Design AI systems that are secure before a line ships. Threat model agents, RAG and pipelines against AISVS.
Two-day instructor-led course. Module order and grouping can be adjusted for private deliveries.
Why STRIDE, PASTA and other traditional threat modeling methods miss the threats that are unique to AI systems. You study the categories of AI-specific threat that do not map cleanly to spoofing, tampering or information disclosure, and you learn where the traditional methods need to be extended or replaced.
Mapping the full AI threat surface across data, model, inference, tools, agents and memory. You draw the threat surface for a representative AI system and identify every component that an attacker can reach, from training data through the model weights to the tools the model calls and the memory it reads from.
Building a threat model that covers AI-specific threats from scratch. You work through scope definition, asset identification, threat enumeration and risk ranking for an AI system, producing a threat model that addresses prompt injection, model poisoning, tool abuse and data leakage alongside traditional application threats.
Using MITRE ATLAS as a structured library of adversary tactics and techniques for AI systems. You navigate the ATLAS matrix, map its techniques to your threat model and use it to identify threats you might have missed during your own enumeration.
Threat modeling an application that integrates an LLM. You identify the trust boundaries between your application code and the model, enumerate the threats at each boundary and document the controls needed to keep prompt injection, data leakage and unsafe output from reaching the user.
Threat modeling a retrieval-augmented generation pipeline. You trace the path from document ingestion through embedding and retrieval to context assembly, identify the poisoning, injection and leakage threats at each stage and map the controls that defend each one.
Threat modeling a system where the model can call tools and take actions. You identify the threats introduced by tool use, including confused deputy, parameter injection and excessive authority, and you design the controls that keep each tool call within its intended scope.
Threat modeling a deployment that uses the Model Context Protocol. You identify the MCP-specific attack surface including server impersonation, tool poisoning and context injection, and you map the controls from MCPS that address each threat.
Threat modeling a multi-agent system where multiple agents communicate, delegate and share state. You identify the threats that multiply with every agent you add, including trust propagation, authority laundering and injection that cascades across agents, and you design the controls that contain each one.
A reference architecture for building a secure LLM application with controls already placed on the diagram. You study the architecture, understand where each control sits and why, and learn how to adapt the pattern for your own application while keeping the security properties intact.
A reference architecture for a secure RAG pipeline covering ingestion, embedding, retrieval and generation. You study how tenant isolation, provenance tracking and retrieval filtering are built into the architecture from the start rather than added as afterthoughts.
A reference architecture for running a secure agent estate with per-agent identity, scoped delegation and kill switches. You study how agent-to-agent trust, tool authorisation and blast radius containment are designed into the architecture.
Mapping each reference architecture to the AISVS control families it satisfies. You produce a control mapping for each architecture that shows which AISVS requirements are met, which are partially met and which need additional work, so you can demonstrate compliance to an auditor.
Applying defence in depth to AI systems so no single control is a single point of failure. You layer training-time alignment, input validation, output encoding, tool authorisation and monitoring so an attacker who bypasses one layer still faces the next.
Giving each agent only the permissions it needs and revoking them the moment they are no longer required. You design permission models that scope each agent's access to the minimum required for its current task and prevent authority from accumulating across tasks.
Designing AI systems that fail closed when something goes wrong. You study the failure modes that lead to open-fail conditions where the model, the guardrail or the tool authorisation defaults to permissive, and you redesign each one so the system stops rather than proceeding unsafely.
Setting secure defaults that prevent the common architectural mistakes teams make when they build AI systems quickly. You review the most frequent insecure defaults in LLM integrations, RAG pipelines and agent systems, and you set the configuration that makes the safe choice the easy choice.
A structured lab where you build a complete AI threat model for a provided system. You identify assets, draw trust boundaries, enumerate threats using MITRE ATLAS, rank risks and produce a threat model document that you can take back to your organisation and apply to your own systems.
A hands-on lab where you review a provided AI architecture against the threat model and the AISVS controls. You identify gaps, propose mitigations and produce an architecture review report with findings and recommendations.
A lab focused on applying secure design patterns to a flawed architecture. You take a system that was built without security controls, apply defence in depth, least privilege, fail-closed and secure defaults, and test that each pattern holds against the threats identified in the threat model.
Hands-on with the CyberSecAI tooling, not slideware.
Generates an AI threat-model diagram and an AISVS control checklist from a system description.
Validates the design once it is built and running.
Checks the implemented architecture against the OWASP standards.
Records the design-review decisions and control acceptance.
Design AI systems you can secure and defend by design.
Set the controls before the first line of code ships.
Bring threat modeling discipline to LLMs, agents and RAG.
Design new systems on AISVS-aligned reference patterns.
This course counts toward the CyberSecAI AISVS assurance track. You leave with a threat model, a set of reference patterns, and a concrete control set your engineers can build against, all mapped to AISVS control families.
Two days, hands-on, taught by the former OWASP-AISVS Co-Leader (v1.0). You threat model agents, RAG and pipelines, map the controls that matter, and hand engineering a reference architecture they can build. Places are limited.
Corporate & sovereign cohorts, and bespoke on-site delivery, on request.