AI Takes the Stand: Teaching Cybersecurity with an Intelligent Tutor

Author: Denis Avetisyan

A new agentic AI system, the CyberJustice Tutor, is demonstrating a promising approach to cybersecurity education by adapting to individual student needs and verifying its knowledge.

This paper details an agentic AI framework leveraging Think-Plan-Act reasoning, Retrieval Augmented Generation, and pedagogical scaffolding within the Zone of Proximal Development to enhance cybersecurity learning.

Existing cybersecurity education for criminal justice professionals often struggles with the limitations of static chatbots and the potential for inaccuracies in critical legal contexts. This paper introduces the ‘CyberJustice Tutor: An Agentic AI Framework for Cybersecurity Learning via Think-Plan-Act Reasoning and Pedagogical Scaffolding’, an innovative educational system employing an agentic AI architecture to address these challenges. Through autonomous planning, dynamic pedagogical scaffolding grounded in Vygotsky’s Zone of Proximal Development, and verified knowledge retrieval, the system demonstrates improved learning outcomes in a user study with [latex]\mathcal{N}=123[/latex] participants. Can this approach pave the way for more effective and reliable AI-driven training in other specialized professional domains requiring high levels of accuracy and contextual understanding?

The Illusion of Understanding: Why Current AI Falls Short

Conventional educational approaches frequently operate on a ‘one-size-fits-all’ model, presenting information at a standardized pace and depth that often fails to resonate with the diverse learning styles and pre-existing knowledge levels of students. This inflexibility can result in significant gaps in comprehension, as learners who require additional support on foundational concepts may be left behind, while those with prior understanding become disengaged from repetitive material. The resulting disconnect diminishes motivation and hinders the development of robust understanding, particularly in complex subjects where building upon prior knowledge is crucial; a student’s individual needs, whether stemming from differing learning speeds, cognitive styles, or background experiences, are often overlooked in favor of maintaining a uniform classroom progression.

Despite their impressive capabilities in generating human-like text, Large Language Models (LLMs) present significant challenges when applied to educational tutoring. A key limitation is their propensity for ‘hallucination’ – the confident presentation of factually incorrect or nonsensical information. This stems from the models’ reliance on statistical patterns in vast datasets rather than genuine understanding. Furthermore, LLMs often struggle with contextual awareness, failing to accurately assess a learner’s prior knowledge or the specific nuances of a question. Consequently, the support they offer can be irrelevant, misleading, or even detrimental to the learning process, hindering effective knowledge transfer and reinforcing incorrect assumptions. Addressing these shortcomings is crucial for building trustworthy and beneficial AI-powered educational tools.

The prevailing limitations of current AI tutoring systems necessitate a shift towards dynamically adaptive learning environments. Rather than delivering standardized instruction, effective AI education requires systems capable of accurately assessing a learner’s evolving knowledge – pinpointing not only what they know, but also identifying specific gaps and misconceptions. This means moving beyond simple question-and-answer interactions to create AI that can infer a student’s cognitive state, tailoring explanations, providing targeted practice, and adjusting the difficulty of material in real-time. Such personalized support, mirroring the nuanced approach of a human tutor, promises to overcome the shortcomings of fixed curricula and address the individual needs crucial for fostering genuine understanding and sustained engagement. Ultimately, the development of these adaptive systems represents a pivotal step toward unlocking the full potential of AI in education.

Building a Tutor That Doesn’t Confabulate: An Agentic Framework

The CyberJustice Tutor utilizes an Agentic AI Framework to facilitate personalized learning by autonomously breaking down complex learning goals into manageable sub-tasks and dynamically sequencing instructional activities. This framework moves beyond pre-defined learning paths, allowing the AI to assess student progress in real-time and adjust the curriculum accordingly. Specifically, the system can identify knowledge gaps, select relevant resources, and generate practice problems tailored to the individual learner’s needs. This dynamic orchestration of learning activities is achieved through continuous evaluation and adaptation, enabling a more efficient and effective learning experience compared to static, pre-programmed tutoring systems.

The CyberJustice Tutor’s core intelligence is powered by OpenAI’s GPT-4o model, selected for its advanced reasoning and natural language capabilities. To address the inherent limitations of large language models, specifically the tendency to generate factually incorrect or nonsensical outputs – known as hallucination – a Retrieval Augmented Generation (RAG) system is implemented. RAG functions by supplementing GPT-4o’s knowledge with information retrieved from a curated knowledge base of legal principles, case law, and pedagogical resources. This retrieved context is provided to the model alongside the user’s prompt, grounding its responses in verifiable data and significantly improving factual accuracy and the reliability of generated content.

The ‘Think-Plan-Act’ Cycle forms the core operational logic of the CyberJustice Tutor’s AI. During the ‘Think’ phase, the system analyzes student input and current learning state to identify knowledge gaps and learning needs. This assessment informs the ‘Plan’ phase, where the AI decomposes the overarching learning goal into a sequence of specific, achievable pedagogical steps. Finally, the ‘Act’ phase involves executing these steps through the delivery of targeted content, exercises, or feedback. This cycle repeats iteratively, allowing the AI to dynamically adjust its approach based on ongoing student performance and ensure continuous, personalized learning interventions.

Scaffolding for Understanding: Meeting Learners Where They Are

The CyberJustice Tutor utilizes a Pedagogical Scaffolding Layer designed to deliver adaptive, temporary support to learners as they engage with legal concepts. This layer dynamically adjusts the level of assistance provided based on real-time performance analysis, offering interventions such as hints, simplified explanations, or worked examples when a learner encounters difficulty. The scaffolding is not static; support is incrementally reduced as the learner demonstrates increased proficiency, fostering independent problem-solving skills. This approach ensures that learners are consistently challenged within their Zone of Proximal Development, promoting optimal learning and knowledge retention without oversimplification or excessive hand-holding.

The CyberJustice Tutor’s Pedagogical Scaffolding Layer utilizes Vygotsky’s Zone of Proximal Development (ZPD) as its foundational principle. The ZPD defines the discrepancy between a learner’s ability to perform a task independently and their potential to perform with guidance. Interventions within the CyberJustice Tutor are specifically designed to target this zone; support is provided when the learner encounters difficulty, and gradually reduced as competence increases. This dynamic adjustment ensures challenges remain within the learner’s reach, fostering cognitive growth and promoting the development of new skills without inducing frustration or disengagement. The system continually assesses performance to maintain this optimal level of challenge, thereby maximizing learning efficiency.

Instructional scaffolding within the CyberJustice Tutor manifests as a series of supports designed to incrementally reduce assistance as the learner’s competence increases. This is achieved through techniques such as providing hints, breaking down complex tasks into smaller, manageable steps, and offering worked examples. The ReAct framework-combining Reasoning and Acting-is utilized to enable the system to not only generate responses but also to explicitly demonstrate the thought process behind them, allowing learners to observe the application of knowledge. These methods collaboratively create a guided learning experience, effectively bridging the gap between the learner’s current knowledge and the targeted complex concepts, while simultaneously promoting independent problem-solving abilities.

Reasoning as a Signal: Why Transparency Matters

The architecture of this system centers on leveraging Chain-of-Thought (CoT) prompting, a technique that encourages the AI to deconstruct problems and articulate its reasoning steps before arriving at a solution. This process isn’t merely about generating an answer; it’s about simulating a deliberate thought process, fostering a deeper level of understanding. Complementing CoT is the application of Backward Design, where the system begins with the desired outcome – a correct solution – and then works backward to identify the necessary steps and knowledge. By first defining the goal, the AI can more effectively structure its reasoning and provide explanations that are logically sound and easily followed, ultimately enhancing critical thinking skills through a transparent and methodical approach.

A crucial element in building effective artificial intelligence lies in fostering transparency – not simply receiving an answer, but understanding how that answer was derived. This system moves beyond opaque outputs by prompting the AI to explicitly articulate its reasoning process, effectively unveiling the steps taken to reach a conclusion. This approach directly addresses concerns about ‘black box’ AI, building user trust by allowing for scrutiny and validation of the AI’s logic. By making the internal thought process visible, interventions become more than just suggestions; they are explainable, defensible, and ultimately, more readily accepted as valuable contributions to problem-solving and learning.

A recent study established a functional agentic AI framework designed to enhance cybersecurity education. Evaluation involving 123 participants revealed strong user acceptance, with an average usability score of 4.4 on a 5-point scale. Perceived accuracy of the AI’s guidance also registered highly, averaging 4.3, suggesting effective knowledge delivery. Importantly, the system demonstrated efficient performance, earning an average response speed rating of 4.7, indicative of its capacity to provide timely and relevant support during the learning process. These findings support the viability of integrating such AI frameworks into educational settings to bolster cybersecurity skills and knowledge.

Beyond Information Delivery: Toward True Pedagogical Interaction

The CyberJustice Tutor’s ability to engage in nuanced, interactive learning hinges on sophisticated orchestration frameworks. Tools like LangChain and AutoGen serve as the essential architecture, enabling the seamless connection and management of large language models (LLMs) with external knowledge sources and reasoning engines. These frameworks don’t simply deliver pre-programmed responses; instead, they facilitate a dynamic exchange where the LLM can access, process, and synthesize information in real-time to construct personalized learning pathways. This complex interplay allows the tutor to adapt its questioning, offer tailored feedback, and ultimately guide students through intricate legal concepts with a level of responsiveness previously unattainable, moving beyond simple information delivery towards true pedagogical interaction.

The integration of Large Language Models (LLMs) with the Socratic Method represents a significant advancement in personalized education. Traditionally, the Socratic Method relies on a skilled educator to guide students through a series of probing questions, encouraging them to examine their own assumptions and construct knowledge independently. Now, LLMs can be engineered to emulate this process, dynamically adjusting the difficulty and focus of questions based on a student’s responses. This adaptive questioning isn’t simply about identifying correct answers; it’s about discerning how a student arrives at a conclusion, pinpointing areas of misunderstanding, and offering tailored prompts to stimulate deeper thought. The result is a learning experience that moves beyond rote memorization, fostering critical thinking and problem-solving skills through individualized inquiry, and potentially unlocking a more profound and lasting understanding of complex subjects.

The development of this AI-driven educational system signifies a shift beyond simple knowledge transmission, envisioning tutors capable of cultivating higher-order thinking skills. Rather than passively receiving information, learners engage in dynamic interactions designed to promote critical analysis and creative problem-solving. This approach moves away from rote memorization and towards a deeper understanding of concepts, encouraging students to question, evaluate, and synthesize information independently. Ultimately, the goal is to instill not just competence in specific subjects, but also a genuine curiosity and intrinsic motivation for continuous learning, fostering a lifelong pursuit of knowledge and intellectual growth.

The pursuit of automated tutoring, as evidenced by the CyberJustice Tutor, feels predictably ambitious. This system, built on agentic AI and Retrieval Augmented Generation, attempts to dynamically adapt to a learner’s Zone of Proximal Development. One anticipates the inevitable edge cases, the quirks in the knowledge grounding that will require constant patching. Vinton Cerf observed, “Any sufficiently advanced technology is indistinguishable from magic.” But the magic always fades, replaced by the mundane reality of maintaining complex systems. It’s a sophisticated framework, undoubtedly, but one can already foresee the escalating tech debt as production use reveals unforeseen limitations in its pedagogical scaffolding.

The Road Ahead

The presented framework, while demonstrating a capacity for dynamic instruction, merely relocates existing limitations. The ‘agentic’ scaffolding, built upon retrieval-augmented generation, still depends on the quality – and inherent biases – of the underlying knowledge base. Verification, a stated strength, becomes an exercise in confirming the least-incorrect answer, not necessarily a true one. The system effectively automates the creation of more sophisticated crutches, delaying the inevitable need for fundamental improvements in how security concepts are initially taught – and learned.

Future work will undoubtedly focus on scaling this approach – more content, more ‘agents,’ more elaborate planning modules. However, the critical bottleneck isn’t computational; it’s the inherent fragility of symbolic representation. The Zone of Proximal Development, a borrowed concept, doesn’t magically resolve ambiguities in threat modeling or incident response. It simply provides a more efficient means of propagating existing assumptions. The pursuit of ‘intelligence’ should not overshadow the persistent need for rigorous validation and, crucially, human oversight.

The field would benefit less from further architectural complexity-we don’t need more microservices – and more from a sustained effort to address the fundamental problem of knowledge decay. Each iteration of this technology adds layers of abstraction, making it progressively harder to trace errors back to their source. The long-term cost of this ‘innovation’ will not be measured in processing cycles, but in the inevitable technical debt accumulated along the way.

Original article: https://arxiv.org/pdf/2603.18470.pdf

Contact the author: https://www.linkedin.com/in/avetisyan/