Your organisation is adding assistants, AI features and agents faster than anyone has reviewed them. This self-paced practitioner course teaches IT, security, risk and engineering staff to map where an AI application can be attacked, model its threats, layer defences against prompt injection and data exposure, limit what agents can do, question vendors, run the first hour of an incident and write a control plan. You practise on Pinecrest Outfitters, a fictional retailer, in browser labs. About 17 hours over 6 weeks.
Bodhih AI Security for Professionals: Practitioner is a self-paced online course for security analysts, IT administrators, developers, risk staff and product owners. In about 17 hours it teaches how to map an AI application’s attack surface, build a threat model, defend against prompt injection and data exposure, set agent permissions, assess AI vendors, respond to an incident and write a control plan. Learners practise in browser labs on fictional systems and complete a reviewed capstone on one real AI use.
Facts on this page last checked by Siddharthan VGJ, Director, Bodhih Training.
An AI feature reads text from customers, documents and the web, and treats instructions and data alike. The usual security review asks about ports and patches; it does not ask what the assistant can retrieve, or what it can do on a user’s behalf.
Assurance is easy to give. The useful questions ask for evidence: where prompts and outputs are stored and for how long, whether your data trains anything, who can see the logs, and what happens when the model behind the product changes.
The strongest AI security training is built for full-time security engineers and priced to match. Most organisations need the larger group, the administrators, analysts, developers and risk owners, to make sound decisions about AI use this year.
You are asked to review AI features with no checklist that fits. You will learn a five-part map of any AI application, a threat model built on public frameworks, and layered controls you can argue for in a design review.
You switch the tools on. You will learn what an assistant can retrieve and for whom, how to respond to unapproved AI use without blame, and what must be logged before something goes wrong.
You build or own the feature. You will learn why no single control stops prompt injection, where to place human approval, and how to estimate an agent’s blast radius before launch.
You sign off or report upward. Picture your next risk committee with a control plan that names each risk, control, owner, test and review date, and states the residual risk in plain words.
This course is not for people who want hands-on exploitation of real models or cloud systems, or preparation for a penetration-testing role or an outside certification; a specialist lab-based programme is the right choice for that.
Four dated statements, each linked to its source.
The UK National Cyber Security Centre wrote that prompt injection may never be totally mitigated in the way SQL injection can be, because a language model draws no inherent line between data and instruction; the aim is to reduce likelihood and impact.
NCSC blog, “Prompt injection is not SQL injection (it may be worse)”, 8 December 2025Prompt injection is the first entry in the OWASP Top 10 for LLM Applications, 2025 edition, followed by sensitive information disclosure, supply chain, and seven more, including excessive agency.
OWASP Top 10 for Large Language Model Applications, 2025, 2025Anthropic reported an attack success rate of about 1% for its browser agent against an adaptive attacker given 100 attempts per environment, and wrote that this still represents meaningful risk.
Anthropic, “Mitigating the risk of prompt injections in browser use”, 24 November 2025A protective layer built around a language model by researchers at Google DeepMind and ETH Zurich solved 77% of benchmark tasks with provable security, against 84% for an undefended system: security had a measurable cost in usefulness.
Debenedetti and others, “Defeating Prompt Injections by Design”, arXiv:2503.18813, 24 March 2025Imagine being asked “is this assistant safe to launch?” and answering with a map, a ranked threat list and three controls, each with what it does not stop. The course measures you at the start and the end on parallel forms, and asks for a capstone: a paper review of one real AI use in your organisation, scored by a reviewer before you receive the credential.
Describe any AI application in five parts and name where each can be attacked, using four questions that expose weak design.
Model the threats to one AI feature against recognised public frameworks, rank them by likelihood and harm, and argue for a design change.
Tell direct from indirect injection, explain why it cannot be fully removed, and choose layered controls that reduce likelihood and impact.
Find the three paths by which data leaks through AI: what staff paste in, what the assistant can retrieve and what it says.
Set least privilege, a separate identity and human approval points for agents and connectors, and estimate the blast radius.
List the suppliers behind one AI feature and put questions to a vendor that separate evidence from assurance.
Decide what an AI system must log, spot signs of misuse, and run the first hour of an incident: contain, count, tell, fix.
Give every control an owner, a test and a review date, and report residual risk upward in plain words.
The pathway runs in order: a baseline assessment, eight modules (attack surface; threat modelling; prompt injection; data exposure; agents and tools; the AI supply chain; detection and response; governance), each with a hands-on lab and boosters two and seven days later, a reviewed capstone, and a final assessment that unlocks once the capstone is accepted.
Measured before you start and again on the same instrument at the end, so the change is recorded rather than claimed.
The baseline assessment, Form A: 20 scenario questions on all eight competencies, about 25 minutes. It is not pass/fail; it sets your baseline, and you take the parallel form at the end.
A five-part map of any AI application and four questions that find most of its weaknesses. Inspector lab: Pine's launch note, the plan for a fictional retailer's AI helpdesk.
A threat model for one AI feature, built with recognised public frameworks and ranked by likelihood and harm. Scenario Sim: The design review.
How direct and indirect prompt injection work, and why no single control stops them. Attack Lab: Break Pine, then defend it, against a fictional practice assistant with scripted behaviour.
Three paths by which data leaks through AI: what staff paste in, what the assistant can retrieve and what it says. Attack Lab: The poisoned document.
Least privilege, identity and approval points for AI agents and their connectors. Flight Deck mission: The overnight inbox, an agent with too many keys.
What to ask before you adopt a model, plugin or AI vendor, and how to read the answers. Inspector lab: Loomwell's security questionnaire (a fictional vendor).
What to log for an AI system, the signs of misuse and the order of work in an incident. Scenario Sim: The first hour.
A control plan that names each risk, control, owner, test and review date, and a report upward that states residual risk. Inspector lab: Pinecrest's draft AI control plan.
Review one real AI use in your organisation: an assistant, an AI feature, an agent or an AI tool your staff use. This is a paper review. Do not test or attack any system; only test systems you own or have written permission to test. Hand in one document of 1,500-2,500 words plus tables, in five parts: (1) the system map: the five parts, the data it touches and who uses it; (2) the threat model: at least eight threats checked against a recognised public framework and ranked by likelihood and harm; (3) controls: layered controls for prompt injection, data exposure and agent or tool permissions, each tied to a threat, with what still gets through; (4) suppliers and detection: the questions you would put to the vendor, what is logged and a first-hour plan for one incident; (5) the control plan: every control with an owner, a test, a review date and the residual risk, and who accepts it. Remove names, internal addresses, credentials and anything confidential first. If you cannot use a real system, use Pinecrest Outfitters (fictional) from the course and say so. A reviewer scores your work on five criteria (0-4 each). Met is 12 or more of 20, with every criterion at 2 or more and Controls at 3 or more. Feedback comes within 5 working days, and you may resubmit once.
The final assessment, loaded from Form B: 20 parallel scenario questions, about 25 minutes. Score 70% or more (3 attempts), with your capstone accepted, for the credential.
Finishing this pathway issues a credential backed by the evidence you produced along the way. It is verifiable by link and is also issued as an Open Badge 2.0, so an employer can check it without taking your word for it.
A five-part map and a ranked threat list, practised in the Inspector lab Pine’s launch note and the Scenario Sim The design review.
How both work and why defences must be layered, in the Attack Lab Break Pine, then defend it, on a fictional practice assistant with scripted behaviour.
What staff paste in, what the assistant retrieves and what it says, traced in the Attack Lab The poisoned document.
Least privilege, identity and approval points, flown in the Flight Deck mission The overnight inbox: an agent with too many keys.
Questions that ask for evidence, and how to read the answers, in the Inspector lab on a fictional vendor’s questionnaire.
Logging and the first hour in the Scenario Sim The first hour, then the Inspector lab on a draft AI control plan.
What comes with the course, and what the practice is like.
Pinecrest Outfitters (fictional) runs a customer assistant called Pine and is adding more AI tools. You review Pine’s launch note, sit in the design review, attack and defend Pine, trace a leak to a document, limit an inbox agent, question a vendor, run an incident and finish the control plan.
Attacks are described in words; no working attack text is taught. Notice how each defence you add stops some attempts and lets others through, which is the point of the lab.
The Third-Party and Vendor Security Risk Kit, The Ransomware and Cyber Incident Response Playbook, The ISO 42001 AI Management System Starter, The AI Use Policy and Governance Kit and The AI Agent Deployment Playbook.
Company seats with reporting on each learner’s progress, before-and-after scores and capstone status. One course serves security, IT, engineering and risk through the role lens.
Ask about team seats| What is compared | A typical AI security course | AI Security for Professionals at Bodhih |
|---|---|---|
| Audience | Full-time security engineers and red teams. | The wider group who decide how AI is used: IT, security, risk, engineering and product staff. |
| Practice | Cloud labs with real models and exploit tooling, or slides only. | Browser labs: scripted Attack Labs on fictional assistants, an agent mission, sims and Inspector labs. Nothing to install. |
| Price and time | Several days of live training at specialist prices. | About 17 hours, self-paced, at $124. |
| Claims about defences | A product or technique presented as the fix. | Every control is taught with what it does not stop; a capstone that claims a complete defence cannot pass. |
| Output | An exam score. | A reviewed threat model and control plan for one real AI use in your organisation, plus a before-and-after score. |
| Honest limit | Hands-on exploitation of real systems. | No real model, cloud infrastructure or exploit tooling. Not preparation for penetration testing or an outside certification. |
No ratings yet. Only people who have bought this pathway can rate it - every buyer gets a one-click rating link a couple of days after their purchase.
Straight answers on time, price, tools and the credential. If yours is not here, ask us and you will have a reply the same working day.
Security analysts and engineers, IT administrators, developers building AI features, risk, compliance and audit staff, product owners and managers responsible for AI tools. A role lens with seven options switches the examples to your work. No model-building or coding skill is assumed.
No. The Attack Labs are scripted simulations with fixed behaviour against fictional practice assistants, and attacks are described in words. No real model, cloud infrastructure or exploit tooling is used. The course does not prepare you for a penetration-testing role. Only test systems you own or have written permission to test.
Prompt injection is text that makes an AI system follow an attacker’s instructions instead of its owner’s. In direct injection the attacker types it; in indirect injection it arrives inside content the system reads, such as a web page, an email or a document. The UK’s national cyber agency has written that it may never be fully removed, so Module 3 teaches layered controls that reduce likelihood and limit impact.
Public ones: the OWASP Top 10 for LLM Applications (2025), NIST’s taxonomy of attacks on AI systems, and published guidance from national cyber agencies and major AI builders. Each is named in the module where it is used. The course is not endorsed by any of these bodies and does not prepare you for their certifications.
About 17 hours: eight modules of about 90 minutes, a 25-minute assessment at the start and at the end, and a capstone of about four hours. Most people finish in about 6 weeks at two modules a week. Short booster questions arrive two and seven days after each module.
A paper review of one real AI use in your organisation, in five parts: a system map, a threat model of at least eight ranked threats, layered controls with what still gets through, suppliers and detection, and a control plan with owners, tests and review dates. A reviewer scores five criteria and one resubmission is allowed. You do not test or attack anything, and you remove confidential details first. If you cannot use a real system, you use the Pinecrest case.
No course can promise that, and this one does not. It teaches you to find the weaknesses, choose controls that reduce risk, say plainly what each control does not stop, and put a named owner on what remains.
Yes. When your capstone is accepted and you pass the final assessment (70%, with up to three attempts), you receive the Bodhih AI Security for Professionals credential with an Open Badge 2.0, a verify page and a PDF that shows your before-and-after result. It is a Bodhih credential, not a university qualification.
Yes. Until 10 January 2027 the price shown on this page is a launch price, about half the regular price. After that date the regular price applies.
Yes. Company seats are $99 each, with reporting on progress, before-and-after scores and capstone status. Write to solutions@bodhih.com or call +91 99000 11601 for seats or a rollout.
The course is $124 for an individual, or $99 per seat for companies. You can start today with the baseline assessment, then map your first AI application in Module 1. For a team, write to solutions@bodhih.com or call +91 99000 11601.
Starting records where you stand today. That baseline is what the re-measurement is compared against, and it is never rewritten afterwards.
Lead your team’s AI use safely and lawfully: the 2026 rules, three Scenario Sims and a real AI register entry.
For working developers: give AI coding tools the right context, plan in small steps, supervise an agent and catch what it gets wrong in review and tests.
Cybersecurity awareness for every employee: spot phishing on every channel, verify payment requests and report fast, with hands-on sims.
Measure your team first, plan each person’s growth after, or bring a trainer or coach in. Bodhih’s sister companies cover the rest of the journey.