AI Security Engineer

Set up your tooling and AWS access, and preview the AI security skills and the Bedrock capstone project ahead of you.

Learn how classic threat modeling adapts to machine learning, and use STRIDE-ML to name specific threats against each part of an AI system.

Build a structured threat model for a Bedrock RAG architecture, ranking threats by likelihood and impact to pick the control that ships first.

Track pre-trained models and datasets as supply chain dependencies, and see what an ML-BOM records so you can scope a vulnerability fast.

Create an ML-BOM for a RAG system, documenting both the embedding and generation models plus the provenance gaps a managed API leaves behind.

Examine why an inference endpoint is a security boundary of its own, and the layered controls that protect a model from theft and abuse.

Audit a Bedrock client configuration for hardcoded credentials, missing input validation, and absent logging, then scope its IAM policy correctly.

Discover why AI systems fail behaviorally while infrastructure stays healthy, and which signals reveal drift, hallucination, and active attacks.

Configure model invocation logging, then write a monitoring plan and an incident response playbook for an AI-specific event.

Study how prompt injection works, including payloads hidden in retrieved documents, and where denylists and allowlists each fall short.

Design and test Bedrock Guardrails that block injection attempts on the way in and catch sensitive data on the way out.

Classify documents by sensitivity and configure PII detection so a knowledge base carries only what the assistant actually needs.

Write least-privilege policies and an organization-level SCP, then interpret IAM Access Analyzer findings for Bedrock resources.

Assess agent tools by the damage they can do, and see why a human approval step belongs in system architecture rather than in a prompt.

Right-size the IAM roles behind a RAG agent, replacing wildcards with scoped ARNs and measuring the blast radius you remove.

Trace what a complete provenance record contains, and how poisoned documents reach a knowledge base and stay hidden inside it.

Investigate a poisoned knowledge base, walking a provenance trail backward from a bad response to the upload event that caused it.

Compare fixed and sliding window rate limiting, and see why unbounded cost threatens an inference API as much as downtime does.

Implement a sliding window rate limiter, analyze usage logs for abuse patterns, and set a limit you can defend from expected traffic.

Read an IAM policy for a cloud AI service and identify the wildcard patterns that hand an attacker administrative control.

Get oriented: what offensive AI security covers, the seven attack families you will run yourself, and the dual-system red team engagement you deliver as the capstone.

Learn why AI red teaming targets model behavior rather than code, walk the three-stage lifecycle, and leave able to scope an engagement and write a charter developers can act on.

Use an LLM to surface attack vectors from real system documentation, then turn the ones evidence supports into a red team charter with scope, rules of engagement, and success criteria.

See how attackers fool an image classifier with changes too small to notice, with and without model access, and why a high score on clean test data proves nothing about robustness.

Build black-box and white-box attacks against a real classifier with ART, measure both with adversarial accuracy and perturbation size, and turn those numbers into a risk assessment.

Learn how flipping labels or planting a trigger corrupts a model at training time, and why a backdoored model passes every accuracy check you would normally run before shipping.

Train a clean baseline, poison it with label flips and a backdoor trigger, measure what each attack costs the model, and find which defender-side check actually catches which attack.

Learn why one sentence of user text can override an application's rules: how a model reads system versus user prompts, and the three techniques attackers reach for once filters go up.

Build a prompt injection payload suite, run it across models and system prompt configurations, score each compromise, and test whether a prompt-level defense moves the number at all.

Follow how RAG turns documents into embeddings and ranks them by meaning, then how an attacker hijacks that ranking to control what the model tells every user who asks a matching question.

Stand up a RAG pipeline with live embeddings, plant poisoned documents tuned to real questions, measure the ranking shift they cause, and test whether provenance filtering stops them.

Learn how a model's own confidence scores let an attacker rebuild the data it trained on, why overfitting makes it worse, and how much detail an inference API should ever return.

Reconstruct a face from a classifier's confidence outputs alone, then switch sides and measure how far leakage drops across full probabilities, rounded scores, and a bare label.

Treat robustness as a number you can benchmark the way you benchmark accuracy: the metrics that measure it, the frameworks that automate it, and how to gate a release on it.

Build an automated attack suite that scores a model under clean, environmental, and adversarial conditions, then compare two variants and judge which one clears a release gate.

Map the stack you inherit — model weights, frameworks, libraries, base images, cloud — and see how a flaw four layers deep in a package you never named runs with your credentials.

Scan AI container images with Trivy, parse the report and SBOM into structured findings, and build a priority score ranked by real exposure, where a MEDIUM can rightly outrank a HIGH.

Get oriented before you start: why LLM and agent systems break the habits of traditional security work, how the course pairs every attack with the defense that answers it, what you should already know, and how the browser-based labs work.

See why the attack surface of a language model is the conversation rather than the code, and how jailbreaking, task hijacking, and token smuggling turn a model's helpfulness into a way past its system prompt.

Run an escalating jailbreak chain against a retail assistant, judge each of five attack techniques as a success or a block, and record what its system prompt actually constrained.

Work through the OWASP Top 10 for LLMs as a shared vocabulary for AI risk, and see why the model is one more piece of your attack surface rather than a replacement for network and access controls.

Probe a healthcare assistant for prompt injection, sensitive information disclosure, and excessive agency, then turn what comes back into a finding report with evidence, a justified severity, and a recommended fix.

Learn where indirect prompt injection comes from: payloads that wait inside the documents, web pages, and connectors your model reads to do its job, reaching it without an attacker ever touching your application.

Plant a hidden instruction in a webpage, watch a news summarizer carry it into its output, and identify which articles in a feed were poisoned from the evidence in the summaries alone.

See why a provider's safety layer knows nothing about your operational risks, where the firewall analogy breaks down for language models, and how layered guardrails sit around a hardened system prompt.

Harden a finance assistant's system prompt one rule at a time, then re-run the attacks to see exactly which rule closes which door without breaking ordinary customer questions.

Follow how RAG moves the primary attack surface from the user's prompt to the document store, and what data poisoning, over-permissive retrieval, and pipeline defenses look like in practice.

Watch a legal research assistant cite a precedent that never existed, test whether a guard prompt is enough to stop it, and decide what retrieval-time controls you would ship instead.

Examine why agent-to-agent handoffs are not microservice calls: text is the protocol and text can be argued with, so segregation of duties and secure communication have to be designed in.

Write role cards for a planner, a coder, and a reviewer, then build the validation function that enforces them so legitimate pipeline traffic passes and adversarial messages are blocked with an auditable reason.

Close the black box: why a successful API call can be the attack, what chain-of-thought logging has to capture, and how incident response playbooks change when the system acts at machine speed.

Instrument a booking agent with structured JSON Lines logging that captures enough to reconstruct any run, then execute a containment plan against it.

Work out where humans belong in an autonomous workflow: the speed gap between agent action and human detection, risk gates set by consequence rather than by task, and the oversight patterns that survive real use.

Build a deterministic risk gate that routes a procurement agent's purchase orders to approval, human review, or an outright block, with the reason attached to every decision.

Understand what changes when a model gets tools and write access, and how an unauthorized action rides along inside legitimate work while every dashboard stays green.

Send poisoned tickets through a support agent that reads and acts on a CRM, then write the classifier prompt that separates a customer describing a problem from a payload instructing the system.

See how unified reasoning across text, vision, and audio lets an instruction hidden in one modality steer the output of another, and why passive-data assumptions about images no longer hold.

Hide an instruction in a receipt image that a human reviewer cannot see, run it through an expense agent, and then make the tampering visible once it has landed.

Write instruction guardrails that hold: identity, scope, and behavioral constraints stated as prohibitions the model cannot read as optional, plus the tests that show whether they work.

Add three named rules to a tutoring assistant's system prompt so it stops completing student work, then test that legitimate questions still get answered.

Address the fact underneath every attack in this course: natural language cannot separate the control plane from the data plane, and XML-style tags create boundaries that prose instructions cannot.

Rebuild a moderation assistant's flat prompt template into tagged blocks that keep policy and user content apart, and test the result against embedded-instruction and format-mimicry attacks.

Preview the shift from building AI systems to governing them, confirm the Python and spreadsheet prerequisites, and tour the browser-based workspaces where every exercise runs.

Learn how explainable AI (XAI) and SHAP enable security auditors to detect bias, assess model risk, and create defensible audit findings for black-box models.

Audit AI for security using SHAP: investigate model decisions, detect proxy biases, perform counterfactuals, and draft clear audit memos for stakeholders.

Learn to implement the NIST AI Risk Management Framework's Govern, Map, Measure, Manage loop to identify, track, and mitigate AI-specific risks in dynamic environments.

Apply the NIST AI Risk Management Framework to assess, score, and visualize AI risks, build risk registers, and create executive reports for responsible AI deployment.

Learn how to use MITRE ATLAS to identify adversary tactics against AI systems, assess techniques like data poisoning and prompt injection, and anticipate threats that traditional security tools miss.

Build an AI threat model with MITRE ATLAS: map attack surfaces, score technique likelihood and impact, and prioritize mitigations for a production ML pipeline.

Learn how the EU AI Act's risk-based tiers classify AI systems, and identify the data governance, transparency, human oversight, and robustness duties that attach to high-risk deployments.

Apply the EU AI Act to classify AI systems by risk tier, build a compliance matrix, map obligations to controls, and produce an auditable compliance plan.

Learn how an AI Acceptable Use Policy fits the wider policy stack, and identify the approved-tool lists, data classification rules, and prohibitions that make a policy enforceable.

Draft an enforceable AI Acceptable Use Policy: define prohibited uses, map policy clauses to technical controls, and design an exception procedure with clear approval authority.

Understand unique AI incident types, detection strategies, response frameworks, severity levels, blameless learning, and emerging regulatory requirements for effective AI incident management.

Build an AI incident response playbook: classify incident severity, implement automated detection against metric baselines, and define escalation paths for AI-specific failure modes.

Learn what separates a genuine key risk indicator from a vanity metric, and how to select, band, and threshold AI security KRIs for executive dashboards.

Build an AI security KRI dashboard in code: compute refusal-rate and fairness indicators, apply green-amber-red bands, and surface portfolio-level risk for governance review.

Learn to identify, categorize, and mitigate the unique risks of third-party AI vendors, including data, bias, drift, lock-in, and security with robust governance and contracts.

Assess third-party AI vendors: score risk across weighted criteria, evaluate SLA compliance, tier vendors by exposure, and produce evidence-backed procurement recommendations.

Learn how a model card documents security posture, what belongs in its Security Considerations section, and how it anchors a transparency stack that regulators can audit.

Author a security-focused model card: document adversarial vulnerabilities and subgroup performance, then crosswalk each section to EU AI Act Article 11 technical documentation duties.

Learn to audit AI for disparate outcomes using core fairness metrics, understand why they cannot all be satisfied at once, and govern fairness across the model lifecycle.

Run a fairness audit end to end: measure subgroup disparities, test threshold adjustments against a policy card, and defend a launch, hold, or remediate decision.

Explore AI's data retention paradox, deletion challenges post-training, regulatory conflicts, key data types, and privacy-preserving techniques for responsible AI governance.

Build an AI data retention and deletion pipeline: apply retention schedules, select deletion methods under legal holds, and trace deletion impact through model lineage.

Learn what distinguishes a governance operating model from a framework: decision rights, an AI Review Board charter, RACI accountability, and the failure modes that break most designs.

Design an AI governance operating model: draft a review board charter, assign RACI accountability, set reporting cadences, and stress-test the design against common failure modes.