sicurity.aiTrack A
AI Platform Security Engineer
GenAI and LLM application security
PROPOSED GAIPS OBJECTIVE ALIGNMENT · NOT VERIFIED COMPLETE EXAM PREPARATION
The person who decides whether an AI product ships
Build AI platform security skills through twelve planned releases and evidence-based release decisions. The proposed GAIPS alignment is not verified as complete exam preparation.
AI/ML Security Engineer role: Secure AI applications, model integrations, retrieval, and the data paths that connect them.
DESIGN PREVIEW / SAMPLE DATA
0 of 13 modules accessible. Availability is confirmed separately from enrollment.
At a glance
- Study time
- 26 to 52 estimated hours, allowing 2 to 4 hours per module. Additional practice varies.
- Modules
- 13 planned modules, including the free foundation
- Credential alignment
- PROPOSED GAIPS OBJECTIVE ALIGNMENT · NOT VERIFIED COMPLETE EXAM PREPARATION
- Free module
- How LLM applications fail. Planned · not accessible yet. Free access depends on release.
- Start date
- Later in the rollout. No start date announced.
Who this is for
Bring your security practice.
Extend it to AI.
Application security engineers who have been handed an LLM feature; cloud security engineers whose company is standing up model hosting; MLOps engineers who own the pipeline and have been told it is now a security boundary; anyone whose name goes on the release.
You join the team that ships a fictional company's customer-facing AI product as its security engineer. Each week introduces a feature: a knowledge base, a tuned model, a new tool, a hosting move, or an automated retraining pipeline. Published advisories and explicitly synthetic scenarios inform the case files. You practice deciding whether a release can ship and supporting that decision with evidence.
Recommended preparation
Recommended: basic Python, HTTP APIs, application security, and familiarity with cloud deployment. Start with the free foundations sprint if LLM application architecture is new to you.
What you will leave with
- A data-flow map of an LLM application with every untrusted entry point marked
- A retrieval authorization pattern
- An alignment regression gate
- Provenance and signing checks for models and packages
- A hardened MCP integration
- An AI gateway policy with budgets and logging
- A fail-closed pipeline stage
- An evaluation harness in CI
- A threat model mapped to NIST AI RMF, ISO/IEC 42001, and the EU AI Act
- A release-gate packet graded by a master
Your capstone
Produce a release-gate packet containing a threat model, evaluation results, residual-risk memo, and a documented ship-or-stop decision.
Inside the labs
One fictional company.
Four connected tracks.
The guide follows a fictional organization with an AI support assistant, a finance agent, coding agents, business-built automations, and security operations across cloud and on-premises systems.
Each week moves from a case file to a practical build, a controlled test, a retained artifact, and readiness work. Allow about five hours per week, roughly 60 hours across the track. Lessons and community run on Skool. The labs run in the sicurity.ai environment shown below. Live-fire and assessment dates are published with each release.
Screens are design previews with sample data, not live lab access or learner results.
DESIGN PREVIEW / SAMPLE DATA
The course range: connected systems, track ownership, and recent activity.
DESIGN PREVIEW / SAMPLE DATA
The weekly sprint: case file, build, controlled test, artifact, and readiness.
DESIGN PREVIEW / SAMPLE DATA
Design preview inspired by GitLab AI Gateway CVE-2026-90970. Trace data, answers, and timer are fictional; this is not evidence of a reproduced exploit.
The course / 12 weeks plus foundations
See the work.
See what it produces.
Each module shows its access status below. Planned modules are curriculum previews, not accessible lessons. Only owner-confirmed releases include a direct Skool module link; Skool sign-in and the required membership may apply.
Open any week for its scenario, learning objectives, and lab interface preview where available. A free foundation label describes planned pricing, not current access.
WEEK 00 / FREEHow LLM applications failPlanned · not accessible yet
Free, and shared across tracks. You take the support assistant apart: where text enters, how it is tokenized, how the context window is assembled, and why instructions hidden in data can influence behavior. The case file references CVE-2026-24307, which Microsoft's CNA record identifies as an M365 Copilot information-disclosure vulnerability caused by improper input-type validation. It is not attributed here to the separately reported Reprompt attack on Copilot Personal. You leave with a data-flow map of the assistant with every untrusted entry point marked.
Learning objectives
WEEK 01Inherit the systemPlanned · not accessible yet
In the fictional scenario, the assistant has been in production for a year and nobody knows what is in its context. The case file references Microsoft's CVE-2026-21520, an information-disclosure vulnerability in Copilot Studio, without assigning an unverified incident nickname. Read it alongside OWASP Top 10 for LLM Applications 2026: LLM08 Hidden Context Exposure and LLM10 Improper Output Handling. You build an output handling policy and test whether protected context stays inside the application.
Learning objectives
WEEK 02The knowledge base shipsPlanned · not accessible yet
Product connects the assistant to the internal document store. An intern's question returns a board deck. The case file pairs OWASP LLM09 Vector and Embedding Weaknesses with a poisoned document seeded into your instance's corpus. You build document-level authorization enforced at retrieval time, a poisoning detector, and a retrieval audit log. Pass condition: zero unauthorized chunks across the seeded test identities.
Learning objectives
WEEK 03The tuned model shipsPlanned · not accessible yet
Marketing wants the assistant to sound like the brand, so the team fine-tunes it. Accuracy goes up; the model starts answering what the base model refused. The case file is OWASP LLM05 Data and Model Poisoning with a range model that passes its accuracy suite and fails safety. You build an alignment regression gate that blocks the regressed model and passes the clean one.
Learning objectives
WEEK 04New framework, new packages, new model from the hubPlanned · not accessible yet
The team upgrades its framework and pulls a model from a public hub. This is a synthetic supply-chain case aligned with OWASP LLM04 Supply Chain: a seeded dependency or model artifact fails provenance checks. It does not claim a particular package's download count or release history. You build provenance and signature verification into the build and produce an AI bill of materials.
Learning objectives
WEEK 05Order lookup over MCPPlanned · not accessible yet
The assistant gets its first tool. Published CVE records describe arbitrary command execution through MCP configuration in LiteLLM (CVE-2026-30623) and Agent Zero (CVE-2026-30624), and command injection when mcp-remote connects to an untrusted server (CVE-2025-6514). These are distinct configuration and authorization trust failures, not a verified count of affected installations. You build tool description validation, scoped tokens, a server allowlist, and configuration hardening.
Learning objectives
WEEK 06The business team builds its own agentsPlanned · not accessible yet
In the fictional scenario, operations deployed a low-code agent builder with six flows. Langflow's maintainer advisory for CVE-2026-105697 describes arbitrary command execution through MCP stdio configuration before version 1.10.3, running as the Langflow process user. It does not establish a Python REPL escalation to superuser. You build a builder hardening standard and a review gate for business-built agents.
Learning objectives
WEEK 07Hosting moves, and the team asks for one control pointPlanned · not accessible yet
Finance wants cheaper inference, so the fictional assistant moves between hosted and self-hosted models. You put a gateway in front of it to filter, budget, and log requests. GitLab's CNA record for CVE-2026-90970 (CVSS 3.1 9.9) describes an authenticated user with Duo Agent Platform access escaping the prompt-template sandbox through crafted flow configuration. Pair this with OWASP LLM06:2026 Unbounded Consumption. The synthetic load test sends 1,204 requests to one tenant in six minutes. Proposed pass conditions: block and alert on the budget breach, retain investigation logs, and keep p95 latency under 300 milliseconds. These are exercise targets, not measured incident results.
Learning objectives
DESIGN PREVIEW / SAMPLE DATA
The gateway lab during the attack step. The policy treats templates as code and variables as data; the Partner API tenant has hit its budget and every further request is blocked while the retail tenant keeps working.
WEEK 08The retraining pipeline goes automaticPlanned · not accessible yet
The model now retrains nightly in the fictional environment. MCP Inspector CVE-2025-49596 describes missing authentication between client and proxy that allowed remote code execution in versions below 0.14.1. A separate, synthetic unsafe-serialization scenario tests artifact handling; the Inspector advisory is not a model-file incident. You build a pipeline stage that scans, signs, and fails closed on the seeded unsafe artifact.
Learning objectives
WEEK 09The assistant acts on behalf of usersPlanned · not accessible yet
Product adds OAuth so the assistant can place orders for logged-in customers. The case file is the MCP TypeScript SDK, CVE-2026-104850, where a malicious server could name its own authorization server and collect stored credentials. You build an authorization server allowlist and token scoping, then put an evaluation harness into CI with pass thresholds per attack category, so every future release is attacked before it ships.
Learning objectives
WEEK 10The board asks whether it is safePlanned · not accessible yet
Someone senior has read about AI incidents and wants a one-page answer. You threat model the fictional product using the OWASP agentic risk taxonomy, then compare the controls from weeks 1 through 9 with NIST AI RMF and ISO/IEC 42001. The artifact is a residual risk memo, not a legal-compliance opinion or a claim of certification. Check applicable legal obligations and dates against current official legislation and qualified advice.
Learning objectives
WEEK 11Live-firePlanned · not accessible yet
A controlled exercise uses the fictional product you have hardened across the track. You triage simulated findings, document defensive changes, and preserve evidence. The rubric measures response quality, containment decisions, and whether your logs support a clear investigation.
Learning objectives
DESIGN PREVIEW / SAMPLE DATA
Live-fire scoreboard: team actions, event timings, and retained evidence.
WEEK 12Ship or stopPlanned · not accessible yet
Release 7.3 is due Friday. You submit the release-gate packet: threat model, evaluation results, residual risk, and your decision with the reason. An automated red-team run then attacks the fixed build; your score is the packet's quality plus what the run finds. Then the exam sprint: GAIPS simulation, 54 questions in 2 hours, hands-on tasks included, with your own index open beside you.
Learning objectives
DESIGN PREVIEW / SAMPLE DATA
The practical. Five of six evaluation categories pass; hidden context exposure sits at 96.7% against a 98% threshold because four probes recovered a system prompt fragment through a translation request. The member has chosen Stop and written the fix.
Proposed exam objective alignment
Build skills. Verify readiness.
The course plan proposes alignment with GIAC AI Platform Security (GAIPS) objectives. Complete coverage has not been verified. It is not official GIAC courseware, and track completion does not guarantee an exam result.
Published GIAC exam information
GIAC lists one proctored CyberLive exam: 54 questions, 2 hours, and a 65% passing score for versions released on or after July 25, 2026. The completion window is 120 days from activation, not purchase. Checked October 31, 2026; confirm your attempt's specifications in your GIAC account. Current fees must be checked directly with GIAC.
Confirm current format, fees, eligibility, and objectives with GIAC before booking. Exam fees are separate. Course practice questions are independently authored, not actual GIAC questions. Internal readiness targets are not GIAC passing scores or validated predictors.
GAIPS crosswalk
The eight objective headings match GIAC's GAIPS page as checked October 31, 2026. Week assignments and evidence rubrics are proposed by sicurity.ai; heading alignment does not establish complete exam coverage. Primary-source review: October 31, 2026. References are linked below. Scenarios, scores, thresholds, and interface values are fictional course-design examples, not incident measurements or learner results. Crosswalks are sicurity.ai's proposed curriculum alignment, not approval by GIAC, OWASP, or NIST. Exam fees are separate. Confirm current objectives and assessment requirements with the certifying body before booking.
Primary sources
- GIAC GAIPS: exam format and eight objective headings ↗
- OWASP Top 10 for LLM Applications 2026: risk names and numbering ↗
- OWASP Top 10 for Agentic Applications 2026: ASI01 to ASI10 ↗
- Microsoft CNA record: CVE-2026-24307, M365 Copilot information disclosure ↗
- Microsoft CNA record: CVE-2026-21520, Copilot Studio information disclosure ↗
- CVE-2026-30623: LiteLLM MCP configuration command execution ↗
- CVE-2026-30624: Agent Zero MCP configuration command execution ↗
- CVE-2025-6514: mcp-remote command injection ↗
- Langflow maintainer advisory: CVE-2026-105697 ↗
- GitLab CNA record: CVE-2026-90970, AI Gateway template sandbox escape ↗
- MCP Inspector maintainer advisory: CVE-2025-49596 ↗
- MCP TypeScript SDK maintainer advisory: CVE-2026-104850 ↗
OWASP risk names are referenced for identification. Course scenarios and proposed mappings are sicurity.ai interpretations, not official OWASP materials or endorsements.
Evidence / scope / access
Real work.
Clear boundaries.
Hosted labs and live-fire are not currently available. Course releases include access details and setup requirements. Published references have been checked; final labs, assessment validity, and coverage still need verification before assessment enrollment.
Primary-source review: October 31, 2026. References are linked below. Scenarios, scores, thresholds, and interface values are fictional course-design examples, not incident measurements or learner results. Crosswalks are sicurity.ai's proposed curriculum alignment, not approval by GIAC, OWASP, or NIST. Exam fees are separate. Confirm current objectives and assessment requirements with the certifying body before booking.
Start with the free foundation when released
Use the module access list above to check what is accessible before choosing a membership. Enrollment does not imply every module is released.