AI Security Engineer Foundations & Certificate

Gain a practical understanding of the key security risks introduced by agentic AI applications. This module explains how risk changes when AI systems can reason, plan, use tools, access memory, interact with other agents, and take actions across business workflows.

By the end of this module, you will be able to:

• Explain why the OWASP Top 10 for Agentic Applications exists and how it differs from the OWASP Top 10 for Web Applications and OWASP Top 10 for LLM Applications.

• Describe how agentic AI changes the security model through goals, tools, memory, identity, permissions, orchestration, and downstream actions.

• Define the ten agentic risks: Agent Goal Hijacking, Tool Misuse, Identity and Privilege Abuse, Agentic Supply Chain Vulnerabilities, Unexpected Code Execution, Memory and Context Poisoning, Insecure Inter-Agent Communication, Cascading Failures, Human-Agent Trust Exploitation, and Rogue Agents.

• Distinguish between model-level risks, application-level risks, tool-layer risks, identity risks, memory/context risks, and downstream system risks.

• Map each risk to practical controls such as least privilege, scoped identities, tool allowlisting, approval gates, memory isolation, context validation, supply chain review, runtime monitoring, and audit logging.

• Explain how one agentic weakness can escalate into a larger attack chain, such as goal hijacking leading to tool misuse, privilege abuse, data exposure, or unsafe automation.

• Differentiate between AI systems that only recommend actions and agentic systems that can execute actions, and explain why execution changes governance and accountability.

• Use the OWASP Top 10 for Agentic Applications as a shared taxonomy for threat modeling, red teaming, architecture review, secure design, control mapping, and incident-response planning.

• Assess whether an agent is operating within safe boundaries: what it can do, whose authority it uses, what data it can access, which tools it can call, and how its actions are logged and approved.

Step into the shoes of the AI Security Engineer to navigate the "unexpected things" that surface when you look under the hood of your AI posture.

• Understand how an AI Security Engineer gets started and operates at the intersection of platform security, ML engineering, and threat intelligence.

• Learn the tools required to uncover “Shadow AI” and how security conversations are now changing within organizations.

• Learn how to provide intelligence and policy enforcement for autonomous AI without slowing down innovation.

By the end of this module, you will be able to:

• Define Shadow AI and articulate the characteristics that distinguish it from Shadow IT.

• Cite the headline 2025–2026 data points on the prevalence and cost of Shadow AI.

• Recognize the four properties that make Shadow AI structurally harder to govern than its predecessors.

• Identify the four most common Shadow AI risk scenarios in enterprise environments.

• Define an AIBOM and describe the three functions it performs in an AI governance program.

• Compare AIBOM and SBOM across scope, behavior, risk classes, update cadence, standards, and supply chain.

• Identify the four anti-patterns most commonly observed in Shadow AI programs and explain why each fails.

• Generate an AIBOM for a sample project using the Snyk CLI and inspect the result inside the Evo platform.

This module introduces you to AI Threat Modeling: the structured practice of identifying, analyzing, prioritizing, and mitigating threats specific to AI-powered systems. Building on traditional threat modeling fundamentals (STRIDE, DREAD, attack trees), the module explores why conventional approaches fall short when applied to probabilistic, non-deterministic AI systems, and walks through a practical workflow for modeling threats across the AI/ML lifecycle, from data ingestion to inference to agentic tool invocation.

By the end of this module, you will be able to:

• Define threat modeling and articulate its role in a modern DevSecOps pipeline.

• Apply traditional threat modeling frameworks (STRIDE, DREAD, attack trees) to system architecture.

• Identify the unique threat surface introduced by AI/ML systems, including agentic AI.

• Recognize new asset classes and trust boundaries specific to AI systems.

• Execute a practical AI threat modeling workflow covering discovery, enumeration, prioritization, and mitigation.

• Integrate AI threat modeling into a continuous, adaptive DevSecOps pipeline.

How SKILL.md Introduced Malware

The first part of this session will dive into the "ToxicSkills" research, where we will dissect the first major supply-chain threats targeting AI agent ecosystems.

In the second part of this session, we'll demonstrate active exploitation techniques against MCP deployments: how a single malicious tool description can exfiltrate credentials, and how attackers exploit insecure MCP Servers to run arbitrary code.

By the end of this module, you will be able to:

• Explain what the Model Context Protocol is, why it became necessary, and what an MCP server fundamentally is from a security standpoint.

• Articulate the three structural reasons MCP security is urgent in 2026: SDK download scale, agentic IDE adoption, and MCP's placement in the developer's most privileged context.

• Define tool poisoning and recognize how hidden instructions in tool descriptions can steer an agent into unsafe actions.

• Distinguish between two categorically different MCP failure modes, malicious MCP servers (the protocol layer) and vulnerable MCP server code (the implementation layer), and identify which defensive control addresses each.

• Recognize the canonical MCP attack patterns, tool poisoning, command injection, and path traversal, by code shape, and apply the standard remediation patterns to each.

• Run MCP-Scan against a local MCP configuration and interpret its findings, including W001/E001 tool-description warnings and TF001/TF002 toxic-flow alerts.

• Run Snyk Code against an MCP server's source and interpret its findings, including command-injection and path-traversal CWEs with AI-generated fixes.

• Articulate the defense-in-depth case for running both MCP-Scan and Snyk Code in a mature MCP security program.

In this session, we break down the security implications of Vibe Coding and share actionable strategies to secure AI-generated code at scale.

• Learn how Vibe Coding is reshaping development and the risks that come with it

• Get practical strategies to secure AI-generated code at scale

• See how Snyk secures your AI-powered SDLC from code to deployment using Snyk Studio

By the end of this module, you will be able to:

• Define vibe coding and explain its origins

• Describe the "Lobster Ecosystem", the constellation of agentic AI tools, agent skill registries, and open-source automation frameworks, and explain the supply-chain attack surface it introduces, with reference to agent skill poisoning and slopsquatting.

• Apply the five-layer Secure-by-Design Playbook to a vibe-coded project

• Identify the most common vulnerability patterns in AI-generated code, disabled row-level security, hardcoded secrets, missing authentication, client-side security logic, slop-squatting, rules file poisoning, and map each to the OWASP Top 10 for LLM Applications

• Distinguish vibe coding from vibe hacking

Gain a practical understanding of how to test AI-powered and agentic applications for security weaknesses. This module explains how AI penetration testing goes beyond traditional web and API testing by examining prompts, model behavior, context handling, tool access, memory, permissions, and downstream actions.

By the end of this module, learners will be able to:

• Explain how AI penetration testing differs from traditional application, API, and infrastructure testing.

• Identify AI-specific attack surfaces such as prompts, system instructions, RAG pipelines, embeddings, tools, agents, memory, plugins, and MCP-connected services.

• Test for common AI security weaknesses including prompt injection, sensitive information disclosure, system prompt leakage, excessive agency, unsafe output handling, context poisoning, and tool misuse.

• Build safe and repeatable test cases for AI applications without relying on harmful, uncontrolled, or production-impacting techniques.

• Evaluate whether an AI system properly separates trusted instructions from untrusted user input, retrieved content, documents, tickets, logs, or web pages.

• Assess how an AI agent selects tools, passes arguments, handles permissions, and prevents unsafe or unauthorized actions.

• Test whether sensitive data can leak through model responses, logs, traces, memory, vector search, tool outputs, or chained agent workflows.

• Map AI pen-testing findings to practical remediation steps such as input/output validation, tool allowlisting, scoped tokens, human approval gates, memory isolation, context filtering, and audit logging.

• Combine AI-specific testing with standard security testing for APIs, authentication, authorization, SSRF, injection, access control, dependency risk, and insecure configuration.

• Better understanding of EVO COS (Continuous Offensive Security)