Sefism AI Security Roadmap

What this roadmap is

AI security is Sefism's nine-stage path for securing LLM applications and AI agents, or for testing them as a red-teamer. It treats AI security as ordinary security with a new and slippery component in the middle: a model that reads instructions and data in the same channel and can be talked into things. So it starts with security foundations, has you build a small LLM app with retrieval and tools, and then spends the rest of the roadmap defending and testing that same app.

By the end you should be able to:

• threat model an LLM app or agent: trust boundaries, data flows, tools and the worst a fooled model could do
• explain each OWASP Top 10 for LLM Applications risk, the agentic risks and MITRE ATLAS techniques in plain words, with the defences that work
• build layered defences against prompt injection: input and content guards, output guards, privilege separation and human approval
• secure agents, tools and MCP servers with narrow permissions, proper token handling, sandboxes and egress control
• check the data and model supply chain: poisoning, unsafe model files, provenance and leakage of data and system prompts
• test AI systems within written rules of engagement with garak, PyRIT, promptfoo and Inspect, and report findings clearly
• monitor an AI app in production, respond to AI incidents and turn each one into a regression test

The roadmap stays on the design side throughout. It deliberately avoids a collection of jailbreak prompts: tricks go stale in months, while least privilege, privilege separation and good tests last for years.

Two paths

You choose a path when you add the roadmap, and the stages, topics, milestones and projects adjust to it:

• App and agent security (the default): build LLM apps, agents and MCP servers that hold up. Your milestones end in a hardened practice app with a security eval suite running in CI.
• Red-teaming and evaluation: test models and apps for failures, within the rules. Your milestones end in a full assessment of your own practice app, with a test plan, scored results and a professional report.

Both paths share the same nine stages and about 230 hours, with 66 topics each.

Who it suits, and who should start elsewhere

It suits developers who build or will build LLM features, AppSec and security engineers who have been handed "the AI stuff", testers and ML engineers who want to own AI risk on their team, and students who want a specialism with growing demand.

It assumes you can program and have called an LLM API. If you cannot yet build a small app, start with Programming foundations and then AI engineering. If you have no security background at all, the first stage covers the essentials, and its advice is to lean on the Cybersecurity roadmap for anything that feels thin. If governance, regulation and audit interest you more than technical testing, see AI governance.

Time and pace

The estimate is about 230 hours across 9 stages. How that becomes weeks depends on the hours you set on your dashboard:

• A student with 10 to 12 hours a week finishes in roughly 19 to 23 weeks, about a semester. A sensible week is two evenings on topics and one long block on the milestone, always against your own practice app.
• Someone working full time with about 5 hours a week should plan for around 46 weeks. Keep the practice app small: the point is to defend and test it, not to polish its features.

The first stage, Security foundations for AI builders, is a foundation stage: if you are already comfortable with threat modelling, least privilege and the classic web weaknesses, it can be skipped.

Stage by stage

1. Security foundations for AI builders (20 hours)

Threat modelling in four questions, trust boundaries and untrusted input, least privilege, secrets, the web weaknesses AI apps inherit, and permission, scope and the law (what you may test). The app and agent path adds secure defaults and layers; the red-team path adds severity when failures are probabilistic. Milestone: a one-page note on these ideas in your own words, plus a threat model diagram of one ordinary web app with its boundaries marked.

2. How LLM apps and agents work, and where they break (25 hours)

How a request becomes a context window, why instructions and data share one channel, where retrieval goes wrong, the agent loop as an attack surface, probabilistic behaviour, and the combination of private data, untrusted content and a way out. You also build the app you will defend and test for the rest of the roadmap. Milestone: your own small LLM app in Git with a system prompt, retrieval over a few documents and two harmless tools, plus a diagram of every way in and every way out.

3. Risk maps: the OWASP lists and MITRE ATLAS (20 hours)

The OWASP Top 10 for LLM Applications (2025 edition), old web risks through new doors, the OWASP Top 10 for Agentic Applications, MITRE ATLAS, NIST AI 100-2 and Google SAIF as optional extra maps, and threat modelling an AI feature with them. Milestone: a two-page threat model of your practice app with the applicable OWASP and ATLAS entries; app builders add a control and a test per risk, red-teamers a coverage plan for testing.

4. Prompt injection and layered defences (30 hours)

Where injected instructions come from, why no single filter fixes it, input and content guards, output guards and safe rendering, privilege separation and safer agent designs, and human approval people actually read. No payloads. Milestone: for app builders, layered defences in your practice app with a test for each layer; for red-teamers, an injection test plan that pairs every content source with every impactful action, with success rates recorded over many attempts.

5. Agent, tool and MCP security (30 hours)

Tool permissions, the confused deputy, trusting an MCP server, MCP authorisation with tokens, audience and scopes, isolating code the agent runs, egress control, and memory and state leaks across users. Milestone: your practice agent locked down with narrow tools, a reviewed and sandboxed MCP server, no token passthrough, isolated code execution and an egress allow list; red-teamers instead build a sandboxed harness with fake tools that record every call.

6. Data and model supply chain (25 hours)

Poisoned training and retrieval data, model files that run code, provenance, model cards and signing, an AI bill of materials, leaking sensitive data and system prompts, with model theft and hallucinated packages as optional topics. Milestone: a supply chain review of your practice app: an AI bill of materials, safe model formats, publisher and licence checked, one model signed and verified, and a system prompt with nothing in it you would mind leaking.

7. Testing: red-teaming and safety evals (35 hours)

The longest stage: scope and permission for AI tests, red-teaming versus evals, a test plan from the risk list, garak, PyRIT, promptfoo and Inspect by purpose, scoring with rules, classifiers and LLM judges, reporting a weakness so it gets fixed, and what AI vulnerability programmes reward. Milestone: app builders end with a security eval suite running in CI on every prompt, model, tool or retrieval change; red-teamers with a full assessment and professional report on their own practice app.

8. Monitoring and incident response for AI apps (20 hours)

What to log for every model and tool call, keeping those logs private, signals worth an alert, kill switches, an AI incident playbook, cost abuse and unbounded consumption, and turning every incident into a test. Milestone: tracing, restricted logs, five alerts with thresholds, working kill switches, a one-page playbook, hard cost limits and one simulated incident turned into a regression test.

9. Career: roles, certifications and a first job (25 hours)

Where AI security work actually sits, AI security certifications assessed honestly, a portfolio piece for your path, contributing to open source AI security tools, responsible disclosure, keeping up without chasing every jailbreak, and a realistic route to a first role. Milestone: a public profile with your portfolio piece, one open source contribution, a certification plan with honest timing and ten tailored applications to nearby roles.

Projects that fit

The roadmap suggests five final year project ideas per path:

• Prompt injection regression test harness for RAG support chatbots and a model file supply chain scanner with an AI bill of materials, for both paths
• For app and agent security: an AI agent tool permission gateway with human approval, a guarded text-to-SQL assistant and Urdu and English personal data redaction before cloud AI prompts
• For red-teaming: a prompt injection red-team harness for tool-using agents, an MCP server behaviour sandbox and an evaluation harness for language model applications

How it works on Sefism

Everything on Sefism is free to learn from. The public page at AI security shows the full list of nine stages for your chosen path, with the first two stages open: their topics, milestones and recommended material. Later stages show their title, summary, hours and topic count.

To open every stage, add the roadmap to your dashboard. Adding a roadmap uses credits, new members get starting credits when they join, and your first roadmap is free. Once it is on your dashboard you can:

• open every stage, its topics, checks, AI study prompts and recommended material
• tick stages off and track your progress, at a pace set by the hours you have each week
• keep the companion AI security cheat sheet, which comes with the roadmap
• ask Tauseef a question about any stage, or book a 1:1 session if you want to talk your plan through

If you are new, create a free account first. Credits are there so the platform goes to people who are actually learning, and if you run out while learning seriously, you can ask for more.

The companion cheat sheet

The AI security cheat sheet follows the same nine chapters, with each attack class next to the defences that work, the guard layers, MCP and agent checks, the OWASP LLM Top 10 map and the testing tools, and the classic mistake beside each idea. It comes in two editions, one per path. Use it to revise after each stage and as a checklist before you ship or test an AI feature.

Related on Sefism

• How do I get into AI security as a student or junior engineer?
• What is MCP, and do I need to learn it?
• Getting into cybersecurity as a fresh graduate
• Library picks used in the stages: OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic Applications, MITRE ATLAS, MCP Security Best Practices, garak, PyRIT and promptfoo
• Related roadmaps: Cybersecurity, AI agents and MCP and AI governance

What you can do afterwards

You can show an employer a practice app you defended or assessed end to end, with a threat model, tests that run on every change and findings written up properly. From here, AI agents and MCP deepens the building side, Cybersecurity broadens your general security base, and MLOps and LLMOps covers running AI systems in production.

Frequently asked questions

How long does it take to learn AI security? The roadmap estimates about 230 hours. At 10 to 12 hours a week that is roughly 19 to 23 weeks; at 5 hours a week it is closer to 46.

Do I need a cybersecurity background first? No, but you need the basics. Stage 1 covers threat modelling, trust boundaries, least privilege, secrets and the classic web weaknesses, and points to the Cybersecurity roadmap for anything that feels thin.

Which path should I choose? App and agent security if you build software and want your features to hold up; red-teaming and evaluation if you enjoy breaking things and writing them up. Both cover the same risks.

Is it legal to test chatbots for prompt injection? Only systems you own or have written permission to test, public chatbots included. The roadmap teaches rules of engagement in stage 1 and again before any testing in stage 7.

Is there a job called AI security engineer? A few, but most people start as developers, AppSec engineers, testers or ML engineers and become the person their team trusts with AI risk. Stage 9 covers that route and the certifications worth considering.