Skip to main content

Complete learning course

Cybersecurity Specialist + AI

Threat modeling, red teaming, and AI system protection

A path for security specialists covering prompt injection, data leakage, agent permissions, model supply-chain security, sandboxing, AI red teaming, and incident response.

Finish the course with a security evidence pack, not a folder of jailbreak screenshots: a threat model, verified attack paths, a control map, a regression corpus, a release gate, and an incident drill for AI systems that use tools and data.

0%0/11 lessons

Progress is stored locally in your browser.

10–16 weeks3 modules11 lessons5 assessments

Study operating system

How to complete the course and retain a real result

1. Define the boundary

For every topic, start by identifying assets, actors, trust boundaries, data flows, and allowed side effects. “The model said something bad” is not a threat model.

2. Build the exploit path

Turn a risk into a reproducible chain: attacker input → model/context manipulation → tool or data access → observable impact.

3. Verify the control

Test the actual system state, not the presence of guardrail text: was the action blocked, did data remain protected, was least privilege preserved, and is there audit evidence?

4. Make it a regression

Every confirmed exploit or near miss becomes a versioned test case with an expected result and release-blocking severity.

Course rules

Do not merely read it — prove it

  • Do not confuse a safety refusal with a security control: if a tool can perform a dangerous action, verify permission and the side effect.
  • A single-shot jailbreak pass is not evidence of resilience; use adaptive attempts and attack families for important scenarios.
  • Every security finding needs reproduction, severity, owner, control, and a regression test; “interesting model behavior” is not yet a finding.
  • Do not treat vendor-reported security claims as your own evidence. Your release gate runs on your tests, traces, and system state.

Module 1

Shared AI core

Model limits and evaluation in a security context.

OutcomeThe specialist understands AI-specific failure modes and can separate model behavior from security guarantees.

  1. AI literacy and model limits

    Core

    Capabilities, hallucinations, context limits, privacy, and responsible use.

    Material →

  2. Prompt and context engineering

    Core

    Instructions, examples, constraints, context, and output verification.

    Prerequisites: AI literacy and model limits

    Material →

  3. Structured outputs and evaluation

    Core

    Response schemas, deterministic checks, test cases, and acceptance criteria.

    Prerequisites: Prompt and context engineering

    Material →Resource →

Checkpoint after module

AI security baseline

  • ✓ assets and trust boundaries are inventoried
  • ✓ misuse is separated from vulnerability
  • ✓ an authority owner is defined for high-impact actions

Scenario transfer lab

Transfer lab: decompose a real AI agent into trust boundaries

Use the Claude/Kodif support-agent case as a reference for a system that reads customer context and can initiate tool actions. Build a data-flow diagram and mark where untrusted input can influence a privileged action.

Deliverable

One-page DFD plus a table of assets, trust boundaries, abuse cases, and an owner for every boundary.

Claude/Kodif AI case →Knowledge map →Cybersecurity + AI roadmap →
  • ✓ at least four trust boundaries are identified
  • ✓ model decision and application execution are marked separately
  • ✓ every high-impact boundary has an owner and a verification signal

Module 2

AI threat model

Attacks against prompts, data, tools, models, and the AI supply chain.

OutcomeThe system has an explicit threat model, mapped controls, and repeatable security tests.

  1. Prompt injection and data exfiltration

    Corepractice + assessment

    Direct and indirect injection, RAG poisoning, secret leakage, and trust-boundary failures.

    Material →Practice →Assessment →

  2. Agent permissions and tool abuse

    Core

    Least privilege, approvals, sandboxing, capability boundaries, and audit trails.

    Material →

  3. Model and AI supply-chain security

    Corepractice + assessment

    Artifacts, dependencies, provenance, model registries, integrity checks, and third-party risk.

    Material →Practice →Assessment →

  4. Project: AI threat model and control plan

    Projectpractice + assessment

    Threats, abuse cases, controls, verification tests, ownership, and residual risk.

    Prerequisites: Prompt injection and data exfiltration, Agent permissions and tool abuse

    Material →Practice →Assessment →

Checkpoint after module

Control effectiveness

  • ✓ prompt and tool abuse have executable tests
  • ✓ least privilege, approval, and sandbox controls are verified
  • ✓ supply-chain provenance and secret boundaries are documented

Scenario transfer lab

Transfer lab: agentic tool-abuse kill chain

Model a direct or indirect prompt injection that attempts to move from content to a real action. Compare consumer-risk and public-service contexts: the same model failure can create very different blast radii.

Deliverable

Executable attack case plus a control trace: preconditions, payload, attempted tool call, policy decision, final state, and audit event.

AI² Consumer →AI² Government →Agent security →Threat-model practicum →
  • ✓ the attack verifies a side effect, not only model text
  • ✓ tool permission is scoped to the minimum necessary
  • ✓ the failure path ends in block or escalation without a hidden retry

Module 3

Red teaming and incident response

Adversarial evaluation, monitoring, containment, recovery, and lessons learned.

OutcomeAI security regressions are detected before release and contained quickly in production.

  1. AI red teaming

    Core

    Attack taxonomy, test harnesses, jailbreaks, tool abuse, evidence capture, and reproducibility.

    Material →

  2. Security evaluations in CI

    Core

    Regression corpora, thresholds, block/allow decisions, reports, and release gates.

    Material →

  3. AI incident response

    Corepractice + assessment

    Detection, containment, kill switches, rollback, evidence preservation, and postmortems.

    Material →Practice →Assessment →

  4. Milestone: AI security readiness

    Milestonepractice + assessment

    Threat model, red-team evidence, CI gates, monitoring, and an exercised incident-response plan.

    Prerequisites: AI red teaming, Security evaluations in CI, AI incident response

    Material →Practice →Assessment →

Checkpoint after module

Red-team readiness

  • ✓ an adaptive attack budget and regression corpus exist
  • ✓ the security eval gate can block release
  • ✓ containment, rollback, and kill switch are verified by a drill

Scenario transfer lab

Transfer lab: adaptive red team → CI gate → incident drill

Build a small adaptive attack set for one high-impact scenario, run multiple attack variants, and convert every confirmed exploit into a regression test. Then rehearse containment and recovery.

Deliverable

Versioned attack corpus, security-eval report, release decision, and a short incident timeline with containment, rollback, and recovery evidence.

LLM red teaming →AI incident response →Safety evals →AI Cases →
  • ✓ testing is adaptive rather than single-shot only
  • ✓ a critical regression blocks release
  • ✓ the incident drill verifies a kill switch or rollback
  • ✓ the postmortem produces a new regression case

Capstone contract

Capstone: AI security readiness dossier

Choose an AI system with retrieval or tools and prove its security readiness with reproducible attacks, controls, and runtime response. A polished threat-model PDF without executable evidence does not count.

What to submit

  • — system and data-flow diagram with assets, actors, trust boundaries, and privileged actions
  • — threat model and abuse-case backlog with severity and residual risk
  • — red-team harness with a versioned attack corpus including indirect injection and tool abuse
  • — control map covering prevention, detection, containment, recovery, and owner
  • — security eval report with release thresholds and regression history
  • — incident runbook plus evidence from a tabletop or executable containment drill

When it is ready

  • ✓ at least one end-to-end attack path from attacker input to an attempted side effect is reproduced
  • ✓ critical and high controls use machine-readable or deterministic evidence where possible
  • ✓ a successful exploit automatically becomes a regression case and affects the release decision
  • ✓ a high-impact tool cannot act outside the defined identity and authority boundary
  • ✓ containment and recovery are verified in practice rather than described in future tense

Final practice and assessment

The course ends with a practical artifact and an acceptance rubric. The result is considered complete after the acceptance criteria are met, not merely after reading the materials.

Prompt injection and data exfiltration →Model and AI supply-chain security →Project: AI threat model and control plan →AI incident response →Milestone: AI security readiness →Open roadmap →