I First Learned About Neural Networks in 2016. Today They’re Transforming Cybersecurity.

When AI went mainstream over the last couple of years, the reaction felt strangely uniform. News channels started talking about "AI changing everything." Companies rebranded themselves "AI-first" overnight. Developers rushed to integrate AI into every application they could. And cybersecurity professionals started asking a more pointed question: how is this going to help attackers?

I found myself somewhere else entirely — thinking back almost a decade, to a classroom in 2016, when all of this felt like it belonged to a future I wasn't sure I'd ever actually touch.

When AI Was Just Another Engineering Subject

I still remember sitting through lectures on Artificial Intelligence and Neural Networks during my engineering days, somewhere around the fourth or fifth semester. AI wasn't the hottest topic on LinkedIn back then. There was no prompt engineering, no AI copilots writing code for you. Like most students, I took the subject because it was on the syllabus, half-convinced it was theory I'd never touch again once the exam was over.

But unlike most of my other subjects, this one stuck — because of one assignment. We were asked to look at how Facebook could scan a photo, recognize a face in it, and suggest the right friend to tag, before anyone typed a single letter. At the time it felt like a small kind of magic, and also like something impossibly far away from anything I'd ever build myself. It left me with a question I couldn't shake: how does a computer even know what's in an image in the first place?

That question sent me digging, and I found an article that broke it down in a way no lecture ever had. It sounds obvious now. At the time, it genuinely fascinated me — and it was the first time this "far off" subject started to feel like something real.

Computers Don't See Faces

Humans look at a photo and instantly recognize a friend. We don't consciously catalogue the eyes, the jawline, the shape of the nose — our brains already learned those patterns long ago, without us noticing. Computers don't have that shortcut. What changed my understanding of the whole field was realizing computers don't "see" images at all. They see numbers — millions of them, one for every pixel.

So imagine showing a computer not one face, but millions: different people, angles, lighting, expressions — smiling, serious, partially turned away, partially covered. Over time the model starts noticing patterns no one explicitly programmed into it, until it gets remarkably good at answering one question: does this pattern match a face I've already seen? That's the same underlying idea Facebook was using to suggest a tag before I ever typed a name.

That was probably the first time I really understood why people say data is the new oil. Without data, AI is just mathematics. With enough of it, it starts to look intelligent.

The Article That Blew My Mind

Around the same time, I came across a completely different piece that left the same impression — an article by Adam Geitgey, published on Medium in mid-2016, that explained machine learning using something totally unexpected: Super Mario. Geitgey built a neural network, fed it existing Super Mario levels, and watched brand new ones come out the other end. The training data came from the original 1985 Super Mario Bros. game — he pulled the level layouts straight out of the game's memory and used the outdoor-style levels to train the model on where platforms, pipes, and enemies tend to go, and how a level builds in difficulty from start to finish.

What made it land for me wasn't just the theory — it was that the output was playable. Nintendo had released Super Mario Maker for the Wii U in 2015, a game that let players draw their own Super Mario levels and upload them for friends to play. Geitgey took his AI-generated level and recreated it inside that same tool, so anyone with the game could actually load it up and play a level no human had designed.

I remember thinking: wait, nobody made this? Between the Facebook assignment and that Mario level, I was impressed both times — but I still couldn't picture ever using any of it myself. It felt like something happening in a lab far away, not a skill I'd ever need. Looking back, that was my first real brush with generative AI, and I didn't even know it.

AI Didn't Suddenly Become Smart

Something I've come to understand over the years: AI didn't appear out of nowhere. The research goes back decades. Artificial intelligence has always been the umbrella field; machine learning emerged as a way for computers to learn from data instead of hard-coded rules; deep learning pushed that further with neural networks stacked into many hidden layers; and today's large language models are simply the latest milestone sitting on top of all of it.

The technology feels new because several things finally converged at once — massive datasets, cheap cloud compute, powerful GPUs, better algorithms, transformer architectures, and years of accumulated research. It wasn't one breakthrough. It was thousands of smaller ones reaching critical mass together, until the "far away" subject from my classroom was suddenly sitting inside every product I used.

Machine learning isn't actually mysterious once you look at how it's built. Every project follows a fairly un-glamorous lifecycle: define the problem, collect data, clean it, train a model, evaluate it, deploy it — and, most importantly, keep monitoring it. The world doesn't hold still. Attackers change. Users change. Data drifts. A model that performs brilliantly today can be unreliable in six months.

As someone in cybersecurity, that idea feels very familiar. Security was never a one-time project. Neither is machine learning — and cybersecurity happens to touch nearly every flavor of it. Spam filters lean on supervised learning. Network anomaly detection benefits from unsupervised learning. Fraud detection often blends both. Adaptive security research is even experimenting with reinforcement learning. The algorithms differ; the goal is always the same — finding patterns humans can't easily spot on their own.

Fast forward to today, and AI assistants are sitting in everyone's pocket. One of the biggest misconceptions I run into is that these systems "know everything." They don't, really. Large language models aren't retrieving answers from memory the way we do — at their core, they're predicting the next most likely word, over and over, sentence by sentence, until it adds up to something that reads as a coherent answer. What's impressive isn't any single prediction; it's billions of parameters trained across enormous datasets producing responses that feel surprisingly human.

This is the part that still catches me off guard sometimes — the same "far away" idea I couldn't picture using in 2016 is now something I reach for before lunch.

Why This Matters for Cybersecurity

Today I work in DevSecOps and application security, and the concepts I once studied as theory are no longer theoretical. AI is quietly showing up in my day-to-day work — assisting with secure code reviews, vulnerability prioritization, API discovery, threat intelligence, malware analysis, log analysis. We use Noname, an API discovery tool, for exactly this — it uses machine learning in the background to learn how our APIs normally behave, then flags the deviations that turn out to be attacks or misconfigurations. It's the same core idea from that Facebook assignment years ago: learn what "normal" looks like from enough examples, then spot what doesn't fit.

Unfortunately, attackers have exactly the same tools. They're writing better phishing emails, standing up convincing fake websites, automating reconnaissance, building malware faster, and scaling social engineering. The battlefield hasn't changed. The weapons have. Understanding how AI actually works isn't optional for security professionals anymore — it's becoming a baseline skill.

Looking Back

Sometimes I wonder what my college self would make of today's AI landscape — the one who sat through a lecture thinking this was interesting but distant, never something he'd personally build with. Back then, neural networks were a subject buried in a syllabus. Today they're writing code, detecting attacks, summarizing incidents, discovering vulnerabilities, and reshaping entire industries.

I'm glad I paid attention in those lectures, even when I couldn't picture where they'd lead. I just never imagined I'd be using them nearly every day as a security engineer — and I have a feeling we're still only at the beginning.

What's Next

This piece was about understanding AI, not fearing it. Next up: how attackers are already weaponizing it — prompt injection, model poisoning, data leakage, and the new attack surface large language models have opened up, along with how defenders are adapting. Understanding AI is only step one. Securing it is where it gets interesting.

References

• Machine Learning is Fun! Part 2 — Using Machine Learning to Generate Super Mario Maker Levels, Adam Geitgey
• Attention Is All You Need (Vaswani et al., 2017)