DIY AI: Build Your Own Digital InfoSec Team with BYOLLM

Christian Taillon opens with the pressures security teams face: heavy workloads, junior analysts who must learn many tools quickly, and sensitive data that cannot always go to outside AI services. He presents large language models as a flexible, natural-language way to work with unstructured material such as logs, reports and threat feeds, and argues for running open-weight models on infrastructure the team controls.

The middle of the session covers the practical building blocks. He contrasts deterministic and probabilistic approaches, explains base versus instruction-tuned models, and shows how temperature and quantization affect output consistency, speed and memory use. He compares deployment options from frontier APIs to cloud-hosted and home-lab GPUs, then demonstrates a SOC analyst persona that combines standard operating procedures with an alert, and a retrieval-augmented setup that answers questions over local notes and PDFs. Tooling such as Ollama and Open WebUI appears along the way.

He closes with guardrails: low temperature for structured output, care with context windows, and isolating model runtimes in containers without root or outbound network access. A key warning concerns pickle-based model files, which can run code when loaded, so the safetensors format is recommended. Attendees leave with a sense of where local models fit into security operations and where they still fall short.