What you'll learn
- OWASP Top 10 for LLM applications (2025)
- Securing agents
- AI for defenders
- Governance
Lessons
1OWASP Top 10 for LLM applications (2025)
- Prompt Injection.
- Sensitive Information Disclosure.
- Supply Chain.
- Data and Model Poisoning.
- Improper Output Handling.
- Excessive Agency.
- System Prompt Leakage.
- Vector and Embedding Weaknesses.
- Misinformation.
- Unbounded Consumption.
2Securing agents
Treat every tool result, web page, file and repo instruction file as untrusted input. Give agents least-privilege tools, require human approval for irreversible actions, sandbox code execution, and log every tool call. In Oct 2026 a malicious AGENTS.md file was used to try to make coding agents install a malicious package.
3AI for defenders PRO
AI agents now find real vulnerabilities cheaply (e.g. 21 FFmpeg bugs reported in 2026). Discovery is getting cheaper faster than patching, so asset inventory, SBOMs and fast patch …
Continue this lesson in the platform →4Governance PRO
NIST AI RMF (Govern, Map, Measure, Manage), ISO/IEC 42001 for AI management systems, and the EU AI Act's risk tiers. Keep an AI inventory, data-use rules and red-team testing befor…
Continue this lesson in the platform →Hands-on lab: Threat-model a RAG chatbot
- Draw the flow: user → app → retriever → vector DB → LLM → tools.
- Mark each trust boundary.
- For each boundary, list one OWASP LLM risk.
- Pick a control for each (output encoding, tool allow-list, PII filtering, rate limits).
- Write 3 test cases your red team should try.
Outcome: An AI threat model you can reuse at work.
Practice questions
Indirect prompt injection arrives through…
Answer: Content the model reads, such as web pages or files. Untrusted retrieved content carries instructions.
'Excessive Agency' means…
Answer: Agent has more permissions or autonomy than needed. Over-broad tools and autonomy.
ISO/IEC 42001 covers…
Answer: AI management systems. Certifiable AI management standard.
The full graded assessment (4 questions, pass mark 70%) is in the platform.
Key terms
- Prompt injection
- Instructions hidden in input that make an LLM ignore its intended rules.
- Indirect prompt injection
- Malicious instructions delivered via content the model reads (web pages, files, emails).
- Excessive agency
- An AI agent with more permissions or autonomy than its task needs.
- Model poisoning
- Corrupting training or fine-tuning data to alter model behaviour.
- RAG
- Retrieval-Augmented Generation: feeding retrieved documents to an LLM as context.
- Guardrails
- Input/output filters and policies that constrain AI behaviour.
- MITRE ATLAS
- Knowledge base of adversary tactics against AI systems.
See the full cyber security glossary →
Official references
Related courses
Ethical Hacking & Pentesting
Rules of engagement, methodology and reporting for authorized testing in lab environments.
OT, ICS & IoT Security
Purdue model, ICS protocols, IEC 62443 zones and conduits, and securing connected devices.