AI Security Course Syllabus

One of the few structured AI security programs running in India. Covers testing LLM applications the way you would test any other application, because the vulnerabilities that cause real damage are in the plumbing around the model, not the model itself.

For the foundation concept, read prompt injection explained.

Module 1: How LLM Applications Are Built

• Model, context window, system prompt and why the separation does not exist
• Retrieval augmented generation architecture
• Agents, tool calling and autonomous chains
• Where trust boundaries actually sit in an AI stack

Module 2: Prompt Injection

• Direct injection: instruction override, role reassignment, system prompt extraction
• Encoding and obfuscation bypasses
• Indirect injection through documents, web pages, email and tickets
• Why input filtering and delimiters do not solve it
• Measuring impact by capability rather than by successful injection

Module 3: Data Exfiltration

• Exfiltration through rendered markdown and image URLs
• Tool chaining as an exfiltration primitive
• Cross user context contamination
• Training data and system prompt leakage

Module 4: Agent and Tool Security

• Over permissioned tools as the real vulnerability
• Confused deputy problems in agent architectures
• Chaining an injection into an unauthorised action
• Where human confirmation belongs

Module 5: RAG and Supply Chain

• Retrieval poisoning through user submitted content
• Vector store access control
• Model and dependency supply chain risk
• Third party plugin and integration review

Module 6: Classical Vulnerabilities in AI Applications

The module that produces the findings clients actually care about.

• SSRF via model browsing capability
• Broken access control in AI feature endpoints
• Injection through unsanitised model output reaching a shell, eval or SQL context
• Authorisation gaps between the AI layer and the underlying data

Module 7: Defences That Hold

• Treating all model output as untrusted input
• Least privilege on tools and scoped credentials
• Egress restriction and domain allowlisting
• Human in the loop for consequential actions
• Context isolation per user and per source
• Logging the full context for incident review

Module 8: Assessment Methodology and Reporting

• Scoping an AI assessment by enumerating capability first
• Test case design and coverage
• Evidence capture for non deterministic systems
• Writing impact rather than cleverness

Why this is worth learning now

A tester who already understands SSRF, XSS and broken access control picks this up fast. Someone who only knows prompt tricks does not, because they cannot recognise impact when they find it.

Enrol in the AI Security program

Verify every module against your actual delivered curriculum before publishing.

Frequently asked questions

Do I need machine learning knowledge for AI security?

No. This is application security applied to AI systems. You need to understand how the application is built, not how to train a model.

Is prompt injection the whole course?

No. Prompt injection is the foundation, but the findings that matter come from what the model can reach: tool access, data access and unsanitised output reaching dangerous contexts.

Can prompt injection be fixed?

Not the way SQL injection was fixed. There is no parameterisation equivalent separating instructions from data. Defence focuses on limiting what a successful injection achieves.

Who is this course for?

Security testers adding AI to their scope, developers building AI features, and anyone entering security who wants a specialisation with very little competition.

Is there demand for AI security skills in India?

Demand is rising as companies ship AI features, and the talent pool is thin. Low competition in a rising category is the cheapest authority you will build.

Do I need prior security experience?

It helps considerably. Existing application security knowledge transfers directly. Without it you can still follow the course but expect to work harder on module 6.