AI for Cybersecurity Certification Training Program

Learning Outcomes

• Map AI paradigms to cybersecurity use cases
• Evaluate when AI vs rule-based tools is appropriate
• Benchmark LLMs and compare trade-offs
• Identify hallucinations and unsafe outputs
• Build and justify a basic RAG pipeline
• Distinguish agentic AI workflows from single-shot LLM calls

Topics Covered

• AI paradigm map: Generative vs. Predictive AI vs. Rule-Based Automation — choosing correctly for IDS, SIEM, threat intel
• How LLMs work: tokens, context windows, RLHF, and fine-tuning — intuition-first, practitioner depth
• The constraint triangle: cost-per-inference, latency (p50/p95), output quality — always in operational tension
• RAG vs. fine-tuning vs. prompt engineering — decision flowchart for security applications
• The simpler-solution test: when YARA, Snort, regex, or scripting beats any AI model
• Debugging AI outputs: hallucination patterns, confidence evaluation, unsafe-to-act-on identification
• Agentic AI primer: what makes a system "agentic" (planning, tool use, memory, autonomy) vs. a single prompt-response call — why this distinction matters for risk

Hands-on Lab Activities

• LLM Phishing Triage Comparison: Run 10 pre-provided phishing email samples through GPT-4o and Claude Sonnet independently; score each model on accuracy, false-positive rate, reasoning quality, and hallucination risk; produce a side-by-side comparison table with a 1-paragraph recommendation.
• AI-or-Not Decision Brief: Select one real security workflow (alert triage or CVE scoring); apply the simpler-solution test using a provided checklist; produce a structured 1-page go/no-go decision with cost and latency estimates.

Tools

• ChatGPT (GPT-4o)
• Claude Sonnet
• Jupyter Lab

Learning Outcomes

• Train IDS models using Random Forest/XGBoost
• Deploy ML models via FastAPI and Docker
• Track experiments using MLflow
• Interpret precision, recall, and FP-rate
• Compare supervised vs anomaly detection models

Topics Covered

• Network intrusion detection: CICIDS-2017 anatomy, class imbalance with SMOTE, feature engineering from flow stats
• Supervised models: Random Forest vs. XGBoost — tuning with 3-fold CV (no exhaustive Optuna sweep)
• Isolation Forest for anomaly detection when unsupervised outperforms supervised
• Feature engineering: protocol encoding, inter-arrival timing, packet-length distributions
• UEBA: ML models for insider threat and lateral movement detection
• Model deployment: FastAPI REST endpoint, input validation, output schema, production logging

Hands-on Lab Activities

• IDS Classifier Training: Load a provided 50 k-row CICIDS-2017 sample (pre-cleaned); apply SMOTE for class imbalance; train Random Forest and XGBoost with 3-fold CV; log both experiment runs in MLflow; target ≥90% F1 on the held-out test set.
• FastAPI Model Deployment: Wrap the best MLflow-logged model in a FastAPI application with input validation and an output schema; containerise with Docker; POST 20 synthetic network-flow samples; record p50 inference latency and verify all responses match expected schema.
• Anomaly Detection Comparison: Train an Isolation Forest on the same CICIDS-2017 dataset with no labels; compare its precision, recall, and FPR against the best supervised model from Lab 1; write a 1-page analysis identifying scenarios where the unsupervised approach outperforms supervised.
• IOC Extraction Pipeline: Feed 3 pre-selected threat intelligence PDFs (provided) to an LLM via API; extract structured IOCs (IPs, hashes, domains, CVE IDs); map each IOC to a MITRE ATT&CK tactic; export a validated JSON report and verify it against a provided ground-truth set.

Tools

• scikit-learn
• XGBoost
• MLflow
• FastAPI
• Docker
• OpenCTI

Learning Outcomes

• Train malware classifiers using EMBER dataset
• Fine-tune NLP models for phishing detection
• Debug ML pipelines and fix errors
• Evaluate model performance on real datasets
• Document model limitations and failure scenarios
• Recognize LLM-generated phishing and evaluate detector robustness against it

Topics Covered

• Malware classification: PE static features (entropy, section stats, import hash)
• CNN byte-plot malware detection: binary-to-image conversion
• Metamorphic malware: HMM opcode sequence analysis — conceptual overview and degradation intuition
• Transformer-based phishing detection: fine-tuning DistilBERT on PhishTank + Enron (2k-sample subset)
• ML pipeline debugging: data leakage, label noise, feature scaling, metric mismatch
• Failure mode analysis: communicating model limitations to security stakeholders
• LLM-generated phishing: how generative models change email/SMS phishing at scale — grammar/tone tells disappearing, detector robustness implications

Hands-on Lab Activities

• EMBER PE Classifier: Load a pre-engineered 5 k-sample EMBER subset; train XGBoost; diagnose and fix 2 planted bugs (data leakage + unscaled features); verify the repaired model achieves ≥93% F1 on a held-out test set; log the run in MLflow.
• DistilBERT Phishing Detector: Fine-tune DistilBERT on a provided 2 k-email dataset using a provided training script (~15 min GPU runtime); evaluate on 200 held-out emails; record precision, recall, and FPR; deploy the trained model as a FastAPI endpoint and verify it with 10 sample requests.
• Model Limitations Audit: For both Lab 1 and Lab 2 models, write a structured 1-page limitations brief: 3 failure scenarios per model, evasion risks, and recommended monitoring signals; present findings in a table and a narrative summary.

Tools

• PyTorch
• Hugging Face Transformers
• scikit-learn
• FastAPI
• Jupyter Lab

Learning Outcomes

• Detect voice-cloned audio and deepfake video using classifier and artefact-based methods
• Evaluate liveness detection systems and their bypass techniques
• Design and implement out-of-band verification protocols against synthetic media fraud
• Build an enterprise deepfake incident response and awareness programme

Topics Covered

• Deepfake threat landscape: voice cloning from as little as 3 seconds of audio, video deepfakes, and documented executive-impersonation fraud cases
• Audio deepfake detection: spectral artefact analysis, pre-trained classifier evaluation, and known detection blind spots
• Video deepfake detection: temporal inconsistency analysis, liveness detection, and biometric authentication bypass techniques
• Procedural defences: out-of-band verification, pre-agreed verification codes, and call-back protocols for high-risk transactions (wire transfers, credential resets)
• Enterprise deepfake incident response: detection-to-escalation workflow, awareness training design, and board-level reporting on synthetic media risk

Hands-on Lab Activities

• Audio Deepfake Detection: Using a provided dataset of 20 audio clips (10 real, 10 voice-cloned), run a pre-trained deepfake audio classifier and measure accuracy; identify the spectral/artefact features driving correct vs incorrect classifications; document 3 cases where the classifier fails and explain the likely cause.
• Video Deepfake & Liveness Bypass Assessment: Given a provided set of 6 short video clips (3 authentic, 3 deepfake) and a liveness-detection demo tool, run detection on all 6; attempt a documented bypass technique against the liveness check using a provided synthetic sample; record the bypass success rate and produce a 1-page technical note on why the bypass worked.

Tools

• Pre-trained deepfake audio classifier (provided)
• Liveness detection demo tool
• Librosa

Learning Outcomes

• Generate FGSM and PGD adversarial attacks
• Execute backdoor and data poisoning attacks
• Perform membership inference attacks
• Conduct model stealing attacks
• Map attack techniques to MITRE ATLAS

Topics Covered

• FGSM, PGD evasion of IDS classifiers and malware models
• Minimum perturbation analysis: ε vs. evasion rate, feature-space vs. problem-space attacks
• Data poisoning: backdoor injection (BadNets), label flipping impact on training pipelines
• Model inversion and membership inference — privacy implications and legal context
• Black-box model stealing
• MITRE ATLAS framework: mapping adversarial ML techniques to enterprise AI deployments

Hands-on Lab Activities

• Adversarial Evasion Attack: Using ART, train a fresh Random Forest IDS classifier on the provided 50 k-row CICIDS-2017 sample; craft FGSM then PGD adversarial flows at ε = 0.05, 0.1, 0.2; plot the evasion-rate curve; map the top finding to MITRE ATLAS technique ML05.
• Backdoor Poisoning Attack: Inject 5% trigger-feature samples into a provided 10 k-row training subset; train an XGBoost classifier from scratch; verify the trigger achieves ≥80% attack success rate while clean-data F1 stays ≥88%; document the full attack as a reproducible Jupyter notebook.
• Membership Inference Attack: Train a fresh anomaly detection model (Isolation Forest) on a provided CICIDS-2017 split; run ML Privacy Meter against it; record attack AUC; identify the top 5 most vulnerable records; write 2 concrete defences (DP-SGD + output rounding) with implementation notes.
• Black-Box Model Stealing: Deploy a provided intentionally vulnerable FastAPI IDS endpoint (pre-built Docker image); query it with 500 synthetic input vectors; use the query responses to train a surrogate XGBoost classifier; measure surrogate fidelity (agreement rate vs oracle); identify the minimum query budget to reach 85% fidelity; document 2 architectural defences (query-rate limiting, output perturbation).

Tools

• Adversarial Robustness Toolbox (ART)
• ML Privacy Meter
• MITRE ATLAS Navigator
• PyTorch
• scikit-learn

Learning Outcomes

• Execute OWASP LLM Top 10 attacks
• Implement guardrails (Presidio, NeMo, Llama Guard)
• Measure guardrail effectiveness improvements
• Run automated LLM vulnerability scans (Garak)
• Design mitigations for multi-agent AI attacks

Topics Covered

• OWASP LLM Top 10: prompt injection, insecure output handling, training data poisoning, model DoS
• Direct vs. indirect prompt injection — system prompt override, goal hijacking, multi-turn persistence
• RAG pipeline attacks: document poisoning via malicious PDF, context window stuffing
• Jailbreaking taxonomy: many-shot, virtualization, roleplay bypass with detection signatures
• Guardrail architecture: NeMo Guardrails, Llama Guard 3, Presidio PII redaction

Hands-on Lab Activities

• OWASP LLM Top 5 Attacks: Deploy Ollama Llama 3.2 with a minimal LangChain RAG pipeline (pre-built Docker Compose provided); execute 5 attacks (prompt injection, insecure output handling, data exfiltration, excessive agency, supply-chain poisoning); document attack vector, payload, and severity for each.
• Garak Automated Vulnerability Probes: Run Garak jailbreak, PII leakage, and hallucination probe suites against the local LLM deployed in Lab 1; read the HTML report; write a 1-page remediation specification for the top 3 findings including priority, effort estimate, and success metric.
• Guardrail Stack Implementation: Layer Presidio (PII scrubbing) → NeMo Guardrails (topical rails) → Llama Guard 3 (output safety) on the Lab 1 deployment; re-run the same 5 attacks; record block rate before and after; log residual risk with a risk acceptance statement for each unblocked attack.

Tools

• Ollama (Llama 3.2)
• LangChain
• Garak
• NeMo Guardrails
• Llama Guard 3
• Presidio

Learning Outcomes

• Apply adversarial training techniques
• Implement differential privacy (DP-SGD)
• Evaluate privacy–accuracy trade-offs

Topics Covered

• Adversarial training: PGD-AT clean vs. robust accuracy trade-off
• Certified defences: randomised smoothing — ℓ₂ certification radius, intuition only
• Differential privacy: DP-SGD mechanics, ε calibration, privacy budget accounting

Hands-on Lab Activities

• Adversarial Training Defence: Train a fresh XGBoost malware classifier on the provided 5 k-sample EMBER subset; apply PGD-AT (via ART) at ε = 0.05 and ε = 0.1; add feature squeezing as a pre-processing defence; evaluate and plot a 4-point comparison chart showing clean accuracy vs robust accuracy for baseline, PGD-AT, and feature squeezing.
• Differential Privacy Implementation: Train a neural network IDS on a provided 20 k-row CICIDS-2017 split using TensorFlow Privacy with DP-SGD at ε = 1 and ε = 10; record model accuracy at each privacy budget; write a 1-paragraph GDPR Article 25 privacy impact assessment comparing the two epsilon settings.

Tools

• ART
• TensorFlow Privacy

Learning Outcomes

• Secure models using signing and validation
• Generate explainability reports (SHAP)
• Generate and audit an AI Bill of Materials (AI-BOM) for a deployed AI system
• Evaluate federated learning security trade-offs

Topics Covered

• AI supply chain security: model provenance, ModelScan, safe deserialization, cosign signing
• AI Bill of Materials (AI-BOM): CycloneDX ML-BOM and SPDX AI Profile formats, what a defensible AI-BOM covers (models, datasets, code, licenses, weights identifiers, known biases), and how it extends a traditional SBOM
• Explainable AI for security: SHAP TreeExplainer (global + local)
• Federated learning for security — cross-org threat model sharing

Hands-on Lab Activities

• Supply Chain & SHAP Audit: (a) Download a provided mock pickle-exploit model; scan it with ModelScan; add cosign pinning to an MLflow pipeline; verify the gate blocks the tampered artefact. (b) Train a fresh XGBoost classifier on the provided CICIDS-2017 split; generate a SHAP global importance plot and 3 waterfall plots for individual predictions; format findings as a 1-page audit card.
• Federated Learning Security Simulation: Using a provided PySyft notebook, simulate a 3-client federated learning round on a partitioned CICIDS-2017 dataset; inject a model-poisoning payload from one malicious client; measure the impact on global model accuracy and detection rate; apply a clipping + FedAvg norm-clipping aggregation defence; document residual risk and compliance implications under GDPR Article 25.
• AI-BOM Generation & Audit: Given a provided multi-component AI system (fine-tuned classifier + RAG pipeline + 2 third-party API dependencies), generate a CycloneDX ML-BOM documenting every model, dataset, and dependency with source, license, and provenance fields; cross-check it against a provided vendor disclosure pack to identify ≥3 undisclosed components (an unlisted base model, an unlicensed dataset, an unpinned dependency version); produce a 1-page gap report flagging each as a supply-chain risk.

Tools

• ModelScan
• cosign
• SHAP
• MLflow
• CycloneDX
• PySyft

Learning Outcomes

• Design least-privilege identity and authorization controls for autonomous agents
• Detect and mitigate orchestration hijacking, tool abuse, and cascading agent failures
• Identify and mitigate MCP-specific attack vectors in tool-connected agents

Topics Covered

• Non-human identity & least privilege: authorization models for autonomous agents, scoped credentials, session-bound permissions
• Multi-agent vulnerabilities: orchestration hijacking, tool abuse, cascading failures, goal hijacking via indirect prompt injection
• MCP (Model Context Protocol) security: malicious/poisoned MCP servers, tool-description injection, server impersonation and spoofing, over-broad tool scopes, and MCP server vetting practices before connecting an agent to a new server

Hands-on Lab Activities

• Multi-Agent Orchestration Hijacking: Deploy a 2-agent LangChain pipeline (planner + executor) that processes user-supplied task descriptions; craft 3 indirect prompt injection payloads embedded in a "retrieved document"; demonstrate goal hijacking, tool abuse, and data exfiltration via the executor agent; implement a tool-call approval gate and sandboxed output parser as mitigations; document each attack vector with a MITRE ATLAS mapping.
• Least-Privilege Agent Identity Design: Given a provided 3-agent workflow (research agent, code-execution agent, email-sending agent) with over-permissioned shared credentials, redesign the authorization model using scoped, session-bound credentials per agent; implement the redesign in the provided LangChain scaffold; verify via 5 test scenarios that no agent can exceed its intended scope even under a successful prompt injection.
• Malicious MCP Server Detection: Connect a provided agent to 3 pre-built MCP servers, one of which contains a poisoned tool description designed to hijack agent behaviour and one of which requests over-broad scopes for its stated function; use a provided vetting checklist to inspect each server's tool manifest before granting access; identify the malicious server and the over-scoped server; document the specific manifest red flags that gave each away and implement a scope-limiting wrapper as a mitigation.

Tools

• LangChain
• Ollama (Llama 3.2)
• Model Context Protocol (MCP) SDK
• MITRE ATLAS Navigator

Learning Outcomes

• Apply NIST AI RMF (Govern/Map/Measure/Manage) to an agentic AI deployment
• Build an agent accountability register and kill-switch design
• Map agentic risk to ISO/IEC 42001 and EU AI Act risk tiers

Topics Covered

• NIST AI RMF for agentic systems: Govern, Map, Measure, Manage — applying the Map function to tool-integration surface, authorization scope, and inter-agent interaction
• Human oversight design: approval gates, sandboxed output parsers, kill-switches, and when full autonomy is inappropriate
• Governance frameworks compared: ISO/IEC 42001 (AI management systems) vs. EU AI Act risk-tiering vs. NIST AI RMF — practical crosswalk for enterprise use
• Agent accountability register: business owner, technical owner, delegation lineage, and review triggers for autonomous decisions

Hands-on Lab Activities

• NIST AI RMF Gap Assessment: Given a 1-page description of a fictional company's agentic SOC-automation deployment, complete a provided NIST AI RMF (Govern/Map/Measure/Manage) worksheet; identify ≥6 concrete gaps; produce a prioritised remediation plan mapped to each RMF function with owner and target date per item.
• Kill-Switch & Accountability Register: Design and implement a kill-switch mechanism (hard stop + graceful degradation path) for the agent pipeline built in the previous module; test it under 3 failure scenarios (runaway loop, unauthorized tool call, conflicting agent instructions); build an agent accountability register documenting business owner, technical owner, delegation lineage, and review triggers for the full pipeline.

Tools

• NIST AI RMF worksheet templates

Learning Outcomes

• Perform OSINT reconnaissance using AI tools
• Generate and validate exploit payloads (SQLi, SSRF)
• Use fuzzing tools (AFL++) for vulnerability discovery
• Analyze and classify vulnerabilities
• Write CVSS-based pentest reports
• Assess AI agents and autonomous tool-use as part of the attack surface

Topics Covered

• AI-assisted recon: LLM-powered OSINT, Shodan queries, subdomain enumeration, cloud asset discovery
• LLM payload generation: SQLi, XSS, SSRF, XXE — validation workflow and hallucination detection
• BurpSuite + Nuclei AI templates: AI-native pentest workflow — capabilities, limitations, quality control
• ML-guided fuzzing: AFL++ smart seed generation and AI-assisted crash triage
• Critical AI evaluation: verifying AI outputs, flagging hallucinations, documenting false leads
• Agentic attack surface recon: identifying exposed AI agents, tool-use endpoints, and orchestration layers during reconnaissance

Hands-on Lab Activities

• AI-Assisted Recon: Use Nmap + Shodan + Claude against a pre-built DVWA/Juice Shop target environment; produce a target profile document; list the top 3 attack vectors with LLM-generated rationale; verify each attack vector manually and log AI accuracy (correct vs hallucinated assertions).
• AI Payload Generation & Exploitation: Generate SQLi and SSRF payloads via GPT-4o/Claude for the DVWA/Juice Shop target; validate each payload manually in BurpSuite before execution; exploit one confirmed vulnerability with Metasploit; log AI accuracy (hits vs hallucinations) and append a 1-paragraph reflection on safe AI-assisted exploitation practice.

Tools

• BurpSuite Community Edition
• Metasploit
• Nmap
• Nuclei
• AFL++
• Shodan
• GPT-4o / Claude

Learning Outcomes

• Conduct AI red teaming using STRIDE + MITRE ATLAS
• Simulate attacks and measure evasion rates
• Use CyberBattleSim for attack simulations
• Analyze attack impact and detection gaps
• Deliver executive-level risk reports
• Red team a multi-agent AI system end-to-end

Topics Covered

• AI red team lifecycle: scoping, Rules of Engagement, STRIDE + MITRE ATLAS threat modelling, evidence standards
• MITRE ATLAS attack catalogue: reconnaissance through impact — enterprise AI kill chain mapping
• Adversarial evasion of AI security tools: exploiting model blind spots in AI-powered EDR and WAF
• Reinforcement learning for offensive security: CyberBattleSim — agent design, reward shaping, evaluation
• Board-level risk communication: translating red team findings into business risk and remediation investment
• Agentic red teaming: extending STRIDE + MITRE ATLAS to multi-agent kill chains — delegation abuse, inter-agent trust exploitation

Hands-on Lab Activities

• Scoped LLM Red Team: Deploy a fresh Ollama Llama 3.2 + LangChain RAG stack using the provided Docker Compose; build a STRIDE + MITRE ATLAS DFD for the deployment; execute 6 attacks across the OWASP LLM Top 10; assign CVSSv3.1 severity to each finding; capture evidence screenshots and payloads in a structured report.
• SIEM Evasion Testing: Load a provided 10 k-row CICIDS-2017 sample into a local Elastic instance; train a basic ML anomaly job; craft 3 adversarial network flow payloads using ART to evade detection; measure evasion rate and record minimum perturbation required; map each evasion technique to a MITRE ATLAS technique ID.

Tools

• CyberBattleSim (Microsoft)
• ART
• MITRE ATLAS Navigator
• Metasploit
• Garak
• Elastic SIEM

Learning Outcomes

• Build anomaly detection systems in SIEM
• Create SOAR workflows for automated response
• Perform memory forensics using Volatility
• Develop SIEM correlation rules
• Write incident response and post-mortem reports
• Design human-in-the-loop controls for autonomous SOC triage agents

Topics Covered

• AI-powered SIEM: ML anomaly detection in Elastic, alert correlation, and threshold calibration
• SOAR + LLM integration: LangChain-powered playbooks, NLP case management, intelligent alert enrichment
• AI-assisted digital forensics: Volatility 3 memory analysis and automated IOC extraction
• Incident response for AI-specific attacks: model theft, adversarial bypass, LLM prompt injection in production
• SOC ROI measurement: MTTD/MTTR improvement, FP reduction, analyst hours saved
• Enterprise SecOps platforms: Microsoft Sentinel Copilot, Cortex XSIAM, Vectra AI NDR
• Agentic SOC operations: autonomous triage agents, AI copilots (Microsoft Sentinel Copilot-style workflows), and where human-in-the-loop review remains mandatory
• Failure modes of autonomous triage: alert auto-closure risk, escalation blind spots, and audit trail requirements for agent-taken actions

Hands-on Lab Activities

• Elastic SIEM Tuning: Load a pre-ingested CICIDS-2017 sample into a provided Elastic stack; create an ML anomaly detection job targeting port-scan and brute-force patterns; adjust the anomaly threshold to cut FPs by ≥30% without introducing new FNs; build a 3-panel Kibana dashboard with an ATT&CK tactic overlay.
• SOAR Playbook Automation: Build a 4-step automated workflow in Shuffle/n8n: SIEM alert trigger → VirusTotal IOC enrichment → GPT-4o triage summary → JIRA ticket creation; test the workflow against 5 pre-built alert payloads; record automated processing time vs a manual baseline and calculate analyst hours saved per 100 alerts.

Tools

• Elastic SIEM / Kibana
• Shuffle / n8n (SOAR)
• Volatility 3
• LangSmith
• VirusTotal API
• Wazuh

Learning Outcomes

• Scan and secure cloud ML environments
• Implement model signing and validation pipelines
• Monitor runtime threats using security tools
• Secure Kubernetes and container environments
• Design DevSecMLOps pipelines with security gates

Topics Covered

• Cloud AI threat landscape: compute hijacking, model exfiltration, training data poisoning, misconfigured stores
• AWS SageMaker security controls: IAM least privilege, VPC endpoints, CloudTrail logging
• DevSecMLOps: security gates in MLflow — model signing, vulnerability scanning, compliance gates
• Container & Kubernetes security for AI: Falco (eBPF), Trivy image scanning, NetworkPolicies
• IaC security for AI: Checkov + Snyk IaC scanning of Terraform for AI-specific misconfigurations

Hands-on Lab Activities

• SageMaker Hardening: Start from a pre-deployed SageMaker environment with 4 intentional misconfigurations (over-permissive IAM role, public S3 bucket, missing CloudTrail logging, open inference endpoint); scan with Prowler + Checkov; remediate all CRITICAL findings; re-scan to verify a clean pass.
• Secure MLflow Pipeline: Implement cosign model signing + SHA-256 hash pinning + a model-promotion gate in a provided Docker Compose MLflow stack; inject a tampered model artefact into the registry; verify the gate blocks promotion.
• Kubernetes Runtime Security: Deploy an ML inference pod in a local kind Kubernetes cluster using a provided manifest; install Falco; simulate a privilege escalation attack and a credential exfiltration attempt; confirm Falco fires the expected alerts; write one Kubernetes NetworkPolicy per attack path to prevent recurrence.

Tools

• AWS SageMaker
• Prowler
• Checkov / Snyk IaC
• MLflow
• Falco
• Trivy
• cosign
• Terraform

Learning Outcomes

• Discover and inventory shadow AI usage across an organization
• Assess third-party AI vendor risk using a structured framework
• Draft an enterprise AI usage policy covering acceptable use and data handling
• Translate technical AI risk findings into board-level risk reporting
• Map an AI deployment against EU AI Act risk tiers and NIST AI RMF concurrently

Topics Covered

• Shadow AI risk: discovering unsanctioned AI tool usage, browser-extension and API-key sprawl, data exfiltration risk via consumer AI tools
• AI asset inventory: building and maintaining a register of models, agents, MCP servers, and AI vendors in use across an organization, anchored to the AI-BOM built in Module 9
• Third-party AI vendor risk assessment: structured questionnaires, data handling review, model provenance checks for SaaS AI tools
• Enterprise AI policy design: acceptable use policy, data classification rules for AI inputs, approval workflows for new AI tool adoption
• Regulatory crosswalk: mapping one deployment simultaneously against NIST AI RMF, ISO/IEC 42001, and EU AI Act risk tiers — where they agree and where they diverge
• Board-level risk communication: translating technical AI risk register entries into business-risk narrative and investment asks

Hands-on Lab Activities

• Shadow AI Discovery Exercise: Given a provided synthetic network/SaaS-log dataset for a 200-person fictional company, identify ≥10 instances of unsanctioned AI tool usage (browser extensions, unofficial API keys, unauthorised SaaS AI integrations); classify each by data-exposure risk; produce a prioritised remediation list.
• Third-Party AI Vendor Risk Assessment: Using a provided vendor-risk questionnaire template, assess 2 fictional AI SaaS vendors (one strong, one weak on data handling and model provenance) from provided vendor documentation packs; score each against 8 risk criteria; produce a go/no-go recommendation with conditions for the weaker vendor.

Tools

• Notion / Google Docs
• Google Sheets
• NIST AI RMF worksheet templates
• Claude / GPT-4o

Learning Outcomes

• Create a detailed AI security specification for an original prototype
• Threat model an AI system at engagement depth using STRIDE + MITRE ATLAS + OWASP LLM Top 10
• Deploy a working prototype and execute a structured red team engagement
• Score and document findings with CVSSv3.1 severity and evidence

Topics Covered

• Capstone scope: choose one — AI-powered IDS, LLM security layer, or multi-agent SOC automation
• Threat modelling at engagement depth: STRIDE + MITRE ATLAS + OWASP LLM Top 10 with DFD (Level 0 + Level 1)
• Specification standards: input/output spec, 6-dimension evaluation rubric, compliance checklist (EU AI Act + NIST AI RMF + ISO/IEC 42001), agent accountability register if the prototype is agentic, 3-phase rollout with gate criteria
• Red team execution: drawing on Modules 6, 7, 12, 13 techniques — structured, evidenced, CVSSv3.1-scored

Capstone Activities

• Plan & Specify (4h): Write the AI Security Specification — problem statement, STRIDE + MITRE ATLAS DFD, input/output spec, 6-dimension evaluation rubric, compliance checklist (EU AI Act + NIST AI RMF + ISO/IEC 42001), agent accountability register if the prototype is agentic, and 3-phase rollout with gate criteria.
• Build & Attack (8h): Deploy the chosen prototype; run ≥6 structured attack scenarios from Modules 6, 7, 12, 13; score each against the rubric; assign CVSSv3.1 severity; document evidence.

Tools

• All course tools
• Elastic SIEM
• MLflow

Learning Outcomes

• Apply targeted defences and measure security posture improvement
• Produce a board-level AI risk and compliance report
• Build a business case with ROI analysis
• Deliver a portfolio-ready technical report

Topics Covered

• Defensive hardening: applying Modules 8, 9, and 16 controls; measuring rubric improvement; logging residual risk
• Business case construction: 6-month TCO, ROI projection, risk-adjusted break-even
• Board-level AI risk reporting: risk narrative, compliance posture, investment ask
• Portfolio standards: technical report structure, executive narrative

Capstone Activities

• Harden & Measure (5h): Apply targeted defences from Modules 8, 9, and 16; re-run attacks; record rubric delta (before vs. after); write residual risk register and v2 iteration plan.
• Govern & Report (3h): Produce a board-level AI risk report for the completed engagement — risk narrative, compliance posture against the Module 16 crosswalk, and investment ask.

Tools

• All course tools
• Elastic SIEM
• MLflow