From Markov Chains to LLMs: How AI Works Internally

19 years ago, I started my Final Degree Project with Chema Alonso at Informática 64, one of the cradles of cybersecurity in our country. I don't know if it was the water from Móstoles or the team that gathered at that company, but cool things were done back then. We called my FDP Prefetching Web Browsing, and the idea was simple to state (although it took quite a few lines of C# and C++ to implement...), predicting a user's navigation on an IIS server to preload, using AJAX, the pages they were most likely to visit next. Remember that AJAX had practically just come out, it was still something new. To achieve this, we applied the theorem of Markov Chains, modeling navigation as a sequence of states in which the next page depended on the current one and on the transition probabilities we had observed. Seen from today's perspective, it might sound artisanal, but for the time, it was a small innovation, and above all, it was my first serious contact with something we didn't dare to call "AI" so lightly back then: using a probabilistic model to anticipate behavior. That hooked me so much that I later did a postgraduate degree in statistics, the postgraduate degree in Decision Systems Engineering at URJC, which then allowed me to pursue a doctorate and where I delved much deeper into statistics and its first applications to artificial intelligence.

I'm telling all this because a few months ago, someone from the industry who worked with me jokingly told me that what I had learned was useless, that it was obsolete, that modern AI had left those foundations behind (was he calling me old...? maybe... even though he's a few decades older than me...). If you have delved into this field, you will agree with me that this person was logically mistaken, not out of nostalgia, but because he confuses the tool with the foundation. When we talk today about language models, neural networks, or generative systems, we are essentially talking about statistics applied on a scale we couldn't even imagine back then. The names have changed, and the computing power is incomparable, but the foundations are exactly what we studied. An AI model, beneath all the marketing hype, is nothing more than vectors and matrices. Every word, every pixel, every concept is represented as a numerical vector, an embedding, and the model's knowledge lives in gigantic matrices of weights upon which multiplications are chained, one after another. Hence the immense computational need to make them "run."

Allow me to go into detail for a moment, because understanding how an LLM, for example, is built internally is the best way to see that all of this is, essentially, linear algebra and probability. Minor issues aside, we can say that the first thing that happens is tokenization and embedding. That is, the text is broken down into units called tokens (words, sub-words, or characters), and each token is transformed into a fixed-dimension vector of real numbers, say around 768 or 4096 components depending on the model. This vector is the token's "coordinate" in a semantic space, and the set of all possible embeddings forms a large matrix of size V × d, where V is the vocabulary size (tens or hundreds of thousands of tokens) and d is the embedding dimension. When we input a sentence of n tokens into the model, we are actually inputting an n × d matrix X: one row per token, one column per semantic dimension.

The attention mechanism, which is the heart of the transformer, is applied to this matrix X. The model projects X using three learned weight matrices, W_Q, W_K, and W_V, obtaining three new matrices: queries (Q), keys (K), and values (V). The central calculation is simple: the queries are multiplied by the transposed keys, Q·Kᵀ, which produces a score matrix where each cell measures how much one token "attends" to another. These scores are scaled, passed through a softmax function that converts them into a probability distribution (all sum to 1), and then used to weight the values V. In other words, each token is recalculated as a weighted average of all others, and the weights of that average are probabilities. Here again is the same idea as Markov, but generalized to relationships between all elements of the sequence simultaneously.

After attention, each layer of the model passes the result through a feed-forward neural network (more matrix multiplications with their activation functions) and normalizations, and this block is repeated dozens of times, stacking layers. Finally, the model produces, for each position, a vector of logits the size of the vocabulary, which a final softmax converts into the probability of each possible next token. Generating text is, literally, sampling from that distribution again and again. And all the "learning" is nothing more than adjusting the millions of numbers in all those weight matrices using gradient descent. The model predicts, the error is measured with a loss function, the derivative of that error with respect to each weight is calculated, and it is corrected slightly in the direction that reduces the error. This is repeated trillions of times over vast amounts of text. Fundamentally, there is no magic; there is vectorization, matrix multiplication, probability distributions, and statistical optimization. Exactly the toolbox that some considered obsolete. Those who understand matrices, distributions, inference, and optimization understand what happens inside a model. Those who don't are left with the idea that AI is just using a chatbot, a ChatGPT... but the idea we applied with Markov is still there, only now we call it an autoregressive model.

From all this, I draw a lesson that I apply daily: the CEO of a technology company must also be, to a large extent, its CTO. It's not enough to know a bit about the business and understand numbers; one must understand the technology that underpins it well enough to determine the technological strategy and not just buy what the market wants to sell, because if someone wants to deceive you, they will succeed. In a sector like cybersecurity, where AI is redefining both threats and defenses, an executive who doesn't understand what lies beneath a model is doomed to make blind decisions, and that's why those foundations from 19 years ago are not just a fond memory for me but a competitive advantage. It is precisely this conviction that we have embodied in our Strategic Plan 2026-2030, which is published on our website (zerolynx.com/pages/plan-estrategico) and is articulated around a principle that underpins everything: humans in command, AI as muscle. In 2026, we have oriented this plan towards a model where AI manages repetitive tasks so that the team delivers what truly matters, with artificial intelligence integrated into every service and process as a strategic lever, not just an adornment.

And this is where theory becomes product, because that philosophy doesn't just stay on a slide. We have developed CuatrIA, our process management and unified governance tool, which brings together in one place what normally lives scattered among a CRM, an ERP, HR flows, and the rest of the company's operations. CuatrIA is built with AI from start to finish, but with a design decision that is non-negotiable for us: it runs on Ollama and a multitude of local models, so sensitive data never leaves our infrastructure. For a cybersecurity company, governing information with AI without giving up sovereignty over that data is not a whim; it's consistency. And it's also proof that understanding the fundamentals serves a very specific purpose: knowing when a well-orchestrated local model solves your problem without needing to send your data to a third party.

And betting on AI without governing it would also be irresponsible, even more so in our profession. So, as part of this same strategy, we already have our own AI Policy and are adapting to ISO/IEC 42001, the international standard for artificial intelligence management systems, because we want to use it powerfully but also traceably, ethically, and auditable. That horizon of maturity we hope to achieve by 2030 is built not only with technology but with solid and certified processes. That's why this semester we are certifying ourselves in several other "ISOs"... ISO 20000-1 for IT service management, ISO 22301 for business continuity, ISO 9001 for quality, and ISO 14001 for environmental management, aligning them with the ones we already maintain, ISO 27001 and ENS HIGH level. It's a huge effort, but deeply coherent; if we are going to put AI at the center of our services, the foundation it rests on must be impeccable. I will tell you more about this in future posts, as we are currently immersed in the midst of this "great change" :).

So no, what I learned 19 years ago is not obsolete (don't worry, there's no resentment in this comment, I laugh about it deep down :P). That Final Degree Project with Markov Chains, that statistics postgraduate degree, all of it still beats beneath every model we use today, beneath every response CuatrIA generates from our local models. Technology changes names every few years, but the mathematical and statistical fundamentals do not. And whoever masters them not only understands AI better but is in a better position to lead, to design strategy, and to build companies that truly leverage artificial intelligence, without smoke and mirrors, with good judgment and intelligence. Markov was right. And he will continue to be.