Augmented Cloud Hacking with AI Workflows

Augmented Cloud Hacking with AI Workflows by Beau Bullock AI has advanced rapidly, yet much of offensive and defensive security work remains dominated by manual processes and ad-hoc use of chat-based AI tools. Practitioners frequently paste sensitive data into hosted models, ask vague questions, and hope for useful output, often leading to mixed and untrustworthy results. In this talk, I’ll demonstrate how to build local-first AI workflows to assist with a wide range of cybersecurity-related tasks. Using tools and techniques shared in this talk you will see how easy it can be to augment penetration testing, forensic analysis, incident response and more with AI without handing sensitive data to externally hosted models. By combining low-code automation, local language models, and human guidance, AI can be embedded into repeatable and auditable security workflows rather than treated as a general-purpose chatbot. This session walks through the design of AI-assisted cloud reconnaissance pipelines that perform advanced research & development alongside common penetration testing techniques such as cloud storage bucket discovery, tenant enumeration, and vulnerability scan analysis. Instead of asking AI open-ended questions, these workflows turn local models into task-specific agents by constraining inputs, structuring outputs, and forcing models to reason over attacker-relevant signals. The models are given tools such as Python scripts and controlled web access and operate within well-defined boundaries. Along the way, I’ll demonstrate my own cloud security research and offensive testing workflows, highlighting where AI meaningfully accelerates analysis, where it confidently hallucinates, and how to design guardrails so automation augments human judgment instead of replacing it. The goal is not autonomous hacking, but instead to augment common security processes for offensive practitioners and defenders alike. Attendees will leave with a clear mental model and practical architectural guidance for building their own AI-assisted security workflows using local models and low-code automation.