Learn
A hands-on course, free lessons, notes and videos, plus a 90-day AI security challenge with one short reel a day, starting 1 Nov.
The Sec Guy · Cloud & AI Security
Your cloud is exposed. Your AI is next.
Learn cloud and AI security in plain English, protect the AI your team ships, and stay current without the hype. Every claim is sourced, and every lab runs free on your laptop first.
Course pre-sale opens 1 Nov. Founding price $49 until 30 Nov 2026, then $199.
Six rules behind everything we publish
-
Primary sources, fact-checked
Every claim links to where it came from, and content is independently fact-checked before it ships.
-
Free on your laptop first
Every course lab runs locally at $0 before you touch a cloud account.
-
AWS labs show the bill
Each AWS lab prints its estimated cost before it deploys, and tears itself down after.
-
Updated every quarter
A short “what changed” Future watch update each quarter, free for every student.
-
No trackers on this site
No analytics, no advertising cookies. The only cookie is the course sign-in.
-
Plain English first
Every term gets a one-line plain meaning before it’s used. No maths degree needed.
What The Sec Guy does
Protect
Security advisory for teams shipping AI: app and agent reviews, AWS AI platform security, threat modelling and readiness.
Stay current
Free checklists by email, a newsletter when something new is out, and daily reels on Instagram and YouTube.
Why AI security, why now
Every company is shipping AI. Few teams know how to secure it. The people who learn this now become the ones who lead it.
- +21%
projected growth in US information security analyst jobs from 2025 to 2035, with about 14,100 openings a year.
Source: US Bureau of Labor Statistics - $4.99M
average cost of a data breach in 2026, a record high.
Source: IBM Cost of a Data Breach Report 2026 - 43%
of organisations had a shadow AI security incident, up from 20% a year earlier. AI governance was missing at 68% of breached organisations.
Source: IBM Cost of a Data Breach Report 2026 - Nov 2025
Anthropic reported disrupting the first documented AI-orchestrated cyber-espionage campaign, run largely by AI agents.
Source: Anthropic - 2026
OWASP published a new Top 10 for LLM applications and a Top 10 for agentic applications. EU AI Act high-risk duties apply from December 2027 and August 2028.
Source: OWASP GenAI Security Project · EU Regulation 2026/1744
Zero to Hero in AI Security
Five stages, each ending with something real you can show. You climb one step at a time, and nothing is used before it’s explained.
-
Stage 1 M0–M2
Foundations
How LLMs work, threat modelling
You’ll be able to explain how an AI app really works and threat-model it against OWASP and MITRE ATLAS.
You leave with a threat model of the course’s vulnerable AI app
-
Stage 2 M3–M6
Break and fix any AI app
Prompt injection, data leaks, output handling, RAG
You’ll be able to run prompt injection and data-leak attacks, then ship fixes and prove them with tests.
You leave with a break-and-fix write-up with passing tests
-
Stage 3 M7–M9
Agents and MCP
Agent tools, MCP servers, AI supply chain
You’ll be able to limit what agents and MCP servers can do, and vet models and packages before you use them.
You leave with a hardened agent and MCP setup with a permissions review
-
Stage 4 M10–M16
Secure AI on AWS
Bedrock, Guardrails, AgentCore, SageMaker AI, detection and response
You’ll be able to secure an AI workload on AWS end to end and detect attacks against it.
You leave with hardened Terraform and detection rules for an AWS AI workload
-
Stage 5 M17–M32
Prove it and go advanced
Red teaming, governance, capstone, advanced track
You’ll be able to red-team an AI app, gate releases on security evals, and map controls to governance frameworks.
You leave with a red-team report, a graded capstone and a certificate of completion
From zero: no AI or maths background needed. See the full curriculum
The course
AI Security Engineer
Secure what you build with AI — from your laptop to AWS. Defender-first, starts from zero, and built around one deliberately vulnerable AI app you attack and secure from the first module to the capstone.
- Part 1 Foundations How LLMs work and how to threat-model them 3 modules
- Part 2 Attack and defend any AI app Prompt injection, RAG, agents, MCP, supply chain 7 modules
- Part 3 AI security on AWS Bedrock, Guardrails, AgentCore, SageMaker AI, detection 7 modules
- Part 4 Prove it Red teaming, evals in CI, governance, capstone 3 modules
- Part 5 Advanced track Agent identity, authorization, secure-by-design agents 13 modules
- Part 6 Future watch A short “what changed” update every quarter Quarterly
6 parts and 33 modules, from “what is a token” to securing agents on AWS. See every lesson in the curriculum.
What you get
- Video lessons. Each lesson opens with a real incident, then breaks it and fixes it on screen.
- PDF slide decks. A downloadable deck for every module.
- Hands-on labs. A $0 local version and an optional AWS version, each with a walkthrough video and a written guide.
- Community. Lab help on GitHub Discussions, and a Discord server with student channels (coming soon).
- Certificate of completion. Earned by passing the graded capstone, with a public verify link.
- Progress you can see. Badges, ranks and an attack-surface map that lights up as you secure each part.
Who we help
Everyone who works near AI and was never taught to secure it. Start from the job you already do.
-
SOC analyst
You already know logs, alerts and triage. You’ll learn what AI attacks look like in logs, and how to run an AI incident end to end.
-
Cloud security engineer
You already know IAM, SCPs, KMS and logging. You’ll learn the Bedrock, Guardrails and AgentCore controls you need to sign off an AI launch.
-
AppSec engineer or pentester
You already know injection and threat modelling. You’ll learn prompt injection, agents and MCP as attack surface, and AI security tests in CI.
-
Developer or ML engineer
You already know APIs, auth, secrets and CI/CD. You’ll learn the AI-specific mistakes: trusting model output, over-powered tools, RAG leaks.
-
Vibe coder
You already know how to ship fast with AI tools. You’ll learn why AI-written apps leak keys and data, plus a 10-point “before I launch” check.
-
Founder
You already know customers, risk, budgets and vendors. You’ll learn what AI may do in your product, a one-page AI policy, and what to ask vendors.
-
GRC, risk or compliance
You already know frameworks, controls and audits. You’ll learn how NIST AI RMF, ISO 42001, the EU AI Act and OWASP map to real controls.
-
IT, DevOps or platform
You already know Terraform, containers and networking. You’ll learn self-hosting models safely, the model supply chain, private AI endpoints.
-
Student or career switcher
You already know enough: curiosity is the only prerequisite. You’ll learn everything from scratch, plus portfolio projects you can show in interviews.
It’s OK not to know this yet.
ChatGPT went public in November 2022 and OWASP's first Top 10 for LLM apps followed in 2023. Nobody has ten years of this. The people doing it today came from SOC, cloud, AppSec, development and GRC, the same places you’re coming from.
For teams
Cloud and AI security advisory
For teams putting AI into production on AWS or elsewhere. Every engagement is scoped by email first: tell us what you’re building, which cloud you’re on and your timeline.
Email [email protected]AI app and agent security review
Your chatbot, RAG app or agent, reviewed end to end: prompts, tools, data paths and permissions, with fixes in priority order.
AWS AI platform security
Amazon Bedrock, Guardrails, Knowledge Bases and AgentCore: identity, network, logging and guardrail configuration checked against your design.
Threat modelling
A working session that maps the trust boundaries of your AI system and ties each threat to OWASP and MITRE ATLAS.
AI security readiness
Where AI is used across your organisation, what it can touch, and a short plan your engineers and auditors can both act on.
Latest videos and notes
Latest videos
All videos- 6 Ways Hackers Hijack Your AI Agent Six real cases where an error log, a contact form, a PDF, a GitHub issue, an email and a browser extension hijacked AI agents, and the five fixes that stop all of them.
- Your Bucket Is Private. Your Data Isn't. Six real ways data leaks from S3 buckets that look locked down, from public objects to CloudFront and leaked keys, and how to close each one.
- Your Cloud Is Exposed. Your AI Is Next. The trailer for Cloud & AI Security in 5 Minutes: what's coming every week across AWS, Azure, GCP, OCI and AI agents, and the free Cloud & AI Security Quick Check.
Latest notes
All notes- 5 AWS settings attackers hope you skipped (10-minute check) Five account-level AWS settings that close the most common doors: S3 Block Public Access, IMDSv2 by default, root MFA, an all-Region CloudTrail trail and IAM Access Analyzer.
- Leaked an AWS key on GitHub? Here's what happens in the first 5 minutes Attackers found and used exposed AWS keys within five minutes in one real campaign. What they did, what AWS does automatically, and the 6 steps to take right now.
- Prompt injection for cloud teams: 6 real AI agent hijacks and the 5 fixes An AI agent can't reliably tell data from instructions. Six real attacks shown by researchers (logs, forms, PDFs, GitHub issues, email, browser extensions) and the controls that stop all of them.
Stay current
Free, short, and only when there’s something worth your time.
Get the free Quick Check
25 checks that catch the mistakes behind common cloud and AI breaches. Enter your email and the PDF lands in your inbox, plus a short note when a new video is out. Unsubscribe anytime.
We'll only use your email to send the checklist and new-video notes. See the privacy policy.
Free checklists
Community
-
GitHub Discussions
Lab help, bug reports and show-and-tell, in public, on the course lab repo.
Open Discussions -
Discord Coming soon
Daily chat, 90-day challenge check-ins, and student-only channels for the course.
-
Email
Billing, account questions, or a topic you want covered. Every message is read.
[email protected]
Questions
What is The Sec Guy?
An independent cloud and AI security brand. We publish free videos, notes and checklists, run a hands-on course called AI Security Engineer, and advise teams that are shipping AI.
What is free, and what is paid?
Videos, notes, checklists, the daily reels and the free course lessons cost nothing. The full course is a one-time payment. Advisory work for teams is scoped by email.
Do I need an AI, machine-learning or maths background?
No. The course starts at “what is a token”, and every term gets a one-line plain meaning before it’s used. If you can follow a cloud console or a terminal, you can follow this.
Will the labs cost me money?
Every lab runs free on your laptop first. The AWS versions are optional; each prints its estimated cost before it deploys, uses budget alarms, and tears itself down.
How do you keep the content accurate?
Claims link to their primary source, content is independently fact-checked before it’s published, and the course gets a Future watch update every quarter.
Do you track visitors?
No. This site has no analytics and no advertising cookies. The privacy policy lists exactly what is stored, and why.
Can you help my team?
Yes. Email [email protected] with what you’re building, which cloud you’re on and your timeline. Team purchases of the course and invoices in your company’s name are handled the same way.
Are you affiliated with AWS?
No. The Sec Guy is independent and not affiliated with or endorsed by AWS or any other vendor named on this site.