Build LLM features that survive security review, using the OWASP LLM Top 10 and hands-on guardrails, in two days.
You work through the OWASP Top 10 for LLM applications with live examples, then build the input and output guardrails that hold those risks down in real code. The course counts toward the CyberSecAI AISVS assurance track and is taught by the former OWASP-AISVS Co-Leader (v1.0).
Two-day instructor-led course. Module order and grouping can be adjusted for private deliveries.
Walking through the OWASP LLM Top 10 with live code examples so you see what each risk looks like in a running application. Each risk is mapped to the matching AISVS control so you leave with a checklist tied to a recognised standard, not a list of slogans.
The patterns that make an LLM integration secure from the start. You study parameterised prompts, input validation, output encoding and fail-closed defaults so security is built into the design rather than bolted on after.
Where the trust boundary sits between your application code and the model. You map the point where your application hands data to the model and where it receives output back, and you treat both crossings as untrusted by default.
Treating everything the model returns as untrusted input to your application. You study why model output can contain injection payloads, hallucinated data and unsafe content, and you build the habit of validating and encoding every response before your application acts on it.
Applying the SQL injection lesson to LLMs. You build parameterised prompt templates where user input is data, never part of the instruction, so an injected instruction cannot change what the model is told to do. You test each template against known injection patterns.
Validating and sanitising user input before it reaches the model. You set up validation rules that reject obviously malicious input, strip control characters and encoding tricks, and enforce length limits so oversized payloads never enter the prompt.
Writing system prompts that are harder to override. You study how instruction hierarchy works, write system prompts with clear boundaries, and test them against override attempts so the model follows your instructions, not the attacker's.
Isolating user input from system instructions in the prompt. You use delimiters, role separation and structured templates to keep user-supplied text in a clearly marked data zone where the model treats it as content, not as a command.
The discipline of never trusting model output. You build output processing pipelines that validate, sanitise and encode every response before it reaches the user or triggers any downstream action in your application.
Validating model output against expected schemas and encoding it for the context where it will be used. You write validators that reject malformed responses and encoders that prevent model output from being interpreted as HTML, JavaScript or SQL in your application.
Stopping cross-site scripting and injection attacks that arrive through model responses. You study how a model can be tricked into generating payloads, and you build output encoding and content security policies that neutralise those payloads before they execute.
Filtering personally identifiable information and sensitive data from model output before it reaches the user. You configure output scanners that detect and redact PII patterns, credentials and internal data that the model should never surface in a response.
Setting up LLM Guard, Presidio and NeMo Guardrails in your application. You install each tool, configure it for your use case and wire it into the request and response pipeline so every prompt and every response passes through a guardrail before it continues.
Writing content policies that define what your guardrails allow and block. You set up topic restrictions, toxicity thresholds and custom rules, then test them against a range of inputs to tune the policy until it matches your requirements.
Running guardrail tests as part of your continuous integration pipeline. You write test cases that exercise each guardrail rule, wire them into your CI system and configure the build to fail when a guardrail regression is detected.
Understanding and managing the tradeoff between blocking harmful content and blocking legitimate requests. You measure false positive rates for each guardrail rule, adjust thresholds based on real traffic patterns and decide where your application can afford to be strict and where it needs to be lenient.
How function calling works and where it goes wrong. You study the flow from model decision through function selection to execution, identify the trust assumptions at each step, and build controls that prevent the model from calling functions it should not or passing arguments that are dangerous.
Giving each tool only the permissions it needs and nothing more. You configure tool-level access controls, scope each tool's authority to the minimum required and test that a compromised tool call cannot escalate beyond its granted permissions.
Checking every tool parameter against a schema before the function runs. You write parameter validators that reject unexpected types, out-of-range values and injection payloads so a malicious tool call is caught before it executes, not after.
A structured lab where you build a secure LLM integration from scratch. You implement parameterised prompts, input validation, output encoding and PII filtering, then test the integration against injection attempts and verify that every control holds.
A hands-on lab where you deploy and configure guardrails in a running application. You set up LLM Guard and Presidio, write content policies, wire the guardrails into CI and measure false positive rates against a test suite of legitimate and malicious inputs.
A lab focused on securing function calling and tool use. You configure least-privilege tool access, write parameter validators and test the controls against tool abuse scenarios where the model tries to call restricted functions or pass dangerous arguments.
Hands-on with the CyberSecAI tooling, not slideware.
A security gate that checks AI-generated code at the moment it is written.
Guardrail effectiveness scorer (bypass rate and false-block rate).
The OWASP-standards scanner run in your CI pipeline.
Signed record of the security checks that ran on each build.
Add LLM features to a product without opening a hole in it.
Stand up model and retrieval infrastructure that holds under attack.
Bring the LLM Top 10 and guardrails into your review remit.
Set the bar your team ships to, and know it will pass review.
This course counts toward the CyberSecAI AISVS assurance track. Assessment is practical: you build an LLM feature, separate its trust tiers, add input and output guardrails, secure the retrieval path, and wire the LLM Top 10 tests into CI.
Two days, hands-on, working the OWASP LLM Top 10 and building real guardrails, taught by the former OWASP-AISVS Co-Leader (v1.0). Places are limited.
Corporate & sovereign cohorts, and bespoke on-site delivery, on request.