The full curriculum

Where you fit in AI security, whatever your role, plus a safe lab setup on your laptop and a safe AWS learning account.

1. 0.1 What you'll be able to do after this course Free ~5 min
2. 0.2 It's OK not to know this yet Free ~5 min
3. 0.3 Your role → AI security: the map Free ~36 min
4. 0.4 Your first win in 15 minutes Free ~5 min
5. 0.5 How to study this course: 30 minutes a day, the 90-day reels as daily practice, how to ask for help Free ~5 min
6. 0.6 Lab setup in 20 minutes: Docker, Python, Ollama, first local model (Mac / Windows / Linux) Local lab ~30 min
7. 0.7 A safe AWS learning account: MFA, no root use, IAM Identity Center, budgets + alerts, the $200 credits, region choice AWS lab ~30 min
8. 0.8 Rules of engagement: test only what you own or are allowed to test ~9 min

What a large language model really does (it guesses the next word), and the parts that matter for security: tokens, prompts, embeddings, where models run.

1. 1.0 Basics: normal software vs AI. A program follows your rules; an AI guesses the next word. Why that changes security (analogy: a calculator vs a well-read intern) Free ~5 min
2. 1.1 Next-word prediction, tokens and the context window Free ~5 min
3. 1.2 Sampling and temperature: why AI isn't deterministic, and why that breaks testing ~9 min
4. 1.3 System prompts, roles, chat templates, tool calling ~9 min
5. 1.4 Embeddings and vector search in plain English ~9 min
6. 1.5 Traditional ML vs LLMs: classifiers, training data, and why the old ML attacks still matter ~9 min
7. 1.6 Fine-tuning vs RAG vs agents: which one you're actually securing ~9 min
8. 1.7 Where models run: API, managed cloud, self-hosted. Shared responsibility ~9 min
9. 1.8 Lab: run a model locally, count tokens, call it through the OpenAI-compatible API, watch the context window fill Local lab ~30 min

Why AI systems can't reliably tell data from instructions, the threat maps you'll use (OWASP, MITRE ATLAS, AWS scoping matrices), and your first threat model.

1. 2.1 The core flaw: models can't reliably tell data from instructions Free ~5 min
2. 2.2 The maps: OWASP Top 10 for LLM Apps 2025, OWASP Top 10 for Agentic Apps 2026, OWASP ML Top 10, MITRE ATLAS, NIST AI 100-2, Google SAIF ~9 min
3. 2.3 AWS Generative AI Security Scoping Matrix + Agentic AI Security Scoping Matrix: which scope are you in? ~9 min
4. 2.4 Trust boundaries: input, model, tools, output, data, memory, identity ~9 min
5. 2.5 Lab: threat-model TSG Helpdesk, the course's deliberately vulnerable AI app (chat + RAG + agent + MCP), used all the way to the capstone Local labCapstone ~30 min

Direct and indirect prompt injection, jailbreaks, hidden payloads and exfiltration, then layered defences proven with automated tests.

1. 3.0 Basics: what "injection" means, from SQL injection to prompt injection (analogy: a forged note in the intern's inbox) ~9 min
2. 3.1 Direct prompt injection: why "ignore previous instructions" still works Free ~5 min
3. 3.2 Jailbreaks vs prompt injection: different attack, different control ~9 min
4. 3.3 Jailbreak techniques you'll meet: role-play, many-shot, multi-turn (crescendo), token smuggling and encodings ~9 min
5. 3.4 Indirect injection: web pages, emails, PDFs, tickets, code comments, tool outputs ~9 min
6. 3.5 Hidden and multimodal payloads: invisible Unicode, white text, images, documents ~9 min
7. 3.6 Exfiltration channels: markdown images, links, tool calls ~9 min
8. 3.7 System prompt leakage, and what must never be in a prompt ~9 min
9. 3.8 Defences in layers: separating data from instructions (spotlighting), privilege separation, dual-LLM pattern, egress control, human approval, canary tokens, multi-turn monitoring ~9 min
10. 3.9 Labs: break TSG Helpdesk 6 ways → fix → prove the fix with automated tests Local labCapstoneDetection ~30 min

What leaks from AI apps and how: PII in prompts and logs, data poisoning, privacy attacks, and shadow AI.

1. 4.1 Sensitive information disclosure: what leaks and how ~9 min
2. 4.2 PII in prompts, logs and training data: redaction and retention ~9 min
3. 4.3 Data poisoning and backdoors (trojaned models) in plain English ~9 min
4. 4.4 Privacy attacks: membership inference and model inversion (intuition, no maths) + where differential privacy fits ~9 min
5. 4.5 Shadow AI and acceptable use: the business side ~9 min
6. 4.6 Lab: PII detection and redaction in and out; prove nothing sensitive reaches logs Local lab ~30 min

Treat AI output like user input: injection through model output, denial of wallet, model extraction, and auth that never trusts the model.

1. 5.0 Basics for non-developers: how a web app works (browser, server, database) in 5 minutes, and where AI output lands ~9 min
2. 5.1 Improper output handling: AI output into HTML, SQL, shell, code = injection ~9 min
3. 5.2 Unbounded consumption: denial of wallet, rate limits, quotas, token budgets ~9 min
4. 5.3 Model extraction and API abuse: when someone copies your model through its API ~9 min
5. 5.4 AuthN/AuthZ for AI apps: never let the model decide who sees what ~9 min
6. 5.5 Hallucination as a security and legal risk; grounding ~9 min
7. 5.6 Lab: exploit XSS and command injection through model output; fix with encoding, allow-lists, sandboxes Local lab ~30 min

How retrieval-augmented generation works end to end, and how it breaks: poisoned documents, cross-tenant leaks and vector database exposure.

1. 6.0 Basics: search engine vs RAG (analogy: an open-book exam) ~9 min
2. 6.1 How RAG works end to end, and where it breaks Free ~5 min
3. 6.2 Ingestion: poisoned and hidden-instruction documents ~9 min
4. 6.3 Access control in retrieval: per-user, per-tenant, metadata filtering ~9 min
5. 6.4 Vector database hardening: auth, network, encryption, multi-tenancy ~9 min
6. 6.5 Embedding leakage and inversion: what vectors can reveal ~9 min
7. 6.6 Grounding, citations, and refusing when context is missing ~9 min
8. 6.7 Lab: local RAG (Ollama + Chroma/Qdrant), poison it, leak another tenant's data, fix all three Local labCapstone ~30 min

Agents are a model with tools, a loop and memory. Excessive agency, goal hijack, agent identity, sandboxing and kill switches.

1. 7.0 Basics: chatbot vs workflow automation vs agent (info desk vs vending machine vs personal assistant) ~9 min
2. 7.1 Agents = model + tools + loop + memory. Why that changes everything Free ~5 min
3. 7.2 Excessive agency: too many tools, permissions, autonomy ~9 min
4. 7.3 Goal hijack and tool misuse (OWASP ASI01–02) ~9 min
5. 7.4 Identity and privilege for agents: own identity, short-lived and scoped credentials (ASI03) ~9 min
6. 7.5 Unexpected code execution and sandboxing (ASI05) ~9 min
7. 7.6 Memory and context poisoning (ASI06) ~9 min
8. 7.7 Multi-agent systems: inter-agent trust, cascading failures (ASI07–08) ~9 min
9. 7.8 Human-in-the-loop that people actually read; kill switches; rogue agents (ASI09–10) ~9 min
10. 7.9 Lab: a vulnerable agent with shell, files and email tools → hijack it → contain it Local labCapstoneDetection ~30 min

API vs MCP explained simply, then tool poisoning, confused deputies, MCP authorization done right, and scanning servers before you plug them in.

1. 8.0 Basics: API vs MCP, side by side. A restaurant menu vs a universal USB-C port where the AI reads the menu itself. Same request done both ways, and what changes for security Free ~5 min
2. 8.1 MCP in one picture: hosts, clients, servers, tools, resources, transports Free ~5 min
3. 8.2 Tool poisoning, rug pulls, tool shadowing ~9 min
4. 8.3 Confused deputy and token passthrough ~9 min
5. 8.4 MCP authorization done right: OAuth 2.1, PKCE, resource indicators, audience checks ~9 min
6. 8.5 Reviewing and scanning MCP servers (and agent skills) before you plug them in ~9 min
7. 8.6 Labs: a malicious MCP server vs a local agent → scan it → build a secure MCP server with real auth Local labCapstone ~30 min

Models are code plus data: safe use of Hugging Face, malicious model files, signing and pinning, AI-BOMs, and the risks of AI coding assistants.

1. 9.0 Basics: packages vs models. A model file is code + data (analogy: an ingredient jar that can be tampered with) ~9 min
2. 9.1 Hugging Face safely: model cards, licences, trust signals, Hub scanning ~9 min
3. 9.2 Malicious models: pickle code execution vs safetensors; model scanning ~9 min
4. 9.3 Model artefact tampering and deployment integrity: pin, hash, sign ~9 min
5. 9.4 AI-BOM: inventory of models, datasets, packages, prompts, MCP servers ~9 min
6. 9.5 Self-hosted guardrail models (Llama Guard / Prompt Guard / LlamaFirewall, NeMo Guardrails, LLM Guard) and their limits ~9 min
7. 9.6 AI coding assistants for developers and vibe coders ~9 min
8. 9.7 Lab: safely detonate a booby-trapped model in a sandbox, catch it with a scanner, pin and verify artefacts Local lab ~30 min

AWS in plain English, the map of AWS AI services, shared responsibility, IAM and SCPs for models, Bedrock API keys and LLMjacking cost safety.

1. 10.0 Basics for non-cloud folks: AWS in 10 minutes (accounts, IAM, VPC, KMS, CloudTrail) with everyday analogies (office building, staff badges, private corridors, safes, CCTV) ~9 min
2. 10.1 Map of AWS AI: Bedrock, Guardrails, Knowledge Bases, Bedrock Agents, AgentCore, SageMaker AI Free ~5 min
3. 10.2 Shared responsibility for each: what's yours to secure ~9 min
4. 10.3 IAM for AI: actions, resources, condition keys; SCPs that allow-list models (the old model-access page is gone) ~9 min
5. 10.4 Bedrock API keys ~9 min
6. 10.5 Cost safety: quotas, budgets, anomaly detection. LLMjacking: stolen keys used to run up your bill ~9 min

Least privilege, private networking, KMS, invocation logging and cross-Region inference for Amazon Bedrock, deployed with Terraform.

1. 11.0 Basics: calling a model API on the internet vs Amazon Bedrock inside your AWS account. What you gain and what's still yours ~9 min
2. 11.1 Least privilege per app and per model; Marketplace model subscriptions ~9 min
3. 11.2 Private networking: VPC endpoints + custom endpoint policies (the default allows everything) ~9 min
4. 11.3 Encryption with KMS; data handling ("not used to train models", and what that means) ~9 min
5. 11.4 Invocation logging + CloudTrail: what's captured, where, privacy trade-offs, and the gaps (e.g. the OpenAI-compatible endpoint) ~9 min
6. 11.5 Cross-Region and global inference: data residency and the SCP gotchas ~9 min
7. 11.6 Lab: deploy TSG Helpdesk on Bedrock with Terraform: private, least privilege, logged, encrypted. make test checks every control AWS labCapstone ~30 min

Every Bedrock Guardrails policy explained, enforcing guardrails org-wide, and testing them honestly: one layer, not the whole wall.

1. 12.1 Every policy explained: content filters, prompt-attack filter, denied topics, word filters, PII mask/block + regex, contextual grounding, Automated Reasoning; Classic vs Standard tier Free ~5 min
2. 12.2 ApplyGuardrail: guardrails for any model, including self-hosted ones ~9 min
3. 12.3 Enforcement no one can skip: IAM GuardrailIdentifier and organization-wide guardrail policies ~9 min
4. 12.4 Testing and tuning: false positives, bypasses, cost; why guardrails are one layer, not the answer ~9 min
5. 12.5 Lab: attack the Helpdesk with and without guardrails; measure with an automated suite (local twin: NeMo Guardrails / LLM Guard) AWS labDetection ~30 min

Secure RAG and agents on AWS: Knowledge Base permissions, per-user filters, action groups and return of control.

1. 13.1 Secure RAG on AWS: data sources, S3 permissions, per-user metadata filters, encryption ~9 min
2. 13.2 Bedrock Agents: action groups, Lambda least privilege, user confirmation / return of control against indirect injection ~9 min
3. 13.3 Lab: port the local RAG + agent to Bedrock without losing a single control AWS lab ~30 min

Amazon Bedrock AgentCore end to end: Runtime, Identity, Gateway, Policy, Memory and Observability, attacked and defended.

1. 14.0 Basics: running an agent on Lambda/ECS yourself vs AgentCore. Which security jobs AWS takes over ~9 min
2. 14.1 What AgentCore is: Runtime, Memory, Gateway, Identity, Code Interpreter, Browser, Observability, Policy, Evaluations Free ~5 min
3. 14.2 Runtime: session isolation, private networking ~9 min
4. 14.3 Identity: inbound JWT auth, outbound OAuth/API-key credentials for tools, and how they get misused ~9 min
5. 14.4 Gateway: APIs and Lambda as MCP tools; authorizers; MCP auth on AWS ~9 min
6. 14.5 Policy: deterministic rules on tool calls (the control prompt injection can't talk its way past) ~9 min
7. 14.6 Memory, Code Interpreter and Browser: the risky powers and how to fence them ~9 min
8. 14.7 Observability + Evaluations: traces you can investigate, security evals ~9 min
9. 14.8 Lab: deploy the course agent on AgentCore end to end (OAuth in, scoped credentials out, MCP via Gateway, Policy on tools, traced), then try to hijack it AWS labCapstoneDetection ~30 min

When teams choose SageMaker AI, and how to lock it down: network isolation, execution roles, model approvals and monitoring.

1. 15.1 When teams choose SageMaker AI over Bedrock ~9 min
2. 15.2 Network isolation, VPC-only domains, KMS, execution roles ~9 min
3. 15.3 Endpoints, JumpStart models (check licences), Model Registry approvals ~9 min
4. 15.4 Model Monitor and Clarify: watching models in production ~9 min
5. 15.5 Lab (optional, cost warning, auto-teardown): a private endpoint for an open model AWS lab ~30 min

Detection and response for AI on AWS: what to log, GuardDuty AI Protection, Security Hub AI inventory, hunting queries and incident playbooks.

1. 16.0 Basics for non-SOC folks: logs, alerts and incidents in plain English (CCTV, alarms, the fire drill) ~9 min
2. 16.1 What to log for AI: prompts, tool calls, identities. And what not to Free ~5 min
3. 16.2 GuardDuty AI Protection ~9 min
4. 16.3 Security Hub AI inventory ~9 min
5. 16.4 AWS Config rules for Bedrock and AgentCore; CloudTrail and invocation-log hunting queries ~9 min
6. 16.5 Incident playbooks: leaked Bedrock key, jailbroken customer bot, hijacked agent, denial of wallet, poisoned knowledge base ~9 min
7. 16.6 Lab: build the detections, run the attack simulator, catch it, write the incident report AWS labCapstone ~30 min

A repeatable AI red-team method, the main open-source tools, and security evals that fail the build on a regression.

1. 17.1 A repeatable AI red-team method (scope, threat model, test, report) ~9 min
2. 17.2 Tools: garak, PyRIT, promptfoo (what each is best at) ~9 min
3. 17.3 Security evals in CI/CD: fail the build on an injection regression ~9 min
4. 17.4 Lab: promptfoo in GitHub Actions against the Helpdesk Local lab ~30 min

NIST AI RMF, ISO/IEC 42001 and the EU AI Act for builders, plus ready-to-use policy, inventory and incident templates.

1. 18.1 NIST AI RMF + GenAI profile in one lesson ~9 min
2. 18.2 ISO/IEC 42001 and the EU AI Act (2026 dates) for builders ~9 min
3. 18.3 Templates: 1-page AI policy, AI inventory, model/vendor risk review, AI incident report ~9 min

The graded capstone: secure the full TSG Helpdesk locally and on AWS, then turn it into a portfolio and interview stories.

1. 19.1 Capstone (graded) Capstone ~9 min
2. 19.2 Portfolio: turn the capstone into 3 public projects ~9 min
3. 19.3 Interviews and roles: cloud security, SOC, AppSec into AI security. Crosswalk to AWS AIF-C01 (security domain), SCS-C03 AI topics, OWASP, ATLAS, NIST, ISO 42001 ~9 min

Agents as non-human identities: OAuth token exchange, on-behalf-of chains, transaction tokens and workload identity.

1. 20.0 Basics: OAuth in plain English (a hotel key card that opens only your room, only until checkout) and why agents need their own card ~9 min
2. 20.1 Agents as non-human identities: owner, lifecycle, rotation, revocation, attribution ~9 min
3. 20.2 OAuth for agents: token exchange (RFC 8693), on-behalf-of chains, down-scoping at every hop ~9 min
4. 20.3 Transaction tokens and stopping permissions from piling up across agent chains ~9 min
5. 20.4 Workload identity for agents: SPIFFE/SPIRE, mTLS, where IETF WIMSE is heading ~9 min
6. 20.5 Lab: AgentCore Identity, one identity per agent, tagged with the human it acts for, proven in CloudTrail AWS lab ~30 min
7. 20.6 Lab: Keycloak token exchange across a 3-agent chain: watch the scope shrink and a replay get refused Local lab ~30 min

Move the security decision outside the model: Cedar, AgentCore Policy, OPA and time-based rules on tool calls.

1. 21.0 Basics: a rule engine vs asking the AI to behave (a locked till vs a polite sign saying "please don't steal") ~9 min
2. 21.1 Why the security decision must live outside the model ~9 min
3. 21.2 Cedar and AgentCore Policy: allow and deny rules for tools ~9 min
4. 21.3 Time-based rules (rate limits, spend caps) with AWS Dogwood, and what you give up ~9 min
5. 21.4 OPA in front of MCP gateways; signed action receipts and human deferral (AARM pattern) ~9 min
6. 21.5 Lab: block "refund > $100 unless approved" and allow at most 3 refunds an hour on an AgentCore Gateway AWS lab ~30 min

The lethal trifecta and six design patterns that resist prompt injection, including CaMeL and taint tracking.

1. 22.1 The "lethal trifecta": private data + untrusted content + a way out ~9 min
2. 22.2 Six design patterns that resist prompt injection: action-selector, plan-then-execute, map-reduce, dual-LLM, code-then-execute, context-minimization ~9 min
3. 22.3 CaMeL: capabilities and data-flow control (Google DeepMind) ~9 min
4. 22.4 Information-flow control and taint tracking for agents ~9 min
5. 22.5 Lab: rebuild an email agent as dual-LLM + taint-checked sinks; score before/after with AgentDojo Local lab ~30 min

Why static test sets lie: automated jailbreaks (GCG, PAIR, TAP) and attacking guardrails properly.

1. 23.1 "The attacker moves second": why static test sets lie ~9 min
2. 23.2 Automated jailbreaks: GCG (white-box), PAIR and TAP (attacker-LLM loops) ~9 min
3. 23.3 Attacking guardrails and classifiers properly (Bedrock Guardrails, Llama Guard, Prompt Guard) ~9 min
4. 23.4 Activation probes vs classifiers: the new detection frontier ~9 min
5. 23.5 Lab: TAP via PyRIT and promptfoo iterative attacks vs a guardrail config; compare with a static list Local labAWS lab ~30 min

MCP vs A2A, spoofed Agent Cards, sampling abuse, self-spreading prompt infections and memory hygiene.

1. 24.0 Basics: MCP vs A2A. AI-to-tool vs AI-to-AI (using a calculator vs negotiating with another company's assistant) ~9 min
2. 24.1 A2A protocol threat model: spoofed Agent Cards, signing, allow-lists ~9 min
3. 24.2 MCP sampling abuse: when a server prompts your model ~9 min
4. 24.3 Prompt infection and AI worms (Morris II): attacks that copy themselves ~9 min
5. 24.4 Memory persistence attacks and memory hygiene (provenance, TTL, review on write) ~9 min
6. 24.5 Lab: one poisoned document spreads through 3 agents; measure the blast radius, then contain it Local lab ~30 min
7. 24.6 Lab: poison AgentCore Memory, then defend it AWS lab ~30 min

Marketplace poisoning, backdoored adapters and quantized models, sleeper agents, and model signing with SLSA for ML.

1. 25.1 Skill, plugin and agent-marketplace poisoning (real 2026 campaigns) ~9 min
2. 25.2 LoRA adapters, model merges, and quantization-triggered backdoors (GGUF) ~9 min
3. 25.3 Sleeper agents: backdoors that survive safety training ~9 min
4. 25.4 Fine-tuning attacks: undoing safety with a handful of examples ~9 min
5. 25.5 Model signing (OpenSSF model-signing / Sigstore), SLSA for ML, ML-BOM (CycloneDX) ~9 min
6. 25.6 Lab: sign in CI, verify at deploy on SageMaker AI, fail closed; add a pre/post-quantization eval gate AWS lab ~30 min

A model server is a web server for an AI brain: real CVEs, side channels, GPU nodes on EKS and confidential computing.

1. 26.0 Basics: what "serving a model" means. A model server is a web server for an AI brain, with the same old risks ~9 min
2. 26.1 Real CVEs in vLLM, Triton, Ollama and Ray, and the exposed-server problem ~9 min
3. 26.2 Side channels: KV-cache sharing across tenants, packet-size/timing leaks (Whisper Leak) ~9 min
4. 26.3 GPU nodes on EKS: isolation, drivers, images, secrets ~9 min
5. 26.4 Confidential computing for AI: Nitro Enclaves, attestation, GPU TEEs ~9 min
6. 26.5 Lab: scan and lock down a self-hosted vLLM/Ollama stack; isolate the prefix cache per tenant Local lab ~30 min

Sandboxes for agents, egress allow-lists, and the special risks of browser and computer-use agents.

1. 27.1 Sandboxes for agents: Firecracker microVMs, gVisor, AgentCore Code Interpreter ~9 min
2. 27.2 Egress allow-lists and DNS/HTTP exfiltration detection ~9 min
3. 27.3 Browser and computer-use agents: logged-in sessions + hostile pages ~9 min
4. 27.4 Lab: code-running agent in a sandbox with VPC endpoints only; try to exfiltrate and catch it AWS lab ~30 min

Embedding inversion, differential privacy trade-offs, shallow unlearning, and a redaction pipeline for invocation logs.

1. 28.1 Embedding inversion: why vectors are sensitive data ~9 min
2. 28.2 Differential privacy for fine-tuning: real trade-offs ~9 min
3. 28.3 Machine unlearning and why it's often shallow ~9 min
4. 28.4 Lab: invocation logs → Amazon Macie → redaction pipeline, separate KMS keys, retention limits AWS lab ~30 min

AI security operations across an AWS Organization: shadow AI discovery, LLMjacking honeytokens, scoring AI vulnerabilities and securing AI SOC agents.

1. 29.1 Shadow AI discovery across an AWS Organization (CloudTrail Lake, flow logs, secret scanning) ~9 min
2. 29.2 The AI-SPM and AI detection-and-response categories: what they do, how to evaluate vendors ~9 min
3. 29.3 AI-enabled attackers: AI-orchestrated intrusions, self-modifying malware, minute-scale cloud attacks ~9 min
4. 29.4 LLMjacking economics, and honeytoken Bedrock keys ~9 min
5. 29.5 Scoring AI vulnerabilities: CVSS vs OWASP AIVSS; AI bug bounty scoping ~9 min
6. 29.6 Securing your own AI SOC agents (least privilege, poisoned-alert attacks); AWS Security Agent ~9 min
7. 29.7 Lab: honeytoken key + alert on use from an unexpected network; minute-scale automated response AWS lab ~30 min

Security benchmarks that matter, a per-release security score card, and CI that fails when injection resistance drops.

1. 30.1 Benchmarks that matter: AgentDojo, InjecAgent, CyberSecEval, b3 ~9 min
2. 30.2 A security score card per model and per release ~9 min
3. 30.3 Lab: CI fails when an agent's injection resistance drops Local lab ~30 min

Agents that pay: x402 and AP2 mandates, injected purchases, deepfake identity attacks and spend caps.

1. 31.1 Agents that pay: x402, AP2 mandates, Agentic Commerce Protocol; replay and injected purchases ~9 min
2. 31.2 Deepfake voice and video vs identity checks; helpdesk reset runbooks ~9 min
3. 31.3 Lab: testnet x402 paywall + injected "buy" instruction + spend cap Local lab ~30 min

The advanced capstone: design, attack and defend a multi-agent system on AWS, then submit an architecture review and red-team report.

1. 32.1 Advanced capstone brief, rubric and submission Capstone ~20 min

Each quarter: a 15-minute "what changed" video, an updated lab if needed, and a changelog entry. Free updates for every student.

1. F.1 Standards tracker: IETF agent auth, NIST, ISO/IEC, ETSI, CoSAI, OWASP ~15 min
2. F.2 Regulatory clock: EU AI Act dates, UK AI Cyber Security Code, US state laws, India guidelines ~15 min
3. F.3 Threat intel digest: new AI CVEs, marketplace poisoning, LLMjacking trends ~15 min
4. F.4 Research radar: new attacks and defences, and which become labs ~15 min
5. F.5 AWS platform delta: Bedrock, Guardrails, AgentCore, GuardDuty and Security Hub changes ~15 min
6. F.6 2027–2028 bets scorecard, re-scored every quarter ~15 min