I Built A Phishing Triage Copilot With Claude: AI Cyber Defense Ops Review & Thoughts On Vibe…

I Built A Phishing Triage Copilot With Claude: My AI Cyber Defense Ops Review And Why Vibe Coding Still Needs A Skeptic

My Bulgarian @abv.bg inbox is a swamp of spam: fake courier notifications from "Econt," "Speedy," and "DHL," parcel-delivery scams asking for a small "customs fee," fake bank alerts from "DSK" and "UniCredit," and the occasional "your Google storage is full" lure. Most of it is low-effort. But some is good enough that if you're actually waiting for a delivery, you might click the phishy link.

I got tired of inspecting headers by hand for every email. So after finishing the AI Cyber Defense Ops course by Just Hacking Training with instructor Anton Ovrutsky, I built my own answer: Phishing Triage Copilot - a small, offline tool that takes a suspicious email and tells me, in seconds, whether it's worth worrying about and why.

In this article, you'll read about:

• What My Phishing Triage Copilot Does and A Real Test On My Mailbox
• AI Cyber Defense Ops Curriculum And What I Built
• My Review Of The Course AI Cyber Defense Ops by Just Hacking Training
• My Thoughts On Vibe Coding

This is My Journey into AI Security #3. Read my previous articles on revising AI and LLM foundations and my AI Security learning roadmap, as well as how and where Human-in-the-loop fits into AI Security.

What My Phishing Triage Copilot Does

This is a runnable Python project - an agentic security tool with an MCP server plus a skill, slash command, hook, and persona, that Claude Code and I built and debugged together, module by module.

Point it at a suspicious .eml file and it:

• Parses the headers and checks SPF / DKIM / DMARC and sender alignment (Does the "From" name match the domain? Does Reply-To or Return-Path disagree?).
• Detects brand impersonation - a "PayPal" or "Econt" identity coming from a domain that has nothing to do with the brand.
• Extracts every URL, IP, and attachment, and flags the dangerous ones: lookalike domains, URL shorteners, raw-IP links, punycode/IDN homographs, high-abuse TLDs (.top, .life,…), free app-hosting (web.app, pages.dev), credential-lure paths (/login, /verify), and 1×1 tracking pixels.
• Scores the message, gives a verdict: Benign / Suspicious / Likely Phish - and maps the findings to MITRE ATT&CK.
• Writes a shareable, self-contained HTML triage report.

The most important design decision is what it doesn't do: it never fetches a URL, resolves a domain, or opens an attachment. Analysis is 100% static and nothing is detonated. A PreToolUse** hook** enforces that at the harness level, and every layer treats the email as untrusted data, not instructions (so a phishing body that tries to prompt-inject the AI gets analyzed, never obeyed).

The detection logic lives in an editable indicators.json knowledge base, including Bulgarian keywords and bank/brand names (DSK, UniCredit, Fibank, Vivacom, Econt, Speedy…). Thus, most of the analysis is language-agnostic and works on Cyrillic email out of the box, as we'll see below.

Real Test On My Mailbox

To see how it holds up, I ran it against real phishing pulled straight from my @abv.bg mailbox. Note: I scrubbed the recipient details for my privacy.

Here's a fake Econt "action required to receive your parcel" email. It even passes SPF and DKIM (the attacker authenticated their own throwaway domain), yet it's correctly flagged Likely Phish, caught on brand alignment and link behavior rather than authentication:

The sender claims "Econt" but the domain is asiakas.life, and the real link points to a lookalike host on free web.app hosting - while the email's genuine econt.com logo images are left unflagged. Every indicator in the report is defanged (hxxps://, [.]), so nothing in it is clickable.

It also doesn't over-flag. A legitimate newsletter through the same pipeline - authenticated, aligned, clean links - comes back Benign, score 0. A triage tool that flags everything is as useless as one that flags nothing, so keeping false positives low is part of the job:

AI Cyber Defense Ops Curriculum And What I Built

AI Cyber Defense Ops is a hands-on course focused on using Claude to build practical Blue Team tooling. You can check out the tools I've built during this course on my GitHub.

The course (worth 20 CPEs) is built entirely around the Claude ecosystem (Claude Code and Claude Desktop), treating Claude less like a chatbot and more like a productivity suite for defenders: Hooks, Skills, Commands, MCP servers, subagents, and personas. Each module teaches one mechanism, and for each one I built a real, runnable security tool with Claude. Instead of a prompt-and-a-screenshot portfolio, every folder in my repo is a working piece of software with its own README, architecture notes, and a documented build history, including the bugs I hit and how Claude and I debugged them.

Here's how the 12 modules map to what I built:

1. Module 1 - The Claude Ecosystem: foundations - CLAUDE.md, MCP, skills, commands, hooks, subagents, plugins.
2. Module 2 - Building Your First Security Tool: sysmon-parser, a dependency-free CLI that turns raw Sysmon Event ID 1 XML into JSON/JSONL/CSV with triage stats.
3. Module 3 - MCP: Wrapping Security CLIs: mcp-hayabusa, an MCP server wrapping the Hayabusa EVTX threat-hunting CLI (scan_evtx, get_hayabusa_rules).
4. Module 4 - MCP: Detection Knowledge Bases: extended mcp-hayabusa into a browsable Sigma/ATT&CK knowledge base with analyze_coverage and suggest_rule.
5. Module 5 - Skills: Codifying Methodology: mcp-detection-kb, a detection-engineering skill + validate-rule.py that mechanically enforce what makes a rule "done".
6. Module 6 - Slash Commands: Repeatable Workflows: siem-queries, a /query command that runs a SIEM query → triage → ATT&CK-map → Obsidian note (Splunk/Elastic/manual).
7. Module 7 - Hooks: Automation Triggers: detection-workflow, SessionStart/PreToolUse/PostToolUse hooks that block secret writes and validate every rule on save.
8. Module 8 - Complex Analysis: Threat Intel & Multi-Source Correlation: complex-analysis, parallel endpoint-analyst + cloud-analyst subagents that fan out, then a correlation step, plus /ingest-ti.
9. Module 9 - Reports & Artifacts: the self-contained HTML triage report in my capstone.
10. Module 10 - End-to-End Purple Team Workflow: purple-team, threat intel → Atomic Red Team → simulation → Hayabusa scan → SIEM validation → gap analysis → sanitized report.
11. Module 11 - System Prompts for Security Personas: personas, threat-hunter, IR-responder, and detection-engineer system prompts with hard behavioral constraints.
12. Module 12 - Cross-SIEM Investigation: correlating Sysmon (host) with CloudTrail (cloud) telemetry across two SIEMs.
13. ⭐ Capstone Project - phishing-triage: the Phishing Triage Copilot above, composing an MCP server, resource, skill, slash command, hook, persona, and HTML report into one tool for a domain the course never covered - email.

My Review Of The Course AI Cyber Defense Ops by Just Hacking Training

I've mostly used GitHub Copilot in VS Code, so Claude Code was new to me. The course is super beginner-friendly! The instructor Anton Ovrutsky explains everything step by step, includes examples, troubleshooting tips, and makes each concept easy to follow. Each module has taken me a little over an hour - not because it's difficult, but because I keep stopping to ask Claude why it made certain decisions and to understand the code it's generating. Partly to learn, and partly because of vibe coding.

What I learned wasn't just "how to prompt." It was a repeatable pattern for building AI-assisted security tooling: take a tool or workflow a SOC/IR team already trusts, wrap it so an agent can drive it safely, and get the contract right - structured JSON outputs, explicit failure modes, no silent data loss, and guardrails enforced by the harness rather than by hoping the model behaves. Along the way I picked up the practical craft too: MCP server design, MITRE ATT&CK mapping, Sigma and YARA-X rule authoring, SPF/DKIM/DMARC analysis, subagent fan-out/fan-in, and treating external binaries (and the model's own tool surface) as an untrusted boundary.

📝 Note: I took this course through the WiCyS Cyber Competency Builder program with Just Hacking Training, which made it free for my cohort (normally it's $50). The weekly sessions with Anton, JHT's Don Donzal, and WiCyS' Quiana Oates were an amazing bonus - everyone was incredibly supportive and helpful!

My Thoughts On Vibe Coding

I think vibe coding is a great way to lower the barrier to entry into programming. It allows people who may have felt intimidated by coding to start building much faster. But there is a difference between building something and understanding what you've built.

I learned programming before AI coding assistants became a thing (which makes me sound old, but I promise I'm still Gen Z 😅). University taught me data structures and algorithms, but also something even more valuable: a programming mindset. That means questioning assumptions. Reading code before running it. Testing it. Verifying it. Understanding what it does -especially when you didn't write it yourself!

Yes, Claude can build these tools much faster than I could manually.

Yes, I could just click "Yes" and "Allow Changes" until everything works.

But that's also where the risk is.

⚠️ When we allow AI assistants to execute commands or modify our environment, we're trusting them to understand our intent, context, and security boundaries… which they can still get wrong.

That's why you should:

• Read the code before accepting it
• Ask Claude to explain its reasoning
• Test everything yourself
• Review every action before approving it

This isn't new advice. Anton emphasizes it throughout the course too. But it's worth repeating!

As AI-assisted development becomes the norm, one of the most valuable skills will be knowing when to trust AI, how to verify, and when to say "no."

🤔 How do you approach AI-assisted coding? Do you treat AI as an autopilot, a pair programmer, or something in between?

Resources Mentioned

1. Phishing Triage Copilot (my capstone project): https://github.com/alisatodorova/ai-cyber-defense-tools/tree/main/phishing-triage
2. All practical security tools I built while completing AI Cyber Defense Ops by Just Hacking Training with FULL build write-ups: https://github.com/alisatodorova/ai-cyber-defense-tools/
3. AI Cyber Defense Ops course by Just Hacking Training: https://www.justhacking.com/course/ai-cyber-defense-ops/
4. WiCyS Cyber Competency Builder program with Just Hacking Training: https://www.wicys.org/benefits/the-cyber-competency-builder-with-just-hacking-training/
5. My Journey into AI Security #1: Revising AI and LLM foundations and my AI Security learning roadmap: https://medium.com/@techalisa/my-journey-into-ai-security-1-back-to-the-foundations-01dd6a29feac
6. My Journey into AI Security #2: How and where Human-in-the-loop fits into AI Security: https://medium.com/@techalisa/human-in-the-loop-owasp-genai-security-project-anthropics-claude-mythos-preview-project-de0d8504d0a8
7. Subscribe to my Tech YouTube Channel: https://www.youtube.com/@TechAlisa