TRUE TEAMWORK

Building Human-AI Partnerships
for Tomorrow’s Cyber Challenges

Ryan Straight

ryanstraight@arizona.edu

Rob Honomichl

rjhonomichl@arizona.edu

Paul Wagner

paulewagner@arizona.edu

GET YOUR STUFF NOW!

also there!

Download Materials Right Now!

ryanstraight.github.io/nicek12‑2025‑materials

You get:

• Quick Start guide (try it Monday!)
• Low-resource options
  (no 1:1 devices? no problem)
• 12 lesson plans
  (3 activities × 4 grade bands)
• Ready-to-print everything

FIRST THING: Scan this QR code. Download the materials while we talk, everything we cover today is in there, plus more.

Honest note: First time through? Budget 2 hours prep. After that, 30-45 minutes. The Quick Start guide walks you through exactly what to do first.

You’re about to experience THREE activities—compressed versions of what your students will do. Pay attention to what YOU notice. Ready? Let’s go!

The Shift We’re Preparing Students For

How we often teach AI:

• AI as a tool to use
• AI as a threat to guard against
• AI as something to regulate

What the workforce actually needs:

• AI as a partner with different strengths
• Humans who know when to trust—and verify
• Teams that leverage both

60 seconds of context before we dive in.

Here’s the shift: We often teach AI as a tool: something students USE. Or as a threat: something to guard against. Or as a policy problem—something to regulate.

But in actuality, we’re seeing AI as a partner. Security Operations Centers are drowning in alerts; thousands per day. AI triages them, prioritizes them, spots patterns. But humans decide what’s real, what to escalate, what to do. That’s not future-state. That’s TODAY.

The professionals of the future who will thrive are the ones who know how to work WITH AI: when to trust it, when to verify it, when to override it.

That’s what these activities teach. Not AI literacy. Not AI ethics in the abstract. Partnership skills.

Let’s experience it.

WHY THIS WORKS

Before we jump into the activities, I want to share the 60-second version of WHY we designed them this way.

This isn’t just “let’s use AI in class.” There’s research behind how we structured these experiences.

If you’re academically inclined, the full annotated bibliography is in your download. For now—the practical version.

The Partnership Framework

Three ideas shaped these activities:

1. Distributed agency — Expertise is shared between humans and AI (this is how SOCs actually work)

2. Complementary strengths — AI sees patterns; humans see context and meaning

3. Mutual shaping — We change AI through how we query it; AI changes us through what it surfaces

In practice:

A SOC analyst doesn’t “use” a SIEM—they work with it.

The SIEM decides what’s worth flagging.

The analyst decides what it means.

Together: threat detection.

Apart: blind spots.

Three quick ideas—no jargon, just the practical version.

FIRST: Distributed agency. In real Security Operations Centers, expertise isn’t in one place. The AI triages thousands of alerts. Humans decide what’s real. Neither has the full picture alone. That’s not future-state—that’s today.

SECOND: Complementary strengths. AI excels at pattern recognition—spotting anomalies across millions of log entries. Humans excel at context—understanding why something matters, what the organization cares about, what’s appropriate to do about it.

THIRD: Mutual shaping. This one’s subtle but important. When analysts work with security tools, the tools shape what they notice. The tool decides what to flag, how to prioritize, what to highlight. Over time, analysts learn to think in the tool’s categories. That’s not bad—it’s just real. And students should understand it.

The activities are designed so students EXPERIENCE these dynamics, not just hear about them.

[For academically-inclined attendees: This draws from posthuman educational theory—particularly Braidotti’s work on distributed agency and Adams & Thompson’s heuristics for examining technology-human entanglement. Full bibliography in your download under “Resources.”]

What You’re About to Experience

Activity 1: You’ll discover that AI caught something you missed—and YOU caught something AI missed.

Activity 2: You’ll hear AI articulate its own limitations—and your policy-making will shift.

Activity 3: You’ll make decisions a real Incident Response professional makes—with AI as your partner.

These aren’t AI literacy lessons. They’re partnership training.

Here’s what’s about to happen—I’m telling you now so you can watch for it.

In Activity 1, you’re going to investigate a security incident. Pay attention to what YOU notice versus what the AI analysis caught. There’s a designed discovery moment.

In Activity 2, you’ll design governance policies for an AI system. Then you’ll hear the AI describe its own blind spots. Watch what happens to your thinking.

In Activity 3, AI will recommend actions. You’ll decide whether to accept, modify, or reject. That’s professional judgment.

None of this is about “AI literacy” in the abstract. It’s about developing the partnership skills that define modern cybersecurity work.

Ready? Let’s experience it.

ACTIVITY 1

Security Detective Teams

12 minutes
Grades 6-8 (adaptable K-12)
NICE: Defensive Cybersecurity

The design: Students investigate a security incident WITH an AI partner

The discovery moment: When students realize AI spotted something they missed—AND they spotted something AI missed—the partnership insight lands.

Activity 1: Security Detective Teams.

Here’s what’s about to happen: You’re going to do a 2-minute version of what your students will experience in 35 minutes. Don’t just follow the instructions. Pay attention to what YOU notice. What catches YOUR eye first?

[FRAGMENT]

The design is simple: students investigate a security incident with an AI partner. But we’ve structured the evidence so AI catches certain patterns AND humans catch different ones.

When you experience both, you’ll understand exactly what your students will feel.

First, quick implementation note—then we dive in.

Implementation Options

Designed for your actual constraints: all activities work WITHOUT 1:1 devices

Pre-Generated Cards ⭐ Easiest start

Print AI response cards: same discovery, zero tech needed

Teacher-Led Reading

You read AI analysis aloud; control pacing and emphasis

Rotation Stations

One device, groups rotate (5-min turns)

Live AI Demo

Project one conversation, whole class analyzes together

District blocks AI? No devices? The print-based options often work BETTER—students focus on thinking, not clicking.

Four options—pick what fits YOUR classroom.

Pre-generated cards are the easiest start. Print them, hand them out, done. Same discovery, zero tech dependency.

Teacher-led reading means YOU read the AI analysis aloud. You control pacing, you can emphasize key points, students focus on thinking rather than clicking.

Rotation stations if you have limited devices. Live demo if you want to project one AI conversation for the whole class.

All four work. Technical guides in your download detail each one.

Now let’s try it. Your tables are going to investigate a real scenario…

Scenario: Friday at Lincoln Elementary

Your role: School cybersecurity team

Monday morning email from IT:

“Unusual activity on our network Friday night. User account compromised. Need to understand what happened.”

You have:

• AI security analysis (technical patterns)
• Access logs (raw data)
• School context (institutional knowledge)

Your job: Develop a theory of what happened

Quick setup—30 seconds.

“You’re investigators with both AI analysis AND human insight. You’ve got access logs, AI pattern detection, and one crucial piece of context. Let’s see what YOU notice.”

Next slide has the evidence. Get ready to investigate.

The Evidence + AI Analysis

Access Logs (Raw Data)

• User: jmiller (school secretary)
• Compromised: Friday, 11:47 PM
• Password: Lincoln2024!
• Failed logins: 47 attempts (Friday 10:15-11:45 PM)
• First unauthorized access: Personnel records

School context: Lincoln Elementary announced budget cuts last week affecting support staff positions

🤖 AI Security Analysis
(This is what students see)

Pattern detected
Password = mascot + year (weak)
Threat vector
Brute force attack
Recommendation
Force password reset, enable MFA

At Your Table (2 min)

1. Read the AI analysis. What did it catch?
2. Read the school context. What does THAT tell you?
3. What’s your theory? Why this person? Why now?
4. Be ready: What did YOU notice that AI didn’t?

:::::

TABLE ACTIVITY TIME!

Quick framing before you start: “Look at the blue box—that’s EXACTLY what an AI security tool would output. It caught the password pattern, identified the attack type, gave a recommendation. Good technical analysis. Now look at everything ELSE on this slide…”

[Click countdown]

“Go! Two minutes. Read everything. What do YOU notice?”

Walk around. Listen for

• Who focuses on the AI analysis first?
• Who notices the budget cuts context?
• Does anyone connect secretary + budget cuts + personnel records?

Don’t give hints. Let them discover.

After timer: “Before I show you anything—let me ask…”

The Designed Discovery

AI catches:

• Password = school mascot + year
• Brute force attempt pattern
• Account compromise indicators

Humans catch:

• Budget cuts → possible insider motive
• Secretary = access to sensitive files
• Why this person, why now?

The insight: Neither alone gets the full picture. Students experience this—they don’t just hear it.

Before I show you this—

“Raise your hand if you noticed the budget cuts connection.”

[Hands go up]

“Now raise your hand if AI’s password analysis was the first thing you focused on.”

[Different hands]

“Look around. Neither group was wrong. You saw DIFFERENT things.”

[Reveal slide content]

AI caught: password pattern, brute force signature, technical indicators.

Humans caught: institutional context—budget cuts mean someone might be angry, secretary means access to sensitive files, timing matters.

The insight isn’t that humans are “better.” It’s that you see different things. THAT’S what your students will discover.

Built-In Verification Protocol

Scaffolded into the activity:

1. How would I verify this finding?
2. What other sources should I check?
3. What’s the cost if AI is wrong here?

Why we built this in:

Students naturally over-trust or under-trust AI. The verification step calibrates appropriate skepticism—without dismissiveness.

We built a verification protocol directly into the activity flow.

Here’s why: At the college level, we consistently see students swing between two extremes—either treating AI as infallible or dismissing it entirely. This protocol addresses that pattern.

The verification checkpoint calibrates appropriate skepticism. Students learn to trust AI outputs AND verify them. That’s the professional standard you’re preparing them for.

The questions are scaffolded: What would verification look like? What sources? And crucially—what’s the cost of being wrong? That last question grounds the abstract in consequences.

In Your Classroom

Activity flow (35 min):

1. Evidence (5 min) — Present scenario
2. AI partner (10 min) — Pattern analysis
3. Human context (10 min) — What AI misses
4. Synthesis (10 min) — Combine insights

The download includes:

• Full lesson plan
• Evidence packets (print-ready)
• AI prompts for students
• All grade bands: K-2, 3-5, 6-8, 9-12

What you just experienced in 2 minutes? Your students will explore over 35 minutes with full scaffolding.

Present the evidence—5 minutes. Students partner with AI for pattern analysis—10 minutes. Then the crucial step: What does AI miss? 10 minutes. Finally, synthesis.

The download includes everything—but start with the Quick Start guide, not the full curriculum. It tells you exactly what to do first.

AND—grade-band versions for ALL ages. K-2, 3-5, 6-8, and 9-12. Same core discovery, adapted to developmental level.

That “aha” you felt? Your students will feel it too.

ACTIVITY 2

Ethics in Automated Security

12 minutes
Grades 6-8 (available K-12)
NICE: Cybersecurity Policy and Planning

The design: Students design governance policies for AI security systems

The discovery moment: When they hear AI articulate its own limitations, policy design becomes collaborative—not just restrictive.

Activity 2: Ethics in Automated Security.

The progression: In Activity 1, you partnered with AI to INVESTIGATE.

[NEXT]

Now you’re designing rules FOR AI—moving from “working together” to “governing together.” That’s a higher-order skill.

Same deal: 4-minute version here, 40 minutes with full scaffolding in your classroom.

Watch what happens to your thinking when AI tells you what it CAN’T do.

The Setup

Scenario: Your school is getting “SchoolGuard”

It can:

• See what websites students visit
• Block “dangerous” sites
• Alert teachers about “unusual” activity
• Learn from student behavior patterns

Your job:

Decide what SchoolGuard should do automatically vs. ask humans first

Here’s the scenario: Your school is implementing an AI security system called SchoolGuard.

It can monitor website visits, block dangerous sites, alert teachers about unusual activity, and learn from patterns.

→ PAUSE

Your job—and the students’ job—is to decide: What should SchoolGuard do automatically? What should require human approval first?

Let’s design some policies together.

Your Table’s Policy Challenge (4 min)

Your table designs ONE policy:

“SchoolGuard should _____________ automatically, but must ask a human before _____________.”

Think about:

• What’s the RISK if SchoolGuard acts alone?
• What’s the COST if humans must approve everything?
• Where’s the line?

TABLE ACTIVITY TIME!

[Click countdown] “Go! Four minutes. Design ONE policy. Think about the trade-offs.”

Walk around and listen. You’ll hear very different approaches—safety vs. privacy vs. efficiency. Don’t intervene. Let them wrestle with it.

When the timer finishes: “Hold onto your policies. Before we share—I want you to hear from the AI itself…”

What Does the AI Say?

What I CAN do:

“I spot patterns humans miss. I’ve identified students at risk of self-harm weeks before any visible signs.”

What I CAN’T do:

“I flagged a student researching gun violence for a history paper. I see patterns, not intentions.”

[Read the AI’s voice dramatically]

“What I CAN do: I spot patterns humans miss. I’ve identified students at risk of self-harm weeks before any visible signs.”

[Pause. Let that land.]

[Reveal the second box]

“What I CAN’T do: I flagged a student researching gun violence for a history paper. I see patterns, not intentions.”

Now ask: “How many of you wrote policies mostly about RESTRICTING what AI can do?” [Hands.] “Now that you’ve heard AI describe its own blind spots—would you write it differently?”

That shift—from “how do we control AI?” to “how do we design smart handoffs?”—THAT’S the insight.

Share Your Policies (2 min)

2-3 tables: What did you decide?

The design insight: did hearing what AI can and can’t do change your thinking? That shift, from controlling AI to partnering with AI, is exactly what we want students to discover.

“2-3 tables—what did you decide?”

[Listen for variety: automation vs. approval vs. specific scenarios]

After sharing: “Did hearing AI’s perspective change how you’d write it? Look around—some of you are nodding.”

“That shift you just felt? From ‘control AI’ to ‘design smart handoffs’? That’s what your students will feel.”

In Your Classroom

Activity flow (40 min):

1. Scenario (5 min) — Intro SchoolGuard
2. Policy design (15 min) — 3 decisions
3. AI perspective (5 min) — Capabilities & limits
4. Debate (10 min) — Defend choices
5. Reflection (5 min) — What’s hard?

Grade-band versions:

• K-2: “Robot Helper Rules”
• 3-5: “Computer Rules Committee”
• 9-12: “AI Governance Workshop”

All include scenario cards + AI voice scripts

What you just experienced in 4 minutes? Your students get 40 minutes with full scaffolding.

Scenario intro, policy design for 3 questions (not just one), AI perspective reveal, class debate, reflection.

Grade-band versions:

K-2: “Robot Helper Rules”—classroom robot Sparky. What can Sparky do alone vs. ask first?

3-5: “Computer Rules Committee”—school tech policies.

9-12: “AI Governance Workshop”—actual legal frameworks like FERPA, stakeholder role-play.

Same discovery, adapted to developmental level.

ACTIVITY 3

AI-Assisted Incident Response

3 minutes
Grades 6-8 (available K-12)
NICE: Incident Response

The design: AI recommends actions, humans decide

The discovery moment: Students realize they’re making real career decisions—Incident Response is a real career.

Activity 3: AI-Assisted Incident Response. Fastest one—90 seconds.

The progression: Activity 1 was investigating together. Activity 2 was governing together. Now: DECIDING together under pressure. AI recommends, you choose. That’s the full partnership arc—analysis, policy, action.

Ready? Here’s your incident.

Incident Response Challenge (90 sec)

🚨 ALERT: Ransomware detected on 3 teacher workstations. Spreading to shared drive.

AI Security System recommends:

#	Recommendation	Your Call
1	Isolate infected machines immediately	(auto-approved)
2	Lock ALL user accounts until investigation complete	?
3	Notify parents about potential data exposure	?

At your table: For #2 and #3—ACCEPT, MODIFY, or REJECT?

Think: What happens if we do this? What happens if we don’t?

[Click countdown] “Go! 90 seconds. For recommendations 2 and 3—accept as-is, modify, or reject?”

Frame it: “Think ‘what if’—What if you lock all accounts? Teachers can’t access lesson plans. What if you DON’T? Ransomware spreads. What if you notify parents now? Panic. What if you wait? Liability.”

Walk around quickly. Listen for disagreement—that’s good. Some will say “lock everyone out, safety first.” Others will say “that’s overreach.”

After timer: “Quick show of hands—who accepted #2? Who modified? Who rejected?”

The Career Connection

You just made decisions an Incident Response professional makes daily.

That’s the Incident Response work role in the NICE Framework.

AI gave options. You used judgment. That’s the partnership.

Full 35-minute version in your download—with role cards for Analyst, Manager, Communications Lead.

“Raise your hand if you accepted recommendation #2—lock all accounts.” [Hands]

“Raise your hand if you rejected or modified it.” [Hands]

“That disagreement? That’s EXACTLY what happens in real incident response. There’s no single right answer. What matters is the reasoning.”

You just did what Incident Response professionals do. That’s a real career in the NICE Framework. Your students can see themselves in that role.

What you experienced in 90 seconds, your students get 35 minutes with full scaffolding, role cards, and multiple incidents.

WHY THIS WORKS

What You Just Discovered

Activity 1: AI sees patterns. Humans see context. Together: the full picture.

Activity 2: AI has limits it can name. Humans design smart handoffs. Together: better governance.

Activity 3: AI recommends. Humans decide. Together: professional judgment.

Let’s name what just happened.

In Activity 1, you discovered that AI catches technical patterns—but YOU caught the institutional context. Neither alone got the full picture.

In Activity 2, you heard AI articulate its own blind spots—and your policy-making shifted from “control AI” to “design smart handoffs.”

In Activity 3, AI gave options. You made judgment calls. That’s professional practice.

Three activities. Three discoveries. Your students will feel exactly what you felt.

WHAT YOU’RE GETTING

Your Complete Download Package

📚 12 Complete Lesson Plans

• 3 activities × 4 grade bands (K-2 through 9-12)
• Full facilitation guides
• Differentiation strategies

📊 Assessment & Career

• Human-AI Collaboration rubrics
• NICE Framework Alignment Matrix
• Career connection handouts
• Work role mappings

🔧 Implementation Support

• Low-Resource Guide ⭐ (often works BETTER)
• AI Platform Setup guides
• CTE program alignment
• Outreach/STEAM integration

📝 Ready-to-Print Materials

• Evidence packets & worksheets
• Role cards & scenario cards
• AI response cards (low-resource)
• Annotated bibliography

Let me quickly run through what you’re getting—it’s substantial.

Twelve complete lesson plans: three activities, each with four grade-band versions from K-2 through high school.

Assessment rubrics focused on what actually matters—how well students collaborate with AI, not just individual knowledge. Plus career connection handouts that link every activity to NICE Framework work roles.

Implementation support for YOUR context. And I want to highlight the Low-Resource Guide—this isn’t a compromise. Teachers tell us the print-based versions often work BETTER because students focus on the thinking, not the clicking. Start there.

CTE pathway alignment, outreach program guidance, and print-ready materials you can use Monday.

NICE Framework Alignment

Mapped to Work Roles—downloadable crosswalks included:

Activity	Primary Work Roles (v2.0.0)
Security Detective Teams	Defensive Cybersecurity, Vulnerability Analysis (PD)
Ethics in Automated Security	Cybersecurity Policy and Planning, Privacy Compliance (OG)
AI-Assisted Incident Response	Incident Response, Defensive Cybersecurity, Threat Analysis (PD)

Implementation note: Career connection handouts link activity tasks to specific TKS statements. Full competency mapping available in download, ready for CTE pathway and curriculum approval documentation.

You’ll find NICE Framework crosswalks in the download—each activity mapped to Work Roles with specific TKS alignments.

For those of you building CTE pathways or documenting curriculum alignment, these are ready to use. Work Role names are current with Framework 2.0.0.

The career connection handouts translate activity tasks into language students—and administrators—can connect to workforce outcomes.

Implementation Considerations

As you plan adaptation…

• What’s your current AI access reality? (Low-resource options are robust)
• Which discovery moments matter most for your students?
• How do these connect to existing curriculum?
• What adaptations are you already considering?

A few implementation considerations as you plan:

AI access: The low-resource options aren’t compromises—they’re often pedagogically stronger because they force focus on the thinking rather than the technology.

Discovery moments: Different contexts may emphasize different insights. The materials are modular enough to prioritize what matters for your students.

Curriculum connections: Where do these fit in what you’re already doing? They’re designed as standalone activities but also as entry points.

What adaptations are you already thinking about? Let’s discuss.

QUESTIONS?

Get the Materials!

ryanstraight.github.io/nicek12‑2025‑materials

12 lesson plans • Career connections • Any resource level

Presented by: Ryan Straight, Rob Honomichl, & Paul Wagner
Cyber Operations
College of Information Science
University of Arizona

Thank you!

One more time—if you haven’t downloaded yet, do it now. QR code is right there.

We’d love to hear how you implement these. Email me at ryanstraight@arizona.edu—I genuinely want to know what works and what doesn’t in different classroom contexts.

Let’s take questions!