Lesson Plans · Information Technology · Cybersecurity Fundamentals · Course 6302
Human + AI: Information Technology and the Human Leader
An AI security scanner flagged a flaw in the school’s attendance app and wrote the fix. It looks ready to deploy. But the finding might be a false positive, and the patch might break the morning attendance sync. Students serve as the school’s student security team: they audit the finding, review the patch, and sign the deploy / revise / hold decision as the accountable humans.
New here? Watch this first — how an interactive lesson works (30 seconds).
Part of the AI-Assisted Cyber Defense curriculum unit — Lesson 1 of 5.
View the full curriculum →VDOE Standards of Learning addressed
| Code | Standard |
|---|---|
| 9.R.1 | English 9 (2024): Evaluation and synthesis of information — evaluate sources for credibility and bias, synthesize, cite sources, and demonstrate ethical and responsible use of all sources including Artificial Intelligence (AI). Students audit the AI scanner’s finding and the AI-generated patch for credibility. |
| 9.C.2 | English 9 (2024): Speaking and presentation of ideas — report on a topic with audience-appropriate vocabulary. Teams present the deploy / revise / hold recommendation. |
| 9.W.1 / 9.W.2 | English 9 (2024): Expository writing — extended piece with a thesis, evidence from multiple authoritative sources, and a concluding section. Decision brief defending the call. |
| EPF.1 | Economics & Personal Finance (2019): Cost-benefit analysis and the PACED decision-making grid. Students weigh deploy, revise, or hold — breach risk against the cost of breaking a working system. |
CTE competencies — Cybersecurity Fundamentals (6302)
| Area | Instructional area (Virginia CTE Resource Center) |
|---|---|
| 6302 | Identifying security issues related to computer hardware, software, and data — students triage the scanner’s finding: real, false positive, or real-but-unreachable. |
| 6302 | Ethical behavior with computer systems — honesty, confidentiality, and authorized work only; defenders protect, they do not attack. |
| 6302 | Privacy concepts — a student-information app holds sensitive data; a breach has human consequences. |
| 6302 | Complying with acceptable-use policies — the team works inside authorized boundaries at all times. |
Workplace Readiness Skills
National Standards Alignment
| Framework | Alignment |
|---|---|
| Career Cluster | Information Technology (National Career Clusters Framework, Advance CTE) — the AI scanner-and-patch decision sits inside this national cluster. |
| Career Ready Practices | CRP-11 Use technology to enhance productivity — direct the scanner, don’t surrender to it; CRP-8 Utilize critical thinking — false positive or real flaw; safe patch or broken sync; CRP-9 Model integrity and ethical leadership in security decisions |
| AI4K12 Big Ideas | Perception — how the scanner detects a possible flaw; Learning — how the scanner learns from data — and what it can mislearn; Societal Impact — deploying AI-written security fixes into systems people depend on |
| CSTA K-12 CS | Impacts of Computing and Networks & the Internet concepts (CSTA K-12 Computer Science Standards) — students weigh the societal impact of an AI-generated patch on a school network. |
National framework names verified September 25, 2026 against the Advance CTE National Career Clusters Framework, the Common Career Technical Core Career Ready Practices, and the AI4K12 Five Big Ideas (AAAI/CSTA). Advance CTE modernized the cluster framework in 2024; this lesson uses the classic cluster names shown on this site’s career-cluster pages. No codes were invented.
Learning objectives
By the end of this lesson, students will be able to:
- Describe the defender’s five jobs — find, validate, fix, test, prove — and explain the cost of skipping any step. (6302)
- Evaluate an AI-generated security finding for credibility: distinguish a real, reachable vulnerability from a false positive, and explain why reachability decides whether a finding matters. (9.R.1 · WRS-15 · 6302)
- Apply “Direct it. Check it. Question it. Decide.” to AI-assisted security work, and name the human accountable for the deploy decision. (9.R.1 · WRS-2)
- Judge an AI-generated patch for safety — what it changes, what it could break — and weigh deploy, revise, or hold on a PACED cost-benefit grid. (EPF.1 · WRS-2 · 6302)
- Write an expository brief defending the deploy / revise / hold decision with a thesis, cited evidence, and a conclusion. (9.W.1 · 9.W.2 · WRS-21)
- Present the team’s recommendation with audience-appropriate language. (9.C.2 · WRS-10)
Materials & vocabulary
Student devices with AI access · the scanner case file — finding report, flagged code excerpt, AI-generated patch (teacher-provided scenario) · PACED decision-grid handout · deployment-authorization sign-off sheet · exit-brief template (paper or digital).
Vocabulary: vulnerability · false positive · reachability · exploitability · patch · regression · evidence packet · sign-off · AI direction
Lesson sequence
1. Engage — The scanner’s report (10 min)
Distribute the case file: the scanner flags a hardcoded database password in the attendance app and generates a patch moving it to a secrets vault. It looks critical; the patch looks clean. Quick poll: deploy it now, revise it first, or hold? A school’s student data is on the line — and so is tomorrow morning’s attendance sync.
2. Explore — What defenders do (15 min)
Direct instruction: the defender’s five jobs — find issues, validate them, fix them, test the fix, prove the work (6302). AI now assists at every stage — scanning, drafting patches, checking fixes — but it cannot be accountable for what ships. Introduce the four-level model: Human Initiates, AI Analysis, Human Review, Authorized Decision.
3. Explain & Elaborate — Audit the finding and the patch (35 min)
Teams of 3–4 run the Human + AI cycle on the case file: Direct an AI tool to list every claim the scanner makes and every change the patch makes. Check each one — is the flagged code actually deployed, or is it a test file (false positive)? Is the finding reachable by an attacker? Does the patch change the login flow? (9.R.1, WRS-15, 6302). Question both directions: what breaks if we ship a bad patch — and what breaks if we hold while student data sits exposed? Then Decide: complete a PACED grid (EPF.1) — deploy, revise, or hold — and sign the authorization sheet as the accountable humans (WRS-10).
4. Evaluate — The brief (20 min)
Individual expository brief (9.W.1 / 9.W.2): deploy, revise, or hold the patch? Defend with a thesis, evidence from the case file and at least one cited source, and a conclusion. Required line: “What the AI produced, what the evidence showed, and why I trust one over the other.”
5. Close — The human signs (10 min)
Teams present recommendations (9.C.2). Reflection: the AI found the flaw and wrote the fix — but a human answers for the deployment. Connect to WRS-11 and WRS-13: across every career, the tools will keep changing; the leader’s judgment is the constant.
Human + AI integration — in every lesson
“Direct it. Check it. Question it. Decide.”
- Human Purpose — students set the goal: student data stays safe and the school keeps running.
- Understand the Task · Match the AI · Assign & Instruct — students direct the AI with precise, bounded assignments: list the scanner’s claims, list the patch’s changes — never the deploy decision.
- Navigate & Direct · Evaluate — students check every AI claim against evidence: is the finding real and reachable? Is the patch safe? What could it break?
- Decide · Guide & Improve · Exercise Accountability — the team makes the final call on the PACED grid and signs the authorization sheet. The human decides; the AI advises.
Assessment rubric
| Criterion | Full credit |
|---|---|
| Finding audit (9.R.1 · WRS-15 · 6302) | Every scanner claim checked; false-positive vs. real-vs.-unreachable judgment defended with evidence. |
| Patch review (6302 · WRS-2) | Each patch change named; assumptions and missing tests identified; what the reviewer would not sign is stated. |
| Decision quality (EPF.1 · WRS-2) | PACED grid completed; deploy / revise / hold follows logically from breach risk and outage cost. |
| Written brief (9.W.1 · 9.W.2) | Clear thesis, cited evidence, “produced vs. evidence” line, concluding statement. |
| Accountability (WRS-10 · 9.C.2) | A named human signs the team’s authorization sheet; the presentation is clear and audience-appropriate. |
Differentiation
Support: pre-highlighted code excerpt; claim checklist for the audit; sentence frames for the brief; vocabulary bank on the handout.
Extension: research one real-world AI-assisted defense program (e.g., OpenAI’s Daybreak announcements) and summarize what the AI does vs. what the humans decide; draft the evidence packet a real team would file after a deployment; run a second PACED grid on a revised patch.
References
- OpenAI. “OpenAI extends cyber access to Ukraine for civilian defense.” openai.com, September 2026. — Daybreak gives verified cyber defenders advanced AI for authorized security work: reviewing software, investigating suspicious activity, validating vulnerabilities, testing fixes.
- Reuters. “OpenAI commits $1 billion to cyberdefense effort amid AI safety scrutiny.” September 3, 2026. — The “Daybreak for Frontline Defenders” initiative: subsidized access to AI cybersecurity tools for organizations protecting essential services.
- Human–AI Leadership Framework (H.U.M.A.N.E.D.G.E.). HumanEdge Academy, 2026. — Human Authority → AI Assistance → Human Verification → Human Decision; “Direct it. Check it. Question it. Decide.”; “The human decides. The AI advises.”
- Virginia Department of Education — Standards of Learning (English 9, 2024; Economics & Personal Finance, 2019), Workplace Readiness Skills, and CTE course frameworks (cteresource.org).
Standards source note: English 9 codes, EPF.1, and Workplace Readiness Skills follow the Academy’s verified September 2026 standards set; Cybersecurity Fundamentals (6302) follows the Virginia CTE Resource Center course listing. Nothing was invented. The scanner case file is a classroom scenario written for this lesson. This lesson references OpenAI’s publicly announced Daybreak program as a real-world example; it is an original HumanEdge Academy work and is not affiliated with, sponsored, or endorsed by OpenAI.