The Sec Guy
Enroll today
Open Menu

AI Security Engineer · Curriculum

The full curriculum

6 parts, 33 modules. Part 3 comes in three cloud streams: AWS, Azure or Google Cloud. Pick one or all; every stream is included. 301 lessons in all. Everything is open from the day you join, all three streams included. Lessons marked Free are open to everyone.

Local lab runs free on your laptop · AWS lab Azure lab Google Cloud lab optional, cost shown before deploy · times are estimates

Part 1

Foundations (anyone can follow)

M0 Start here: you belong in AI security 10 lessons · open from day one

Where you fit in AI security, whatever your role, plus a safe lab setup on your laptop and a safe cloud learning account on AWS, Azure or Google Cloud.

  1. 0.1 What you'll be able to do after this course Free ~15 min
  2. 0.2 It's OK not to know this yet Free ~4 min
  3. 0.3 Your role → AI security: the map Free ~13 min
  4. 0.3b Tech basics, part 1: the terminal, git, the web and APIs ~24 min
  5. 0.3c Tech basics, part 2: how software ships, cloud and security-team basics ~18 min
  6. 0.4 Your first win in 15 minutes Free ~22 min
  7. 0.5 How to study this course Free ~3 min
  8. 0.6 Lab: Docker, Python and a local model Local lab ~26 min
  9. 0.7 A safe cloud learning account AWS lab ~37 min
  10. 0.8 Rules of engagement: test only what you own ~4 min
M1 How LLMs actually work (for security people) 9 lessons · open from day one

What a large language model really does (it guesses the next word), and the parts that matter for security: tokens, prompts, embeddings, where models run.

  1. 1.0 Basics: normal software vs AI ~19 min
  2. 1.1 Next-word prediction, tokens, context window Free ~19 min
  3. 1.2 Sampling and temperature ~4 min
  4. 1.3 System prompts, roles and tool calling ~10 min
  5. 1.4 Embeddings and vector search in plain English ~9 min
  6. 1.5 Traditional ML vs LLMs ~8 min
  7. 1.6 Fine-tuning vs RAG vs agents ~10 min
  8. 1.7 Where models run: API, cloud, self-hosted ~5 min
  9. 1.8 Lab: run a model locally and call the API Local lab ~30 min
M2 Threat modeling AI systems 6 lessons · open from day one

Why AI systems can't reliably tell data from instructions, the threat maps you'll use (OWASP, MITRE ATLAS, AWS scoping matrices), and your first threat model.

  1. 2.0 Basics: how threat modeling works ~18 min
  2. 2.1 The core flaw: data vs instructions Free ~12 min
  3. 2.2 The maps: OWASP, ATLAS, NIST and SAIF ~12 min
  4. 2.3 AWS security scoping matrices ~11 min
  5. 2.4 Trust boundaries in AI systems ~7 min
  6. 2.5 Lab: threat-model TSG Helpdesk Local labCapstone ~90 min

Part 2

Attack and defend any AI app (local, open source, $0)

M3 Prompt injection and jailbreaks 10 lessons · open from day one

Direct and indirect prompt injection, jailbreaks, hidden payloads and exfiltration, then layered defenses proven with automated tests.

  1. 3.0 Basics: what injection means ~20 min
  2. 3.1 Direct prompt injection Free ~7 min
  3. 3.2 Jailbreaks vs prompt injection ~11 min
  4. 3.3 Jailbreak techniques you'll meet ~7 min
  5. 3.4 Indirect injection: where it hides ~11 min
  6. 3.5 Hidden and multimodal payloads ~7 min
  7. 3.6 Exfiltration channels ~11 min
  8. 3.7 System prompt leakage ~6 min
  9. 3.8 Defenses in layers ~11 min
  10. 3.9 Labs: break TSG Helpdesk, then fix it Local labCapstoneDetection ~70 min
M4 Data security and privacy 7 lessons · open from day one

What leaks from AI apps and how: PII in prompts and logs, data poisoning, privacy attacks, and shadow AI.

  1. 4.0 Basics: how data flows through an AI app, and every place it's copied ~21 min
  2. 4.1 Sensitive information disclosure ~12 min
  3. 4.2 PII redaction and retention ~7 min
  4. 4.3 Data poisoning and backdoors ~12 min
  5. 4.4 Privacy attacks: inference and inversion ~12 min
  6. 4.5 Shadow AI and acceptable use ~6 min
  7. 4.6 Lab: PII detection and redaction Local lab ~45 min
M5 Output handling and LLM app security 7 lessons · open from day one

Treat AI output like user input: injection through model output, denial of wallet, model extraction, and auth that never trusts the model.

  1. 5.0 Basics: how a web app works ~27 min
  2. 5.1 Improper output handling ~8 min
  3. 5.2 Unbounded consumption and denial of wallet ~12 min
  4. 5.3 Model extraction and API abuse ~6 min
  5. 5.4 AuthN/AuthZ for AI apps ~11 min
  6. 5.5 Hallucination as a security risk ~7 min
  7. 5.6 Lab: XSS and command injection via output Local lab ~45 min
M6 RAG security 8 lessons · open from day one

How retrieval-augmented generation works end to end, and how it breaks: poisoned documents, cross-tenant leaks and vector database exposure.

  1. 6.0 Basics: search engine vs RAG Free ~27 min
  2. 6.1 How RAG works end to end, and where it breaks ~7 min
  3. 6.2 Ingestion: poisoned documents ~12 min
  4. 6.3 Access control in retrieval ~12 min
  5. 6.4 Vector database hardening ~6 min
  6. 6.5 Embedding leakage and inversion ~11 min
  7. 6.6 Grounding, citations and refusals ~7 min
  8. 6.7 Lab: poison and leak a local RAG Local labCapstone ~60 min
M7 AI agent security 10 lessons · open from day one

Agents are a model with tools, a loop and memory. Excessive agency, goal hijack, agent identity, sandboxing and kill switches.

  1. 7.0 Basics: chatbot vs automation vs agent Free ~27 min
  2. 7.1 Agents = model + tools + loop + memory ~6 min
  3. 7.2 Excessive agency ~11 min
  4. 7.3 Goal hijack and tool misuse ~6 min
  5. 7.4 Identity and privilege for agents ~11 min
  6. 7.5 Unexpected code execution and sandboxing ~6 min
  7. 7.6 Memory and context poisoning ~20 min
  8. 7.7 Multi-agent systems: trust and failures ~6 min
  9. 7.8 Human-in-the-loop, kill switches, rogue agents ~11 min
  10. 7.9 Lab: hijack a vulnerable agent, then contain it Local labCapstoneDetection ~40 min
M8 MCP security 7 lessons · open from day one

API vs MCP explained simply, then tool poisoning, confused deputies, MCP authorization done right, and scanning servers before you plug them in.

  1. 8.0 Basics: API vs MCP, side by side Free ~26 min
  2. 8.1 MCP in one picture ~7 min
  3. 8.2 Tool poisoning, rug pulls, tool shadowing ~13 min
  4. 8.3 Confused deputy and token passthrough ~12 min
  5. 8.4 MCP authorization done right ~7 min
  6. 8.5 Scanning MCP servers before you plug them in ~7 min
  7. 8.6 Labs: scan a bad MCP server, build a safe one Local labCapstone ~50 min
M9 Open-source models and the AI supply chain 8 lessons · open from day one

Models are code plus data: safe use of Hugging Face, malicious model files, signing and pinning, AI-BOMs, and the risks of AI coding assistants.

  1. 9.0 Basics: a model file is code + data ~24 min
  2. 9.1 Hugging Face safely ~12 min
  3. 9.2 Malicious models: pickle vs safetensors ~6 min
  4. 9.3 Model integrity: pin, hash, sign ~6 min
  5. 9.4 AI-BOM: inventory your AI supply chain ~10 min
  6. 9.5 Self-hosted guardrail models and their limits ~5 min
  7. 9.6 AI coding assistants ~13 min
  8. 9.7 Lab: detonate a booby-trapped model safely Local lab ~50 min

Part 3

AI security in your cloud: AWS, Azure or Google Cloud

Three parallel streams teach the same topics: module M12 is guardrails in every cloud, M16 is detection and response in every cloud. All three are open from day one and included in the one price. Pick one, several or all, and switch any time. The certificate needs any one complete stream, and its public verify page lists every stream you finish.

AWS stream

Bedrock · AgentCore · SageMaker AI · 7 modules · 45 lessons

M10 The AWS AI footprint and shared responsibility 6 lessons · open from day one

AWS in plain English, the map of AWS AI services, shared responsibility, IAM and SCPs for models, Bedrock API keys and LLMjacking cost safety.

  1. 10.0 Basics: AWS in 10 minutes ~21 min
  2. 10.1 Map of AWS AI Free ~13 min
  3. 10.2 Shared responsibility, service by service ~7 min
  4. 10.3 IAM and SCPs for AI access ~20 min
  5. 10.4 Bedrock API keys ~6 min
  6. 10.5 Cost safety and LLMjacking ~11 min
M11 Securing Amazon Bedrock 7 lessons · open from day one

Least privilege, private networking, KMS, invocation logging and cross-Region inference for Amazon Bedrock, deployed with Terraform.

  1. 11.0 Basics: Bedrock vs a public API ~27 min
  2. 11.1 Least privilege per app and model ~12 min
  3. 11.2 Private networking with VPC endpoints ~11 min
  4. 11.3 Encryption with KMS and data handling ~11 min
  5. 11.4 Invocation logging and CloudTrail ~11 min
  6. 11.5 Cross-Region inference and data residency ~11 min
  7. 11.6 Lab: deploy TSG Helpdesk on Bedrock AWS labCapstone ~30 min
M12 Amazon Bedrock Guardrails 6 lessons · open from day one

Every Bedrock Guardrails policy explained, enforcing guardrails org-wide, and testing them honestly: one layer, not the whole wall.

  1. 12.0 Basics: what a guardrail is and isn't ~21 min
  2. 12.1 Every Guardrails policy explained ~12 min
  3. 12.2 ApplyGuardrail: guardrails for any model ~11 min
  4. 12.3 Enforcement no one can skip ~12 min
  5. 12.4 Testing and tuning guardrails ~11 min
  6. 12.5 Lab: attack the Helpdesk, measure guardrails AWS labDetection ~30 min
M13 Bedrock Knowledge Bases and Bedrock Agents 4 lessons · open from day one

Secure RAG and agents on AWS: Knowledge Base permissions, per-user filters, action groups and return of control.

  1. 13.0 Basics: managed RAG and agents ~20 min
  2. 13.1 Secure RAG on AWS ~19 min
  3. 13.2 Bedrock Agents: action groups and controls ~17 min
  4. 13.3 Lab: port the RAG agent to Bedrock AWS lab ~30 min
M14 Amazon Bedrock AgentCore (attack and defend) 9 lessons · open from day one

Amazon Bedrock AgentCore end to end: Runtime, Identity, Gateway, Policy, Memory and Observability, attacked and defended.

  1. 14.0 Basics: self-run agent vs AgentCore ~27 min
  2. 14.1 What AgentCore is ~5 min
  3. 14.2 Runtime: session isolation and networking ~11 min
  4. 14.3 Identity: inbound and outbound auth ~11 min
  5. 14.4 Gateway: APIs and Lambda as MCP tools ~11 min
  6. 14.5 Policy: deterministic rules on tool calls ~11 min
  7. 14.6 Memory, Code Interpreter and Browser ~11 min
  8. 14.7 Observability and security evals ~10 min
  9. 14.8 Lab: deploy the agent on AgentCore AWS labCapstoneDetection ~30 min
M15 SageMaker AI security (self-hosted and open models) 6 lessons · open from day one

When teams choose SageMaker AI, and how to lock it down: network isolation, execution roles, model approvals and monitoring.

  1. 15.0 Basics: self-hosted vs SageMaker vs Bedrock ~26 min
  2. 15.1 When teams choose SageMaker AI over Bedrock ~11 min
  3. 15.2 Network isolation and execution roles ~13 min
  4. 15.3 Endpoints, JumpStart and Model Registry ~12 min
  5. 15.4 Model Monitor and Clarify in production ~7 min
  6. 15.5 Lab: a private endpoint for an open model AWS lab ~30 min
M16 Detection and response for AI on AWS 7 lessons · open from day one

Detection and response for AI on AWS: what to log, GuardDuty AI Protection, Security Hub AI inventory, hunting queries and incident playbooks.

  1. 16.0 Basics: logs, alerts and incidents ~23 min
  2. 16.1 What to log for AI ~10 min
  3. 16.2 GuardDuty AI Protection ~7 min
  4. 16.3 Security Hub AI inventory ~11 min
  5. 16.4 AWS Config rules and CloudTrail hunting ~6 min
  6. 16.5 Incident playbooks for AI on AWS ~8 min
  7. 16.6 Lab: build detections and catch the attack AWS labCapstone ~30 min

Azure stream

Foundry · Entra Agent ID · Azure ML · 7 modules · 45 lessons

M10 The Azure AI footprint and shared responsibility 6 lessons · open from day one

Azure in plain English, the map of Microsoft Foundry and Azure AI services, shared responsibility, Foundry RBAC and Azure Policy to allow-list models, Foundry keys, and cost safety against LLMjacking.

  1. 10.0 Basics: Azure in 10 minutes ~13 min
  2. 10.1 Map of Azure AI ~7 min
  3. 10.2 Shared responsibility: what's yours to secure ~10 min
  4. 10.3 Identity for AI: Foundry RBAC and Azure Policy ~7 min
  5. 10.4 Foundry keys: why they bypass RBAC ~7 min
  6. 10.5 Cost safety and LLMjacking on Azure ~7 min
M11 Securing Microsoft Foundry models 7 lessons · open from day one

Least privilege, private endpoints, customer-managed keys, logging and data residency for Foundry Models, deployed with Terraform.

  1. 11.0 Basics: Foundry Models vs a public API ~13 min
  2. 11.1 Least privilege per app and model ~7 min
  3. 11.2 Private networking for Foundry ~6 min
  4. 11.3 Customer-managed keys and data handling ~6 min
  5. 11.4 Logging and the prompt-logging gap ~6 min
  6. 11.5 Data residency across deployments ~5 min
  7. 11.6 Lab: deploy TSG Helpdesk on Foundry Azure labCapstone ~40 min
M12 Foundry guardrails and Azure AI Content Safety 6 lessons · open from day one

Every Foundry guardrail control explained (Prompt Shields, Spotlighting, groundedness, protected material, PII, task adherence), enforcing them org-wide, and testing them honestly.

  1. 12.0 Basics: a guardrail is a WAF for prompts ~13 min
  2. 12.1 Every Foundry guardrail control explained ~6 min
  3. 12.2 Content Safety API: guardrails for any model ~6 min
  4. 12.3 Enforcement no one can skip ~6 min
  5. 12.4 Testing and tuning guardrails ~5 min
  6. 12.5 Lab: attack the Helpdesk, measure guardrails Azure labDetection ~35 min
M13 Azure AI Search, Foundry IQ and Foundry Agent Service 4 lessons · open from day one

Secure RAG and agents on Azure: Azure AI Search permission trimming, Foundry IQ, and Foundry Agent Service tools with MCP approval and allow-lists.

  1. 13.0 Basics: your RAG and agent controls in Azure ~14 min
  2. 13.1 Secure RAG on Azure with AI Search ~7 min
  3. 13.2 Foundry Agent Service: securing tools and MCP ~8 min
  4. 13.3 Lab: port the RAG agent to Foundry Azure lab ~40 min
M14 Foundry hosted agents and Microsoft Entra Agent ID (attack and defend) 9 lessons · open from day one

Foundry Agent Service end to end: hosted agents, Entra Agent ID, Toolbox and AI gateway, tool-call controls, memory and sandboxes, tracing and red teaming, attacked and defended.

  1. 14.0 Basics: Foundry hosted agents vs self-run ~15 min
  2. 14.1 What the Foundry agent platform is ~5 min
  3. 14.2 Runtime: sandboxes, identity, VNet ~6 min
  4. 14.3 Identity: Entra Agent ID for agents ~7 min
  5. 14.4 Tool gateway: Toolbox and MCP auth ~6 min
  6. 14.5 Deterministic controls on tool calls ~5 min
  7. 14.6 Fencing the risky agent powers ~6 min
  8. 14.7 Observability and red teaming agents ~5 min
  9. 14.8 Lab: deploy a Foundry agent, then hijack it Azure labCapstoneDetection ~45 min
M15 Azure Machine Learning security (self-hosted and open models) 6 lessons · open from day one

When teams self-host on Azure Machine Learning, and how to lock it down: managed VNet, private endpoints, model allow-lists, model scanning and monitoring.

  1. 15.0 Basics: self-hosting vs Azure ML vs Foundry ~14 min
  2. 15.1 When teams choose Azure ML over Foundry ~6 min
  3. 15.2 Network isolation for Azure ML ~6 min
  4. 15.3 Endpoints, model catalog and allow-lists ~6 min
  5. 15.4 Watching models in production ~6 min
  6. 15.5 Lab: a private endpoint for an open model Azure lab ~40 min
M16 Detection and response for AI on Azure 7 lessons · open from day one

Detection and response for AI on Azure: what to log, Defender for Cloud AI threat protection, AI security posture, KQL hunting and incident playbooks.

  1. 16.0 Basics: logs, alerts and incidents ~13 min
  2. 16.1 What to log for AI on Azure ~6 min
  3. 16.2 Defender for Cloud AI threat protection ~7 min
  4. 16.3 AI security posture and inventory ~6 min
  5. 16.4 Azure Policy, KQL hunting and Sentinel rules ~6 min
  6. 16.5 Incident playbooks for AI on Azure ~8 min
  7. 16.6 Lab: build detections and catch the attack Azure labCapstone ~35 min

Google Cloud stream

Agent Platform · Model Armor · SCC · 7 modules · 45 lessons

M10 The Google Cloud AI footprint and shared responsibility 6 lessons · open from day one

Google Cloud in plain English, the map of Gemini Enterprise Agent Platform (formerly Vertex AI), shared responsibility, IAM and Organization Policy to allow-list models, API keys and cost safety against LLMjacking.

  1. 10.0 Basics: Google Cloud in 10 minutes ~11 min
  2. 10.1 Map of Google Cloud AI: Gemini Enterprise Agent Platform (formerly Vertex AI), Model Garden, ADK, Agent Runtime, RAG Engine, Agent Search, Agent Identity and Gateway, Model Armor, SCC AI Protection ~6 min
  3. 10.2 Shared responsibility: what's yours to secure ~6 min
  4. 10.3 IAM for AI and allow-listing models ~10 min
  5. 10.4 API keys on Google Cloud ~7 min
  6. 10.5 Cost safety and LLMjacking ~7 min
M11 Securing Gemini on Agent Platform 7 lessons · open from day one

Least privilege, Private Service Connect, VPC Service Controls, CMEK, logging and data residency for Gemini and partner models on Agent Platform, deployed with Terraform.

  1. 11.0 Basics: Gemini API vs Gemini on Agent Platform ~13 min
  2. 11.1 Least privilege per app and per model ~7 min
  3. 11.2 Private networking for Gemini ~7 min
  4. 11.3 Encryption with CMEK ~6 min
  5. 11.4 Logging and its gaps ~6 min
  6. 11.5 Data residency: regional vs global endpoints ~6 min
  7. 11.6 Lab: deploy TSG Helpdesk with Terraform Google Cloud labCapstone ~40 min
M12 Model Armor and Gemini safety filters 6 lessons · open from day one

Every Model Armor filter explained, floor settings that enforce it org-wide, using it for any model, and testing it honestly: one layer, not the whole wall.

  1. 12.0 Basics: what a guardrail is ~12 min
  2. 12.1 Every Model Armor filter explained ~7 min
  3. 12.2 Model Armor for any model ~6 min
  4. 12.3 Enforcement no one can skip ~6 min
  5. 12.4 Testing and tuning Model Armor ~6 min
  6. 12.5 Lab: attack the Helpdesk with Model Armor Google Cloud labDetection ~35 min
M13 RAG Engine, Agent Search and ADK agents 4 lessons · open from day one

Secure RAG and agents on Google Cloud: Agent Search document ACLs, RAG Engine controls, and ADK agents with guardrail callbacks and confirmation.

  1. 13.0 Basics: which controls survive managed RAG ~13 min
  2. 13.1 Secure RAG on Google Cloud ~7 min
  3. 13.2 Agents with ADK: auth and guardrails ~7 min
  4. 13.3 Lab: port the RAG agent to Google Cloud Google Cloud lab ~40 min
M14 Agent Runtime, Agent Identity and Agent Gateway (attack and defend) 9 lessons · open from day one

Agent Platform agents end to end: Agent Runtime, Agent Identity, Agent Gateway, IAM and semantic governance policies, Memory Bank and sandboxes, attacked and defended.

  1. 14.0 Basics: Agent Runtime vs self-run ~14 min
  2. 14.1 What the agent platform is ~6 min
  3. 14.2 Runtime: VPC Service Controls and egress ~6 min
  4. 14.3 Identity: SPIFFE-based Agent Identity ~6 min
  5. 14.4 Agent Gateway: ingress and egress ~6 min
  6. 14.5 Policy: IAM rules vs semantic governance ~6 min
  7. 14.6 Fencing the risky agent powers ~6 min
  8. 14.7 Observability and agent evaluation ~5 min
  9. 14.8 Lab: deploy on Agent Runtime, then hijack it Google Cloud labCapstoneDetection ~45 min
M15 Self-hosted and open models on Agent Platform 6 lessons · open from day one

When teams self-deploy open models on Agent Platform, and how to lock it down: private endpoints, Workbench constraints, Model Garden checks, registry and monitoring.

  1. 15.0 Basics: self-hosting vs Agent Platform vs Gemini ~13 min
  2. 15.1 When teams self-deploy open models ~6 min
  3. 15.2 Network isolation and hardening ~6 min
  4. 15.3 Endpoints, Model Garden and allow-lists ~6 min
  5. 15.4 Watching models in production ~6 min
  6. 15.5 Lab: a private endpoint for an open model Google Cloud lab ~40 min
M16 Detection and response for AI on Google Cloud 7 lessons · open from day one

Detection and response for AI on Google Cloud: what to log, Security Command Center AI Protection, AI inventory, hunting with Cloud Logging and Google SecOps, and incident playbooks.

  1. 16.0 Basics: logs, alerts and incidents ~12 min
  2. 16.1 What to log for AI on Google Cloud ~6 min
  3. 16.2 AI Protection in Security Command Center ~7 min
  4. 16.3 AI inventory and posture ~7 min
  5. 16.4 Org policies and threat hunting ~6 min
  6. 16.5 Incident playbooks for AI ~7 min
  7. 16.6 Lab: build detections and catch the attack Google Cloud labCapstone ~35 min

Part 4

Prove it

M17 Red teaming and security evals 5 lessons · open from day one

A repeatable AI red-team method, the main open-source tools, and security evals that fail the build on a regression.

  1. 17.0 Basics: tests, red teams, evals, benchmarks ~31 min
  2. 17.1 A repeatable AI red-team method ~12 min
  3. 17.2 Tools: garak, PyRIT, promptfoo ~13 min
  4. 17.3 Security evals in CI/CD ~13 min
  5. 17.4 Lab: promptfoo in GitHub Actions Local lab ~30 min
M18 Governance that engineers can use 5 lessons · open from day one

NIST AI RMF, ISO/IEC 42001 and the EU AI Act (2026 dates) for builders, ready-to-use policy, inventory, vendor and incident templates, and a lab that turns a risk assessment into a verifiable evidence pack.

  1. 18.0 Basics: governance, risk and compliance ~24 min
  2. 18.1 NIST AI RMF + GenAI profile in one lesson ~14 min
  3. 18.2 ISO 42001 and the EU AI Act for builders ~18 min
  4. 18.3 Templates: policy, inventory, risk, incident ~13 min
  5. 18.4 Lab: AI risk assessment and evidence pack Local lab ~75 min
M19 Capstone and career 6 lessons · open from day one

The graded capstone: secure the full TSG Helpdesk (RAG, agent tools and an MCP server) on your laptop against a published rubric and self-check, then turn it into three public portfolio projects, a crosswalk to real roles and exam guides, and interview stories.

  1. 19.1 Capstone: the brief and rubric Capstone ~23 min
  2. 19.2 Capstone walkthrough 1: threat model, attack, fix and prove it in CI Capstone ~7 min
  3. 19.3 Capstone walkthrough 2: detect, review the cloud, write the governance note and submit Capstone ~7 min
  4. 19.4 Portfolio: your labs as 3 public projects ~11 min
  5. 19.5 Roles and skills: moving into AI security ~7 min
  6. 19.6 Interviews and your certificate on LinkedIn ~11 min

Part 5

Advanced track (for engineers who want to go deep)

M20 Agent identity and delegated authorization 7 lessons · open from day one

Agents as non-human identities: OAuth token exchange, on-behalf-of chains, transaction tokens and workload identity.

  1. 20.0 Basics: OAuth in plain English ~22 min
  2. 20.1 Agents as non-human identities ~12 min
  3. 20.2 OAuth for agents: token exchange ~12 min
  4. 20.3 Transaction tokens and permission creep ~6 min
  5. 20.4 Workload identity for agents ~11 min
  6. 20.5 Lab: one identity per agent on AgentCore Local labAWS lab ~30 min
  7. 20.6 Lab: Keycloak token exchange, 3-agent chain Local lab ~30 min
M21 Deterministic authorization for tool calls 6 lessons · open from day one

Move the security decision outside the model: Cedar, AgentCore Policy, OPA and time-based rules on tool calls.

  1. 21.0 Basics: a rule engine vs asking the AI ~22 min
  2. 21.1 Why the decision lives outside the model ~11 min
  3. 21.2 Cedar and AgentCore Policy for tools ~12 min
  4. 21.3 Time-based rules: rate limits and caps ~11 min
  5. 21.4 OPA at MCP gateways and signed receipts ~6 min
  6. 21.5 Lab: authorize refunds on AgentCore Gateway Local labAWS lab ~45 min
M22 Secure-by-architecture agents 5 lessons · open from day one

The lethal trifecta and six design patterns that resist prompt injection, including CaMeL and taint tracking.

  1. 22.1 The lethal trifecta ~24 min
  2. 22.2 Six design patterns that resist prompt injection ~12 min
  3. 22.3 CaMeL: capabilities and data-flow control ~12 min
  4. 22.4 Information-flow control and taint tracking ~7 min
  5. 22.5 Lab: rebuild an email agent as dual-LLM Local lab ~40 min
M23 How attackers use AI, and how to catch it 5 lessons · open from day one

A defender's view of how threat actors use AI today and how to catch it: the trail it leaves in your logs, detections for your own AI app, and measuring against an attacker who adapts.

  1. 23.1 How attackers actually use AI today ~26 min
  2. 23.2 The trail an AI attack leaves in logs ~12 min
  3. 23.3 Detecting attacks on your own AI app ~13 min
  4. 23.4 Measuring detection vs an adaptive attacker ~12 min
  5. 23.5 Lab: investigate an AI attack, write the defense Local lab ~45 min
M24 Containing an attack that spreads between AI agents 5 lessons · open from day one

A defender's view of how one planted instruction propagates across AI-agent hand-offs, and how to contain it: hand-off filtering, scoped tools per agent, a circuit-breaker and detection.

  1. 24.1 How a malicious instruction spreads ~28 min
  2. 24.2 Trust boundaries between agents ~11 min
  3. 24.3 Containment: filters and scoped tools ~12 min
  4. 24.4 Detecting spread, proving containment ~10 min
  5. 24.5 Lab: trace an attack, build the containment Local lab ~45 min
M25 Advanced AI supply chain 6 lessons · open from day one

Marketplace poisoning, backdoored adapters and quantized models, sleeper agents, and model signing with SLSA for ML.

  1. 25.1 Skill, plugin and marketplace poisoning ~28 min
  2. 25.2 Backdoored adapters and quantized models ~12 min
  3. 25.3 Sleeper agents: surviving safety training ~11 min
  4. 25.4 Fine-tuning attacks: undoing safety ~6 min
  5. 25.5 Model signing, SLSA for ML and ML-BOM ~12 min
  6. 25.6 Lab: sign in CI, verify on SageMaker AI AWS lab ~30 min
M26 Inference infrastructure hardening 6 lessons · open from day one

A model server is a web server for an AI brain: real CVEs, side channels, GPU nodes on EKS and confidential computing.

  1. 26.0 Basics: what serving a model means ~31 min
  2. 26.1 Real CVEs in model servers ~11 min
  3. 26.2 Side channels: KV-cache and timing leaks ~11 min
  4. 26.3 GPU nodes on EKS ~11 min
  5. 26.4 Confidential computing for AI ~10 min
  6. 26.5 Lab: lock down a self-hosted vLLM stack Local lab ~30 min
M27 Isolation, egress and computer-use agents 4 lessons · open from day one

Sandboxes for agents, default-deny egress on AWS, Azure and Google Cloud, and the special risks of browser and computer-use agents.

  1. 27.1 Sandboxes for agents ~28 min
  2. 27.2 Egress control for agents and model endpoints ~11 min
  3. 27.3 Browser and computer-use agents ~11 min
  4. 27.4 Lab: review a sandbox, prove its egress policy AWS lab ~30 min
M28 Privacy engineering for AI 4 lessons · open from day one

Embedding inversion, differential privacy trade-offs, shallow unlearning, and a redaction pipeline for invocation logs.

  1. 28.1 Embedding inversion: vectors are sensitive ~27 min
  2. 28.2 Differential privacy for fine-tuning ~12 min
  3. 28.3 Machine unlearning and why it's shallow ~13 min
  4. 28.4 Lab: a redaction pipeline with Macie AWS lab ~30 min
M29 AI security operations at scale 7 lessons · open from day one

AI security operations across an AWS Organization: shadow AI discovery, LLMjacking honeytokens, scoring AI vulnerabilities and securing AI SOC agents.

  1. 29.1 Shadow AI discovery across an Organization ~33 min
  2. 29.2 AI-SPM and AI detection-and-response ~11 min
  3. 29.3 AI-enabled attackers ~11 min
  4. 29.4 LLMjacking economics and honeytokens ~6 min
  5. 29.5 Scoring AI vulnerabilities ~10 min
  6. 29.6 Securing your own AI SOC agents ~10 min
  7. 29.7 Lab: honeytoken key with alerting AWS lab ~30 min
M30 Security evals as a release gate 3 lessons · open from day one

Security benchmarks that matter, a per-release security score card, and CI that fails when injection resistance drops.

  1. 30.1 Benchmarks that matter ~28 min
  2. 30.2 A security score card per release ~12 min
  3. 30.3 Lab: CI gate on injection resistance Local lab ~30 min
M31 Agentic commerce and fraud 3 lessons · open from day one

Agents that pay: x402 and AP2 mandates, injected purchases, deepfake identity attacks and spend caps.

  1. 31.1 Agents that pay: x402 and AP2 mandates ~33 min
  2. 31.2 Deepfakes vs identity checks ~13 min
  3. 31.3 Lab: x402 paywall, injected buy, spend cap Local lab ~30 min
M32 Advanced capstone (graded) 1 lessons · open from day one

The graded advanced capstone: design, attack and defend a multi-agent system, prove the fixes with security evals in CI, and review the cloud deployment on your stream. Graded automatically.

  1. 32.1 Advanced capstone brief and rubric Capstone ~40 min

Part 6

Future watch (updated every quarter)

Part 6 Future watch (updated every quarter) 6 lessons · open from day one

Each quarter: four short videos (standards and the regulatory clock, threats and research, the three clouds, the bets scorecard), an updated lab if needed, and a changelog entry. Free updates for every student.

  1. F.1 Standards tracker ~24 min
  2. F.2 Regulatory clock ~14 min
  3. F.3 Threat intel digest ~12 min
  4. F.4 Research radar: attacks and defenses ~7 min
  5. F.5 Cloud platform delta: AWS, Azure, Google Cloud ~12 min
  6. F.6 Bets scorecard ~12 min

One price. Every module, every update.

Launch price $199 (regular $299). Final price: nothing is added at checkout. Prices are shown in your local currency: rupees in India, US dollars everywhere else.

Enroll at the launch price Back to the course page

AI Security Engineer

Move into AI security from the role you have

280+ videos, 33 modules, labs on AWS, Azure and Google Cloud, a graded capstone and a certificate.

$199regular price $299 launch price, one payment. Final price: nothing is added at checkout.

Enroll today See the full curriculum

AI Security Engineer

Enroll in the full course

A practical, applied AI security course. Every module, lab, quiz, handbook and the graded capstone open the day you join.

  • 280+videos
  • 33modules
  • 3clouds included
  • 280+ videos, plus every reading page and lab across all 6 parts
  • Local and cloud lab solutions for AWS, Azure and Google Cloud
  • Downloadable slide deck (PDF) for every module
  • Graded capstone and certificate
  • Every future update, including the quarterly future-watch

$199regular price $299

Launch price until Nov 30, 2026One-time payment. No subscription. Final price: nothing is added at checkout.

You pay $199 USDUS dollars, paid by card. Final price: nothing is added at checkout.

You pay on Razorpay's secure payment page. We never see your card or bank details. One-time payment, no subscription.

  • Paid on Razorpay's secure page: Card, in US dollars
  • Refund policy

See the full curriculumTry a free lesson first