Description
Private group classes of up to 30 people, Remote:
If you need on site, call 888-225-0888 ext 3
You choose dates and times based on your team requirements.
One session can be replaced with following options:
- Security architecture
- Security engineering
- Building a deployment plan greenfield Ai
General information:
- There will be recordings.
- Each student will do 2 to 6 hours of homework between sessions.
- The exam fee is not included.
- You will have access to the full the VMLT learning platform for all your course material.
- You must be able to build the following lab on your machine: https://github.com/deanbushmiller/Ai-OFF-and-DEF
- As developments occur in Ai during this class, we will adjust accordingly.
Prerequisites:
NO programming experience necessary. Labs are delivered at three levels: video, low code, and programmer.
Successful students will be able to pass the pre-class quiz and / or have one of the following certifications:
- Sec+, CASP+, CySa, CISSP, CEH, Pentest+
Course Outline
1: Foundations
Session 1 : Kickoff and AI Types
Objective 1.1
- Demo: Make a chatbot leak its system prompt.
- Present the exam format, domains, and weights.
- Teach ML, deep learning, transformers, and RAG in one diagram.
- Lab: setup & practice ( you must be able to share your screen for support)
- Support will for lab will continue until everyone’s lab is running FIFO.
Homework:
- Videos: AI types and techniques in security.
- Lab: Clone the repository and complete the setup.
- Practice questions
- Set a target exam date on platform.
Session 2 : Data Security and the AI Life Cycle
Objectives 1.2 and 1.3
- Discussion: Why does data-at-rest encryption fail to protect a model during inference?
- Teach the AI life cycle and the security risk at each stage.
- Exercise: Find the poisoning risks in a sample training pipeline.
Homework:
- Videos: Data provenance, data quality, and life cycle security.
- Lab: Trace a dataset through a sample pipeline and mark each risk.
- Practice questions on objectives 1.2 and 1.3.
2: Threat Modeling and Controls
Session 3 : AI Threat Modeling
Objective 2.1
- Teach the structure of OWASP Top 10 for LLM Applications and MITRE ATLAS.
- Poll: Which is worse, a malicious prompt or a poisoned vector database?
- Exercise: Threat model a fake AI-powered tool with the ATLAS matrix.
Homework:
- Videos: Each OWASP LLM risk in plain terms.
- Lab: Finish the ATLAS threat model from class.
- Practice questions on objective 2.1.
Session 4 : Security Controls for AI Systems
Objective 2.2
- Teach guardrails, prompt firewalls, rate limits, and token quotas.
- Game: “Red Team real Ai setup.” Students send injection attempts through lab machine.
- Game: “Threats & Controls.” Match each successful attack to a control.
Homework:
- Videos: Model guardrails and gateway controls.
- Lab: Build a prompt firewall that blocks PII.
- Lab: Use a system 1 tool to reduce prompt injection.
- Practice questions on objective 2.2.
3: Access, Data, and Monitoring
Session 5 : Access and Data Security Controls
Objectives 2.3 and 2.4
- Teach access control for models, APIs, agents, and vector stores.
- Demo: A RAG system returns a document the user should not see.
- Exercise: Choose the access and data controls that stop the leak.
Homework:
- Videos: Least privilege, encryption, and data masking for AI.
- Lab: Configure a RAG flow and test it for data leakage.
- Practice questions on objectives 2.3 and 2.4.
Session 6 : Monitoring, Auditing, and Attack Evidence
Objectives 2.5 and 2.6
- Teach what to log for an AI system.
- Exercise: Review sample logs from an attacked AI system.
- Discussion: Name the attack and propose a compensating control.
- Poll: Can a model ever be 100% jailbreak-proof?
Homework:
- Videos: AI audit trails and common attack evidence.
- Lab: Run a basic injection on a sandbox LLM, then add a control.
- Practice questions on objectives 2.5 and 2.6.
4: AI-Assisted Security
Session 7 : AI Tools for Security Tasks
Objectives 3.1 and 3.2
- Teach how AI helps with detection, triage, and response.
- Demo: An AI agent summarizes a log file.
- Chat: Name one SOC task you would give to AI and one you never would.
Homework:
- Videos: How attackers use AI for phishing, malware, and deepfakes.
- Lab: Use an AI tool to triage a sample alert queue.
- Practice questions on objectives 3.1 and 3.2.
Session 8 : Automating Security Tasks with AI
Objective 3.3
- Teach automation workflows and where humans must approve.
- Poll: Would you let an agent block an IP address on its own?
- Discussion: What are the risks of excessive agency?
- Exercise: Design an approval step for an automated response.
Homework:
- Videos: Automation patterns and agent permissions.
- Lab: Build an agent workflow that summarizes logs and drafts a ticket.
- Practice questions on objective 3.3.
5: Governance and Exam Prep
Session 9 : Governance, Risk, and Compliance
Objectives 4.1, 4.2, and 4.3
- Teach the EU AI Act, NIST AI RMF, and ISO/IEC 42001 side by side.
- Game: “Which Framework?” Match five scenarios to a framework.
- Discussion: How do you balance explainability with intellectual property?
Homework:
- Videos: AI governance roles, AI risks, bias, hallucinations, and shadow AI.
- Lab: Evaluate a sample AI tool against the NIST AI RMF.
- Full practice exam: 60 minutes, timed. This replaces the 20-minute question set.
Session 10 : Final Review and Exam Strategy
All domains
- Review the practice exam results by domain.
- Blitz: Rapid-fire performance-based questions with a leaderboard.
- Teach three exam tactics and a time plan.
- Chat: Post your exam date and weakest domain.
Homework:
- Review your two weakest domains using the mindmap.
- Retake the missed practice questions.
- Schedule the exam.
Refunds:
- Up to the first day of class
