Skip to main content
back to List back
on this page

AI-Powered Security Operations: Hardware to Agents

live online
price $3,200
Ahmed Essayed
Intermediate
5 Days
AI Focus
Sun 22 Nov - Thu 26 Nov
price $3,200
Register


Online, Available in English

Overview

Every enterprise wants an AI-powered SOC - a stack of LLMs, agents, and ML pipelines that triages alerts, hunts threats, and accelerates incident response. Most organisations are buying these capabilities off the shelf without understanding what is inside, how to extend them, or -critically- how to secure the AI stack itself. An AI defending the enterprise that is itself compromised is a worse outcome than no AI at all.

This 5-day, hands-on course teaches security engineers and architects how to build a production-grade AI security stack from silicon to agents, with security designed in at every layer. By the end of the week, attendees will have stood up a working reference stack protected GPU compute, signed model artifacts, a RAG-grounded SOC copilot, and a multi-agent investigation workflow - and battle-tested it in a live red-versus-blue capstone.

The course bridges a real gap in the market: most AI security training is either attack-only (prompt injection tricks) or application-only (build a chatbot). This one is build it, secure it, operate it, defend it - end-to-end, hands-on, full stack.

Topics

  • Foundations and Threat-Modelling the Stack
  • ML and LLM essentials for security engineers: transformers, embeddings, RAG, agents, MCP / A2A, evals.
  • Mapping the full AI security stack: silicon → infrastructure → model → application → agent → enterprise.
  • Threat-modelling each layer; framework overlay (NIST AI RMF, OWASP LLM Top 10, MITRE ATLAS, KSA NCA / SDAIA).
  • Hardware and Infrastructure Layer
  • Confidential computing for AI: NVIDIA H100/H200 confidential mode, Intel TDX, AMD SEV-SNP.
  • Hardware threats: side channels on accelerators, model extraction via timing, fault injection on edge AI, supply-chain risk.
  • Infrastructure hardening: GPU isolation, network segmentation, secrets, artifact signing.
  • Model Layer
  • Choosing models for security tasks: open-weight versus proprietary, on-premise versus API, sovereignty considerations.
  • Fine-tuning, LoRA, and RAG patterns for alert triage, threat-intel, malware classification, log summarisation.
  • Model security: training-data poisoning, backdoors, model theft, supply-chain risk, MLOps pipeline hardening.
  • Application and Orchestration Layer
  • LLM application architecture for security operations: SOC copilot, IR assistant, threat hunter.
  • Application-layer attacks: direct and indirect prompt injection, jailbreaks (GCG, PAIR, TAP, Crescendo), exfiltration.
  • Defence engineering: input/output filtering, structured outputs, sandboxing, content provenance, eval-gated deployment.
  • Agentic and Enterprise Layer (Capstone)
  • Agent architectures for security: single-agent → multi-agent → MCP / A2A; tool-use safety.
  • Agent threat models: hijacking, goal-drift, prompt smuggling via tool outputs; enterprise integration with SIEM / SOAR.
  • Capstone CTF: red-versus-blue exercise against the stack attendees built across the week.
     

Target Audience

  • Security engineers and architects designing AI-augmented SOCs, threat-hunting platforms, or automated incident-response tooling.
  • Red teamers who need to attack — and understand the inner workings of — enterprise AI systems.
  • ML and AI engineers moving into security-sensitive domains: regulated industries, government, critical infrastructure.
  • Security leaders evaluating sovereign-AI deployments in KSA and GCC contexts who want hands-on grounding rather than vendor decks.

By the end of this course, the participant will be able to: 

  • Design and build a secure AI security stack spanning GPU infrastructure, models, applications and AI agents.
  • Threat-model AI systems end-to-end, identifying security risks across the infrastructure, model, application and agent layers.
  • Secure GPU and AI infrastructure, including confidential computing, isolation, segmentation, secrets management and artifact integrity.
  • Select and deploy AI models for security use cases, balancing capability, security, privacy, sovereignty and operational requirements.
  • Build RAG-powered security applications for use cases such as alert triage, threat intelligence and incident response.
  • Identify and defend against AI-specific attacks, including prompt injection, jailbreaks, data poisoning, model theft and agent hijacking.
  • Secure AI applications and agent workflows using controls such as sandboxing, filtering, structured outputs, provenance and evaluation gates.
  • Integrate AI agents with enterprise security tooling such as SIEM, SOAR and security data sources while controlling tool access and actions.
  • Evaluate and harden AI systems before production, using security testing, adversarial evaluation and operational controls.
  • Attack and defend a complete AI security stack through a hands-on red-versus-blue capstone exercise.