ask for a second hint, make it slightly clearer.

Governance and compliance: the Essential Cybersecurity Controls

Not all cybersecurity work is technical. Governance, Risk, Compliance and Laws is one of the five categories, and the framework supports the NCA Essential Cybersecurity Controls (ECC), whose latest version is ECC 2-2024. In governance courses, AI can turn a long document into review questions, or check a policy you drafted for a fictional company against a specific control. The reference is always the official document on the NCA website, not the tool's summary.

Tools and offers for cybersecurity students

The GitHub Student Developer Pack and JetBrains tools are free for university students and useful for code projects and labs. Details are in the GitHub Student Developer Pack guide.

• GitHub: GitHub offers GitHub Student Developer Pack to university students in Saudi Arabia for free.
• JetBrains: JetBrains offers JetBrains Student Pack to university students in Saudi Arabia for free.
• Google AI: Google AI offers Google AI Plus free for a year to university students in Saudi Arabia.

Worked example: analysing a phishing email

Your network security course hands you a training email claiming to be from a bank and asking you to "update your details within 24 hours". Analyse it yourself first, then paste the text and headers with any real addresses removed, and ask the tool to walk through the signs one by one:

• The display sender against the actual domain in the headers.
• SPF, DKIM and DMARC results if present, and what a failure of each means.
• The real link behind the visible text, without opening it.
• Urgency and threat language, the most common social engineering lever.

Then write a one-page report: what you noticed, the severity, and the action you recommend for the employee and the security team. That is the kind of report you will actually write in a security operations centre.

Lab rules you never bend

• Test only systems you own, course environments, or targets you have written permission for. Testing anything else without permission can expose you to legal liability.
• Run scanning tools inside an isolated virtual machine, not on your main machine signed into your accounts.
• Never paste keys, passwords or data from a training placement into an AI tool.
• If the tool suggests a command you do not understand, ask it to explain every part before you run it.

A simple weekly plan

1. Two days

   One beginner CTF challenge, with a write-up in your own words.

2. One day

   Read one essential control and summarise what it asks an organisation to do in practice.

3. One day

   Review an old project of yours against the OWASP list and record what you found in your GitHub repository.