sicurity.aiTrack B
Agentic AI Defender
Securing agentic AI
PROPOSED SICURITY.AI AGENTIC DEFENSE CREDENTIAL · NOT A GIAC CERTIFICATION
The person who finds, contains, and investigates compromised agents
Find the compromised agent. Contain its authority. Prove what happened. Build the inventory, identity controls, detections, and investigation skills that make agentic systems defensible.
AI/ML Security Engineer role: Set boundaries for agents, identities, tool access, monitoring, and incident response.
DESIGN PREVIEW / SAMPLE DATA
0 of 13 modules accessible. Availability is confirmed separately from enrollment.
First modules December 14, 2026.
At a glance
- Study time
- 26 to 52 estimated hours, allowing 2 to 4 hours per module. Additional practice varies.
- Modules
- 13 planned modules, including the free foundation
- Credential alignment
- PROPOSED SICURITY.AI AGENTIC DEFENSE CREDENTIAL · NOT A GIAC CERTIFICATION
- Free module
- How agents fail. Planned · not accessible yet. Free access depends on release.
- Start date
- First modules December 14, 2026. Remaining modules follow as released.
CVE identifiers, cited scores and fixed versions reviewed against published CNA records on . Other references retain their stated review dates; check current maintainer advisories before use.
Who this is for
Bring your security practice.
Extend it to AI.
Security engineers who have been told the company is deploying agents; identity architects who have just met their first non-human identity; incident responders and forensic analysts who know the next call will be about an agent; platform engineers building agents who want to know how they fail.
You join a fictional company as its agent security lead when it discovers agents in production that nobody approved. Over twelve weeks it deploys a support agent, a finance agent, coding agents, a long-memory assistant, and a multi-agent workflow. Published advisories and synthetic exercises inform the attacks. Each scenario teaches a control, then tests containment and investigation.
Recommended preparation
Recommended: incident-response fundamentals, identity and access management, basic scripting, and experience reading application logs. Foundations introduces agent inputs and trust boundaries.
What you will leave with
- An agent register that states authority as actions, not roles
- An agent evidence standard your company can adopt
- Goal integrity and isolation controls
- A non-human identity and approval design
- A tool trust process with a gateway policy
- A developer agent sandbox standard
- Memory integrity controls with rollback
- A detection pack for agent behavior
- A containment runbook you have run under a clock
- A forensic timeline and incident report graded against ground truth
Your capstone
Contain a compromised agent and reconstruct its injection source, actions, data access, root cause, and required control changes in an evidence-backed incident report.
Inside the labs
One fictional company.
Four connected tracks.
The guide follows a fictional organization with an AI support assistant, a finance agent, coding agents, business-built automations, and security operations across cloud and on-premises systems.
Each week moves from a case file to a practical build, a controlled test, a retained artifact, and readiness work. Allow about five hours per week, roughly 60 hours across the track. Lessons and community run on Skool. The labs run in the sicurity.ai environment shown below. Live-fire and assessment dates are published with each release.
Screens are design previews with sample data, not live lab access or learner results.
DESIGN PREVIEW / SAMPLE DATA
The course range: connected systems, track ownership, and recent activity.
DESIGN PREVIEW / SAMPLE DATA
The weekly sprint: case file, build, controlled test, artifact, and readiness.
DESIGN PREVIEW / SAMPLE DATA
Design preview inspired by GitLab AI Gateway CVE-2026-90970. Trace data, answers, and timer are fictional; this is not evidence of a reproduced exploit.
The course / 12 weeks plus foundations
See the work.
See what it produces.
Each module shows its access status below. Planned modules are curriculum previews, not accessible lessons. Only owner-confirmed releases include a direct Skool module link; Skool sign-in and the required membership may apply.
Open any week for its scenario, learning objectives, and lab interface preview where available. A free foundation label describes planned pricing, not current access.
WEEK 00 / FREEHow agents failPlanned · not accessible yet
Free, shared with every track. An agent combines a model, an execution loop, tools, and memory. Each introduces a trust boundary. The case file references Microsoft's M365 Copilot information-disclosure record CVE-2026-24307, not an independently verified Reprompt/Copilot Personal identifier. You leave with an untrusted-input map for one agent.
Learning objectives
WEEK 01Find every agent in the companyPlanned · not accessible yet
You cannot defend what you have not counted. Cursor's advisory for CVE-2026-22708 describes a terminal allowlist bypass through environment variables before version 2.3, when Auto-Run and Allowlist modes are enabled. The maintainer assigns CVSS 4.0 7.2, not 9.8. You build a synthetic register: 23 agents, nine never approved, four able to move money or change vendor records, and two using a shared static credential. These counts are exercise fixtures, not research findings. Record authority as actions an agent can take.
Learning objectives
DESIGN PREVIEW / SAMPLE DATA
The register. The finance agent sits at the top because it can pay invoices and edit vendor bank details on a shared admin key with no approval step. Fourteen developer laptops open repositories that carry MCP configs.
WEEK 02Make agents investigable before they failPlanned · not accessible yet
The case file is the September 2025 GTG-1002 campaign, disclosed by Anthropic on November 13, 2025 and catalogued by MITRE as Campaign C0062. Anthropic estimates AI performed 80 to 90% of the campaign against roughly thirty attempted targets, with a small number of successful intrusions, human decision points, and some hallucinated results. This is the vendor's reported estimate, not an independently measured automation rate. You build an evidence standard covering traces, tool-call logs, memory snapshots, egress, and retention.
Learning objectives
WEEK 03The support agent goes livePlanned · not accessible yet
A synthetic support-agent deployment tests OWASP ASI01 Agent Goal Hijack. Untrusted material attempts to change the agent's task. You build goal integrity controls, constrained tool permissions, and untrusted-content isolation, then test whether application-enforced boundaries hold even when the model follows an injected instruction. This is a course scenario, not a claim about a vendor announcement.
Learning objectives
WEEK 04The finance agent can move moneyPlanned · not accessible yet
NIST's AI Agent Standards Initiative includes research into agent authentication and identity infrastructure and links to identity and authorization work; it is not a credential standard. Pair that context with MCP TypeScript SDK CVE-2026-104850, where unbound OAuth credentials could be sent to an authorization server chosen by a malicious MCP server. In the synthetic finance workflow, replace shared credentials with scoped tokens and bind approval to the action. Test that a seeded stolen token cannot act outside its task or lifetime.
Learning objectives
WEEK 05The company adopts third-party toolsPlanned · not accessible yet
The synthetic inventory contains seven external MCP servers and two internal ones. Published references include LiteLLM MCP configuration command execution (CVE-2026-30623) and Claude Agent SDK argument injection through an untrusted resume session identifier (CVE-2026-96620), fixed in Python SDK 0.2.121. You build provenance checks, response validation, gateway policy, and egress limits. Test tampered and clean tool responses against the same policy.
Learning objectives
WEEK 06Coding agents on fourteen laptopsPlanned · not accessible yet
Compare Cursor CVE-2026-26268, a Git-hook sandbox escape fixed in version 2.5, with Microsoft's CVE-2026-21523, a time-of-check/time-of-use issue in GitHub Copilot and Visual Studio Code. The second identifier is not a Cursor vulnerability. You build repository configuration policy, hook controls, credential isolation, and detection for an agent reaching outside its project in a synthetic developer environment.
Learning objectives
WEEK 07The assistant that remembersPlanned · not accessible yet
The company gives its assistant long-term memory. The published CVE-2026-95183 record describes prompt injection through crafted external content in the context-compaction feature of DeepSeek Harness at commit c291e796. It does not establish a measured exploitation rate. In a synthetic memory-poisoning exercise, build provenance tags, detection, and rollback, then remove a seeded sleeper entry while preserving legitimate memory.
Learning objectives
WEEK 08Agents that delegate to agentsPlanned · not accessible yet
In this synthetic scenario, procurement's agent asks finance's agent to pay a vendor. Whose identity is that, and what happens when the first one is wrong? You build the inter-agent trust chain, identity propagation, and circuit breakers. The scenario illustrates OWASP ASI07 and ASI08; it does not claim that published inter-agent exploits do not exist.
Learning objectives
WEEK 09Detection engineering for agentsPlanned · not accessible yet
Thirty days of agent telemetry from your instance, with three compromises hidden in it. You write detections over OpenTelemetry GenAI traces for tool misuse, privilege drift, runaway loops, and exfiltration through tool calls. Your pack is scored on precision and recall against the hidden set, not on how many rules you wrote.
Learning objectives
WEEK 10Two in the morningPlanned · not accessible yet
The support agent is refunding orders at 412 a minute. You have five minutes. The runbook you built this week runs: revoke tokens at the identity provider, freeze the memory store, snapshot traces and tool calls and egress with hashes recorded, cut tool access, then restore with refund authority removed and an approval gate on money. Scored on time to detect, time to contain, evidence integrity, and whether service came back.
Learning objectives
DESIGN PREVIEW / SAMPLE DATA
The containment lab at three minutes and twelve seconds. Tokens revoked at 41 seconds, memory frozen, four snapshots hashed, tool access cut. Two steps remain: restore with reduced authority and notify the business.
WEEK 11Live-firePlanned · not accessible yet
Track C members attack the company's agents in real time, including the ones you hardened. Your containment log, your evidence hashes, and your times go on the scoreboard.
Learning objectives
DESIGN PREVIEW / SAMPLE DATA
Live-fire scoreboard: team actions, event timings, and retained evidence.
WEEK 12Prove what it didPlanned · not accessible yet
The practical. You get the traces, the tool-call logs, and a memory snapshot from the week 10 agent, and nothing else. You rebuild the timeline: the injection source, every action, every record touched, the memory writes, the exfiltration, the root cause, and the control changes that would have prevented it. Your timeline is scored against ground truth, your evidence integrity is checked by hash, and a master grades the incident report against the public rubric. This is the credential practical.
Learning objectives
DESIGN PREVIEW / SAMPLE DATA
The reconstruction. Seven of eight ground-truth events are placed, the exfiltration was timed eight minutes late, and a second memory write at 02:33 is still missing from the member's timeline. Ground truth match: 87%.
Proposed independent assessment
Defend. Investigate. Demonstrate.
An independent sicurity.ai agentic defense credential is proposed. It is not a GIAC certification. Its assessment rules, verification service and availability are not yet finalized.
Proposed assessment design
Proposed independent assessment: a 4-hour seeded-range practical plus 40 timed questions. These are course-design targets, not final rules or an available certification. OWASP risk references and NIST research inform the design; neither organization accredits or endorses this credential. Final rules, scoring, verification, and availability must be published before assessment enrollment.
An independent sicurity.ai assessment is not a GIAC certification, OWASP certification, or NIST accreditation.
The assessment concept is a seeded-range practical plus timed questions, graded against a public rubric. The final name, rules, scoring, and availability are not yet finalized.
Credential crosswalk
These eight proposed course domains reference selected risks in OWASP Top 10 for Agentic Applications 2026 (ASI01 to ASI10). NIST's identity and authentication research is context, not an identity-and-authorization pillar or a certification framework. This is a sicurity.ai interpretation, not a NIST or OWASP credential. Primary-source review: October 31, 2026. References are linked below. Scenarios, scores, thresholds, and interface values are fictional course-design examples, not incident measurements or learner results. Crosswalks are sicurity.ai's proposed curriculum alignment, not approval by GIAC, OWASP, or NIST. Exam fees are separate. Confirm current objectives and assessment requirements with the certifying body before booking.
Primary sources
- OWASP Top 10 for Agentic Applications 2026: ASI01 to ASI10 ↗
- NIST AI Agent Standards Initiative: research and related identity work, not credential accreditation ↗
- Microsoft CNA record: CVE-2026-24307, M365 Copilot information disclosure ↗
- CVE-2026-30623: LiteLLM MCP configuration command execution ↗
- MCP TypeScript SDK maintainer advisory: CVE-2026-104850 ↗
- Cursor maintainer advisory: CVE-2026-22708, terminal allowlist bypass ↗
- Cursor maintainer advisory: CVE-2026-26268, Git hooks sandbox escape ↗
- Microsoft CNA record: CVE-2026-21523, GitHub Copilot and Visual Studio Code, not Cursor ↗
- Claude Agent SDK maintainer advisory: CVE-2026-96620 ↗
- CVE-2026-95183: DeepSeek Harness context-compaction prompt injection ↗
- Anthropic: reported AI-orchestrated espionage campaign and estimated 80 to 90% AI contribution ↗
- MITRE ATT&CK Campaign C0062: GTG-1002, September 2025 ↗
OWASP risk names are referenced for identification. Course scenarios and proposed mappings are sicurity.ai interpretations, not official OWASP materials or endorsements.
Skill record interface preview
DESIGN PREVIEW / SAMPLE DATA
The skill record: artifacts, assessment criteria, and practitioner sign-off.
Evidence / scope / access
Real work.
Clear boundaries.
Hosted labs and live-fire are not currently available. Course releases include access details and setup requirements. Published references have been checked; final labs, assessment validity, and coverage still need verification before assessment enrollment.
Primary-source review: October 31, 2026. References are linked below. Scenarios, scores, thresholds, and interface values are fictional course-design examples, not incident measurements or learner results. Crosswalks are sicurity.ai's proposed curriculum alignment, not approval by GIAC, OWASP, or NIST. Exam fees are separate. Confirm current objectives and assessment requirements with the certifying body before booking.
Start with the free foundation when released
Use the module access list above to check what is accessible before choosing a membership. Enrollment does not imply every module is released.