← All Posts
Personal Reflections

From Cyber Practitioner to AI Explorer: A Hands-On Journey

By James Carder · · 7 min read

From Cyber Practitioner to AI Explorer: A Hands-On Journey

A cybersecurity practitioner's journey into AI development: tools, challenges, and successes in building innovative projects with ease.

From Cyber Practitioner to AI Explorer: A Hands-On Journey

A Cyber Practitioner’s Journey with AI Development

I think it was Confucius (depending on which meme you're reading) who said, "I hear and I forget, I see and I remember, I do and I understand." That quote has always resonated with me, not just in life and in cybersecurity but especially in the world of technology and innovation. When it comes to the warp-speed evolution of AI, you can hear and see a lot, but to truly "get it," you’ve got to roll up your sleeves and do it yourself. This blog is my take on that journey, the uphill trek of learning, testing, failing, and ultimately discovering what’s possible with AI.

The Start

Before we go further, I should confess that I am not the most proficient coder. In my pre-AI life, building apps wasn’t exactly my thing. But give me some solid tools, a hefty dose of research, and a sprinkle of ADHD, and I’ll figure it out. As it so happens, a lot of these AI development tools sort of meet you at your level and I often felt like a little kid working with them both in what I was asking or prompting and how the AI tool would respond.

My point being, you don't have to be a technical expert to be able to build really cool things.

My gateway drug into this world? Replit.

The Early Stages

Ah, Replit. When I started about a year ago, everyone was raving about “vibe coding,” which was often frowned upon or even trash-talked by many of the purists.

  • At the time, Replit was… fine. Functional, but bland.
  • I churned out some very basic, very underwhelming apps, vanilla, the kind you wouldn’t dare show off or make public.
  • The design, the UI/UX of it all, was not on par with what I was expecting.

I’ll admit the disappointment was enough to temporarily kill my enthusiasm. I abandoned Replit and hit pause on my AI adventure.

Four months later, curiosity lured me back in. And thankfully, things had evolved. The new Design Agent was a game-changer, letting me build things that weren’t just functional but visually impressive.

The Realities

When I first set out, my goal was modest:
Get enough knowledge to keep up.

I just wanted to understand AI at a conceptual level, the market trends, and its potential impact on businesses, software, and cybersecurity. Then reality hit.

  1. To really grasp AI, and not just stumble through surface-level conversations, I needed to treat this like a side job.
  2. The ongoing costs: I burned through more AI tokens and credit card charges than I originally intended.

Still, it was way cheaper than a week-long training class from SANS Institute, so I’ll call that a win. (For now. Fingers crossed.)

The hours, lessons, trial-and-error loops, and the excitement of completing tangible projects made the effort totally worth it.

If you’re feeling hesitant about diving into AI, let me borrow some wisdom from Confucius:

Stop overthinking it and just do.

The Learnings

Some people like to bury their takeaways at the end of a blog post. Not me. I’m serving them upfront so you don’t have to wade through this longer-than-expected blog.

Here’s a high level of what I’ve learned in my 8-month-long AI deep dive:

  1. These tools aren’t as intimidating as they look.
    Once you understand the layout and architecture of AI dev platforms, they almost feel like tour guides.

    • They’ll ask questions, suggest options, and help you work through trade-offs.
    • Don’t feel pressured to write complex, technical prompts; conversational language works just fine.

  2. Have a game plan before you start.
    Even if it’s just rough notes, a PowerPoint sketch, or a “north star” vision scribbled on a napkin, clarity helps.
    You should:

    • Know what you want to build.
    • Understand what you hope to achieve.
    • Define how far you’re aiming to take it.

  3. Data is king (and also a royal pain).
    The hardest and most time-consuming part of building anything AI-related is getting access to quality data.

    • Free APIs? Jackpot.
    • Expensive, high-value datasets? Avoid.
    • Rich datasets locked behind layers of bureaucracy? Frustrating.

    Without good data, your app is a great idea stuck in neutral.

    Key Question: Do you need to own the data, or is being a data consumer good enough?

First Build

My first serious project? Building a website for Cardiant Security.

Here’s how it went down:

  1. I’d already outsourced logo creation to ChatGPT, Gemini, and, eventually, Fiverr (because sometimes three AI tools just don’t cut it).

  2. Armed with a logo, a color scheme, and some design elements, I started sketching the site's vision in PowerPoint slides.

    • Each slide represented a webpage, with elements detailing layout and content ideas.
    • I even used rectangle shapes in PowerPoint to mimic web design (Hey, it worked).

  3. Once I had all this mapped out, I handed it over to Replit.

    • I wrote prompts detailing every element: from the “north star” mission to the content and aesthetic preferences.
    • Replit took my messy PowerPoint and cranked out a functional website in about 15 minutes.

Result: A live website for Cardiant Security by December 2025. Secure, tested, and operational, with MFA and a client portal, no less.

Cybersecurity Ecosystem

As a former operational CISO, I wanted to create an interconnected ecosystem of apps designed to tackle real-world cybersecurity challenges.

Objective:
Build a suite of specialized, AI-powered tools that span the breadth of a CISO’s daily workload, from defensive operations to executive reporting.

Features:

  • These apps didn’t just sit in silos.
  • They integrated with each other, pulling and pushing data to maintain context, minimize manual tasks, and keep everything streamlined:
    • If you find a vulnerability in one app, it automatically triggers actions in others:
      • Logging a risk item.
      • Creating a mitigation plan.
      • Writing and pushing detections.
      • Even remediating the vulnerability in real time.

The Suite of Apps:

Here’s a rundown of the apps I built (but trust me, they have way more functionality than I can list here):

  • Vanguard: Penetration testing, vulnerability management, and remediation tools with posture analytics.
  • Watchtower: Defensive operations with SIEM/XDR-like functionality, detection engines, and even a "pew pew" map.
  • Argus: Threat intelligence aggregation with AI-assisted predictive analysis.
  • Bedrock: Risk quantification, compliance tools, and AI-powered governance aids.
  • Forge: Application security tools for vulnerability management and automated remediation.
  • Crucible: Maturity assessments, audit tools, and visualizations for executives.
  • Helm: Bird’s-eye view dashboards for CISOs and boards.
  • DeceptionGrid: An AI-powered honeypot with automated threat intelligence gathering.
  • Ledger: Full financial and budget management for cybersecurity programs.

Personal Ecosystem

On top of all that, I started building apps to simplify my personal life. Why stop at work challenges when AI can overhaul your day-to-day?

  • Healthcare Manager: Tracks every medical detail for my family, from EHRs and lab results to nutrition and emergency health data.
  • Finance Manager: Think Mint on steroids, budgeting, investments, estate planning, and financial forecasting.
  • Family Meal Manager: Weekly meal planning, automated grocery lists, and nutrition insights synced across devices.
  • Fashion Manager: Tracks wardrobe inventory, suggests outfits, and even helps with shopping.

Near-Term Roadmap

My next project (currently underway) is the ultimate Fantasy Football Analytics app.

Goals:

  • Dive into player performance forecasting, college-to-pro transition analysis, and every metric under the sun.

Stay tuned for a follow-up blog on how well my Fantasy Football teams performed using this app.

What’s Really Next

I’ve since integrated Claude Code with Replit, using it to refine, debug, and add new functionality to my apps. I have found this to really work well in taking "vibe coded" apps and get them to true production grade and quality.

Claude:

  • Slower and pricier.
  • My monthly AI spend is teetering near $250+, but the precision and depth make it worth it.

I find it easy to build the scaffolding and prototype in Replit, and then make it more production-grade through Claude.

This journey hasn’t just been a creative outlet, it’s become a bit of an obsession.

My wife often jokes that I am having an affair with both Replit and Claude. And my kids are now asking me questions like, “Are you Replit’ing again?”

In conclusion:
Welcome to what might eventually become AI Anonymous.
My name is James Carder, and I have a problem...

James Carder
Strategic Advisor for Cybersecurity · Cardiant Security
← More Posts