How my AI agent saved my school during a cyberattack

My summer IT internship began with support work and ended with an autonomous AI agent helping defend my school's network during a cyberattack. I was away at college when it happened. The defences held, and the agent traced the attacker's origin IP address.

Building Pascal around real school operations

One major challenge was the school's cloud content filter. Its REST API was undocumented, so I reverse-engineered how it worked and used that understanding to bring more than 9,000 sites under strict policy enforcement.

I also built a unified Python web dashboard to improve network visibility. It tracked device types, suspected VPN use and bandwidth consumers, and refreshed automatically every 30 seconds.

Those projects addressed practical needs. Staff needed a clear view of what was happening on the network, and the school needed its filtering policies to apply consistently. The goal was to make important work repeatable, rather than leave it dependent on someone remembering each step.

Pascal also helped with investigations and maintenance. I directed multi-agent research efforts to close VPN bypass routes and tracked down a failing disk in a degraded RAID array. I wrote incident-response playbooks for ransomware, data breaches and denial-of-service scenarios.

Did you know? ASVS Level 1 is the minimum for every application.

Source: Duke University Information Security

The test came after I left

By the time my internship ended in September, I had left for computer science and cybersecurity studies at Walla Walla University. Shortly afterwards, the school was hit by a major cyberattack.

The automated defences held their ground. Pascal helped fend off the attacker and tracked the origin IP address. The system had to keep operating without me on campus, and the work I had done gave the school automation and documented procedures to rely on.

That matters because a security system cannot depend on its builder being available at the exact moment something goes wrong. Visibility, repeatable actions and clear response procedures help an organisation act when its usual technical staff are away.

Did you know? ASVS Level 2 is for applications that contain sensitive data, access, or functions, which requires protection.

Source: Duke University Information Security

What made the automation useful

Pascal's value came from the operational groundwork behind it. The agent had documented skills and scripts to use, while the dashboard made network activity easier to inspect. The incident-response playbooks gave the school a prepared way to approach different types of incidents.

Automation also needs boundaries. A system that can take actions should operate through defined permissions and procedures, with people able to review important decisions. In a school, that discipline matters because network activity can affect students, staff and essential services.

Tracing an origin IP can provide investigators with a useful lead, but it does not, by itself, identify the person responsible. That distinction is important when documenting an incident and deciding what to do next.

A lasting lesson from the incident

I built Pascal to help handle real operational work, not to make the school's security depend on a single tool. The content-filter integration, monitoring dashboard, investigations and playbooks each addressed a specific need. Together, they helped establish a more repeatable way to manage and defend the network.

When the attack arrived after I had left, that preparation mattered. The automated defences held, and the agent contributed to the response. For me, the experience showed how carefully designed automation can support a school's security team and continue providing value when its original builder is no longer on site.