AI Security Engineer Foundations & Certificate

Gain a deep understanding of the web’s most critical security risks through the lens of the latest OWASP Top 10 industry standard. This course moves beyond theoretical lists, teaching you how to identify root-cause vulnerabilities and implement modern defense strategies to harden your applications.

By the end of this module, you will be able to:

• Explain why the OWASP Top 10 for LLM Applications exists, what changed between the 2023 and 2025 versions, and why a separate framework was needed alongside the classical OWASP Top 10 for Web Applications.

• Define each of the ten 2025 risks: Prompt Injection, Sensitive Information Disclosure, Supply Chain, Data and Model Poisoning, Improper Output Handling, Excessive Agency, System Prompt Leakage, Vector and Embedding Weaknesses, Misinformation, and Unbounded Consumption, in their own words.

• Recognize each risk in a sample architecture or real-world incident and explain why it applies.

• Identify the primary defensive controls that map to each risk, and articulate the layered-defense reasoning that connects them.

• Distinguish between the risks that are properties of the model itself and those that are properties of the surrounding application, a distinction that guides where mitigations should be implemented.

• Use the OWASP Top 10 for LLM as a shared reference taxonomy in subsequent threat modeling, red teaming, and code-review activities throughout the rest of the program.

Step into the shoes of the AI Security Engineer to navigate the "unexpected things" that surface when you look under the hood of your AI posture.

• Understand how an AI Security Engineer gets started and operates at the intersection of platform security, ML engineering, and threat intelligence.

• Learn the tools required to uncover “Shadow AI” and how security conversations are now changing within organizations.

• Learn how to provide intelligence and policy enforcement for autonomous AI without slowing down innovation.

By the end of this module, you will be able to:

• Define Shadow AI and articulate the characteristics that distinguish it from Shadow IT.

• Cite the headline 2025–2026 data points on the prevalence and cost of Shadow AI.

• Recognize the four properties that make Shadow AI structurally harder to govern than its predecessors.

• Identify the four most common Shadow AI risk scenarios in enterprise environments.

• Define an AIBOM and describe the three functions it performs in an AI governance program.

• Compare AIBOM and SBOM across scope, behavior, risk classes, update cadence, standards, and supply chain.

• Identify the four anti-patterns most commonly observed in Shadow AI programs and explain why each fails.

• Generate an AIBOM for a sample project using the Snyk CLI and inspect the result inside the Evo platform.

This module introduces you to AI Threat Modeling: the structured practice of identifying, analyzing, prioritizing, and mitigating threats specific to AI-powered systems. Building on traditional threat modeling fundamentals (STRIDE, DREAD, attack trees), the module explores why conventional approaches fall short when applied to probabilistic, non-deterministic AI systems, and walks through a practical workflow for modeling threats across the AI/ML lifecycle, from data ingestion to inference to agentic tool invocation.

By the end of this module, you will be able to:

• Define threat modeling and articulate its role in a modern DevSecOps pipeline.

• Apply traditional threat modeling frameworks (STRIDE, DREAD, attack trees) to system architecture.

• Identify the unique threat surface introduced by AI/ML systems, including agentic AI.

• Recognize new asset classes and trust boundaries specific to AI systems.

• Execute a practical AI threat modeling workflow covering discovery, enumeration, prioritization, and mitigation.

• Integrate AI threat modeling into a continuous, adaptive DevSecOps pipeline.

How SKILL.md Introduced Malware

The first part of this session will dive into the "ToxicSkills" research, where we will dissect the first major supply-chain threats targeting AI agent ecosystems.

In the second part of this session, we'll demonstrate active exploitation techniques against MCP deployments: how a single malicious tool description can exfiltrate credentials, and how attackers exploit insecure MCP Servers to run arbitrary code.

By the end of this module, you will be able to:

• Explain what the Model Context Protocol is, why it became necessary, and what an MCP server fundamentally is from a security standpoint.

• Articulate the three structural reasons MCP security is urgent in 2026: SDK download scale, agentic IDE adoption, and MCP's placement in the developer's most privileged context.

• Define tool poisoning and recognize how hidden instructions in tool descriptions can steer an agent into unsafe actions.

• Distinguish between two categorically different MCP failure modes, malicious MCP servers (the protocol layer) and vulnerable MCP server code (the implementation layer), and identify which defensive control addresses each.

• Recognize the canonical MCP attack patterns, tool poisoning, command injection, and path traversal, by code shape, and apply the standard remediation patterns to each.

• Run MCP-Scan against a local MCP configuration and interpret its findings, including W001/E001 tool-description warnings and TF001/TF002 toxic-flow alerts.

• Run Snyk Code against an MCP server's source and interpret its findings, including command-injection and path-traversal CWEs with AI-generated fixes.

• Articulate the defense-in-depth case for running both MCP-Scan and Snyk Code in a mature MCP security program.

In this session, we break down the security implications of Vibe Coding and share actionable strategies to secure AI-generated code at scale.

• Learn how Vibe Coding is reshaping development and the risks that come with it

• Get practical strategies to secure AI-generated code at scale

• See how Snyk secures your AI-powered SDLC from code to deployment using Snyk Studio

By the end of this module, you will be able to:

• Define vibe coding and explain its origins

• Describe the "Lobster Ecosystem", the constellation of agentic AI tools, agent skill registries, and open-source automation frameworks, and explain the supply-chain attack surface it introduces, with reference to agent skill poisoning and slopsquatting.

• Apply the five-layer Secure-by-Design Playbook to a vibe-coded project

• Identify the most common vulnerability patterns in AI-generated code, disabled row-level security, hardcoded secrets, missing authentication, client-side security logic, slop-squatting, rules file poisoning, and map each to the OWASP Top 10 for LLM Applications

• Distinguish vibe coding from vibe hacking

This module is the offensive capstone of the AI Security Engineer Foundations track. It introduces red teaming as a discipline, distinguishes it from related security testing practices, explains why the AI era expanded the attack surface in ways traditional approaches were never designed to test, and walks through the benefits, anti-patterns, and best practices that define effective AI red teaming today. The module closes with a live demonstration against a deliberately vulnerable chatbot, and an asynchronous exercise that the learner completes in their own time.

By the end of this module, learners will be able to:

• Define red teaming and articulate its role alongside vulnerability scanning, penetration testing, and classical red team exercises.

• Distinguish red team and blue team roles in a security engagement.

• Read the four-row testing comparison table (vulnerability scan, penetration test, red team exercise, AI red teaming) and place a given activity into the right row.

• Explain why introducing an AI model into an application architecture expands the attack surface, and what kinds of issues red teaming uncovers that scanners do not.

• Recall the six benefits, six anti-patterns, and six best practices that define effective AI red teaming in practice.

• Configure a basic Snyk Agent Red Teaming engagement against a chatbot endpoint using a minimal YAML configuration.

• Successfully complete a hands-on exercise against a vulnerable chatbot.