Start with a labeling problem

A security team evaluates a tool that reads several alerts and writes an incident summary. One analyst calls it generative AI. Another calls it an LLM. A vendor describes it as a transformer-based NLP system. A fourth person simply calls it machine learning.

They may all be describing the same system from different angles.

That is why the AI vocabulary feels confusing: the terms do not all answer the same question.

• Machine learning and deep learning describe broad ways systems learn.
• Statistical learning describes a family of methods grounded in probability, inference, and relationships in data.
• A transformer is an architecture—a way a neural network is organized.
• NLP describes the language problem space.
• LLM and SLM describe language-model scale and deployment tradeoffs.
• Generative AI describes the job of creating new content.
• A GAN is one specific architecture for generating realistic synthetic data.

Certification lens: CompTIA SecAI+ CY0-001 Objective 1.1 asks you to compare and contrast AI types and techniques used in cybersecurity. The goal is not to memorize eight isolated definitions. The goal is to recognize the boundary each term describes.

Use two maps instead of one family tree

Some relationships are genuinely nested:

Artificial intelligence
└── Machine learning
    └── Deep learning
        └── Transformer architectures

But that diagram is incomplete. NLP is a field of problems, not simply another layer under transformers. Generative AI is a capability, not one architecture. GANs generate content without being language models. Statistical learning overlaps with the mathematical foundations of machine learning rather than fitting cleanly on one rung.

Use two maps:

Map 1: What is the technology?

Ask whether the label names:

• a broad field;
• a way of learning;
• a mathematical approach;
• a neural-network family;
• an architecture; or
• a model scale or deployment category.

Map 2: What job is it doing?

Ask whether the system is:

• classifying or scoring;
• recognizing complex patterns;
• processing language;
• generating new content; or
• producing synthetic data through adversarial training.

One system can occupy several places at once. A cloud tool that summarizes a threat report may be:

• an AI system;
• based on machine learning;
• built with deep learning;
• implemented with a transformer;
• an NLP application;
• powered by an LLM; and
• performing a generative task.

Those labels are not competing answers. Each describes a different layer or job.

Machine learning: patterns learned from data

Machine learning (ML) is an approach within AI that learns useful patterns from data. The previous topic established the basic pipeline:

data → training → model → inference → output

Cybersecurity examples include:

• classifying a file as malware or benign;
• scoring an email for phishing;
• detecting unusual login behavior; and
• prioritizing alerts using historical analyst decisions.

Machine learning is the broadest learning label in this topic. Saying a tool uses ML does not tell you whether it uses a simple regression model, a decision tree, or a deep neural network.

Statistical learning: relationships, uncertainty, and explanation

Statistical learning uses statistical models and inference to understand relationships in data and make predictions. Examples include regression, probabilistic models, and methods that estimate how strongly different inputs relate to an outcome.

Suppose a login-risk model considers:

• geographic distance from the user's normal location;
• device familiarity;
• time of day; and
• failed attempts before success.

A statistical model may produce a risk score while also making the influence of those features comparatively visible. That interpretability can help an analyst ask why an event was flagged.

Statistical learning and machine learning overlap. A useful classroom contrast is emphasis:

Do not turn this contrast into an absolute rule. Many statistical methods are machine-learning methods, and many ML projects need both prediction and explanation.

Deep learning: many layers learn complex representations

Deep learning is a subset of machine learning that uses neural networks with multiple layers. Each layer transforms the input and can learn increasingly complex representations.

For malware analysis, early layers might identify small byte patterns while later layers combine those patterns into features associated with a malware family. For network traffic, layers may learn relationships among timing, packet size, flow direction, and session behavior.

Deep learning is useful when data is large, complex, and difficult to represent with a few human-selected features:

• executable bytes;
• images;
• audio;
• long event sequences; and
• large collections of unstructured text.

The tradeoff is that a powerful multi-layer network can be harder to explain, more expensive to train, and more demanding to operate. “Deep” refers to network layers—not to how intelligent or trustworthy the system is.

Transformers: an architecture built around attention

A transformer is a deep-learning architecture designed to model relationships across a sequence. Its key mechanism is attention.

Consider this sentence:

The analyst blocked the attachment after the sandbox reported that it created a scheduled task.

To understand “it,” a model must connect that word to “the attachment,” not “the analyst” or “the sandbox.” Attention assigns relevance to relationships among tokens so the model can use context.

In cybersecurity, transformers can help with:

• phishing-message classification;
• threat-report summarization;
• extraction of indicators from prose;
• alert and ticket analysis;
• code analysis; and
• modeling sequences of events.

A transformer is not automatically generative. Transformer models can classify, extract, translate, summarize, or generate. Transformer names the architecture; generative names a type of output job.

NLP: the language problem area

Natural language processing (NLP) is the field concerned with computers working with human language. NLP includes tasks such as:

• classification: phishing or legitimate;
• extraction: find domains, hashes, and IP addresses in a report;
• translation: convert a report into another language;
• summarization: reduce a long incident record;
• question answering: respond using available text; and
• generation: write new language.

Not every NLP system is an LLM. A rule-based parser, a statistical classifier, a small neural network, or a transformer can all perform NLP tasks. Likewise, transformers can process data other than ordinary prose, including code, images, and event sequences.

Use this distinction:

NLP tells you the problem involves language. Transformer tells you how a model may be built.

LLMs and SLMs: language models at different scales

A language model learns patterns in sequences of language and estimates what tokens fit a context. Modern language models are commonly built with transformers.

Large language models

Large language models (LLMs) are designed for broad language capability across many tasks. They often require substantial memory and compute and are frequently accessed through hosted services.

Security uses include:

• summarizing a complicated investigation;
• explaining alerts in plain language;
• drafting detection logic for analyst review;
• comparing multiple threat reports; and
• supporting conversational security tools.

Small language models

Small language models (SLMs) use a smaller resource footprint. They may be a strong fit for a narrow task, lower latency, limited hardware, or on-premises deployment.

Security uses include:

• locally classifying alert text;
• extracting fields from routine tickets;
• assisting on an endpoint or edge device; and
• processing sensitive text within an organization's controlled environment.

Compare the tradeoffs

These are tendencies, not guarantees. An LLM can be deployed privately, and an SLM can be hosted externally. A smaller model is not automatically secure, accurate, unbiased, or appropriate. Deployment, access controls, data handling, and testing still matter.

Generative AI: creating something new

Generative AI creates new content from learned patterns. The output may be text, code, images, audio, video, or synthetic records.

Cybersecurity examples include:

• drafting an incident summary;
• proposing detection-rule code for human review;
• generating synthetic phishing messages for authorized awareness training;
• explaining a vulnerability to a nontechnical audience; and
• producing artificial examples to expand a training dataset.

Generative AI is a capability category. It does not identify one specific architecture. Text generation often uses transformer-based language models, while image or synthetic-data generation may use other architectures.

The capability is dual-use. A defender can create safe training material; an attacker can create persuasive phishing content or deceptive media. Later topics address those security risks in depth. For now, be able to identify the generative job.

GANs: generation through competition

A generative adversarial network (GAN) contains two neural networks trained in competition:

1. The generator creates synthetic examples.
2. The discriminator attempts to distinguish synthetic examples from real ones.
3. Feedback from the discriminator helps the generator improve.
4. The cycle repeats until the generated examples become more realistic.

Generator creates a sample
          ↓
Discriminator compares real and synthetic samples
          ↓
Feedback improves the generator
          ↺

Defensive security uses can include synthetic training data, safe simulation, and robustness testing. Offensive uses can include deepfakes, synthetic identities, and content designed to evade a detector.

A GAN is not another word for generative AI. It is one specific generative architecture. An LLM is not a GAN: an LLM predicts language tokens, while a GAN trains a generator against a discriminator.

A repeatable decision method

When a SecAI+ scenario presents an AI system, ask five questions:

1. What is the output job? Classification, extraction, prediction, or generation?
2. What data is central? Structured features, complex raw data, language, images, or sequences?
3. Which layer does the term name? Field, learning approach, architecture, model scale, or capability?
4. Where must it run? Hosted service, controlled environment, edge device, or ordinary workstation?
5. What security consequence follows? Data boundary, explainability, compute, dual use, or attack surface?

Worked example

Requirement: A security team wants a local tool that reads routine alert descriptions, assigns a category, and sends no text outside the organization.

• The data is language, so this is an NLP task.
• The output is a category, so the job is classification, not generation.
• A transformer may be an appropriate architecture because context matters.
• An SLM may fit the local, bounded, low-resource requirement.
• It is still based on machine learning and likely deep learning.
• The local deployment may reduce one data-boundary concern, but it does not prove the output is accurate or secure.

The best answer depends on what the question asks. If it asks for the language field, choose NLP. If it asks for model scale under a local constraint, choose SLM. If it asks for architecture, choose transformer.

What to carry forward

Do not study these terms as eight disconnected flashcards. Study the relationships:

• AI is the broad field.
• ML learns patterns from data.
• Statistical learning emphasizes modeled relationships and inference.
• Deep learning uses multi-layer neural networks.
• Transformers use attention to model relationships in sequences.
• NLP is the language problem area.
• LLM and SLM describe language-model scale and deployment tradeoffs.
• Generative AI creates new content.
• GANs generate through competition between a generator and discriminator.

The next topic will compare model-training approaches and prompting. First, make sure you can name the family member being described here—and explain why another related label may also be true.

Study guide: The AI Family

This topic supports CompTIA SecAI+ CY0-001 Objective 1.1: comparing and contrasting AI types and techniques used in cybersecurity.

The relationship map

AI
└── Machine learning
    └── Deep learning
        └── Transformers are one architecture

NLP = language problem area
LLM / SLM = language-model scale and deployment categories
Generative AI = capability that creates new content
GAN = specific generative architecture using two competing networks
Statistical learning = overlapping mathematical and inferential foundation

The map is intentionally not one perfect tree. The terms answer different questions.

Compare the terms

High-value distinctions

NLP versus transformer versus LLM

• NLP names the language problem.
• Transformer names an architecture.
• LLM names a large language model commonly built with transformers.

A threat-report summarizer can be all three.

LLM versus SLM

• Compare breadth, compute, latency, cost, deployment, and data boundary.
• “Large” and “small” do not mean “unsafe” and “safe.”
• Either model still needs evaluation, access controls, secure data handling, and human verification.

Generative AI versus GAN

• Generative AI is the broad capability of creating new content.
• A GAN is one architecture that trains a generator against a discriminator.
• Many generative language systems are transformer-based and are not GANs.

Statistical learning versus deep learning

• Statistical learning often emphasizes relationships, inference, and interpretability.
• Deep learning uses layered neural networks to learn complex representations.
• Both can be part of machine learning.

Common certification traps

1. Treating every listed term as a separate rung in one hierarchy.
2. Calling NLP an architecture rather than a problem field.
3. Assuming every transformer is generative.
4. Assuming every NLP system is an LLM.
5. Describing an SLM as automatically private or secure.
6. Calling every generative system a GAN.
7. Forgetting that a single system may have several valid labels.
8. Choosing a broad true label when the question asks for a more specific architecture, task, or scale category.

Retrieval practice

Answer without notes, then explain why a neighboring term is less precise.

1. Which broad AI approach learns patterns from examples?
2. Which approach commonly emphasizes interpretable relationships and statistical inference?
3. Which machine-learning subset uses multi-layer neural networks?
4. Which architecture uses attention to model relationships across a sequence?
5. Which field covers understanding, extracting, classifying, and generating human language?
6. Which language-model category often favors broad capability and substantial compute?
7. Which language-model category may favor a narrow task, lower resource use, or local deployment?
8. Which capability creates new text, code, images, audio, or synthetic records?
9. Which architecture contains a generator and a discriminator?
10. Why can one incident-summary tool be described as NLP, transformer-based, an LLM, and generative AI?

Scenario practice

For each scenario, state the best-fit term and one additional label that may also apply.

1. A multi-layer network analyzes executable bytes to identify a malware family.
2. A model uses attention to connect events located far apart in a long incident timeline.
3. A compact local model categorizes short security tickets.
4. A tool extracts domains and hashes from a written threat report.
5. Two networks compete while producing increasingly realistic synthetic login records.
6. A broad hosted model drafts a new executive incident summary.

These are original study prompts, not actual CompTIA exam questions.