Stage 1 of 9 · 7 lessons · ~4 weeks
Security foundations for AI builders
The security ideas every AI security task stands on: threat modelling, trust boundaries, least privilege, secrets, the classic web weaknesses AI apps inherit, and the rules on what you may test.
Start: Threat modelling in four questionsLessons· one lesson for each topic, in this order
Do this
- Draw a threat model diagram for one small web app and answer the four questions.
- Mark every trust boundary on it with a dashed line.
- Move every secret in your projects out of code and scan your repositories with Gitleaks.
- Complete three web security labs on injection, XSS and access control.
- Write your own one-paragraph rules of engagement for practising on apps you own.
Start with· follow one of these
- RoadmapFreeSefism Cybersecurity Roadmap
Sefism · Beginner
Sefism's general security roadmap, for any foundation in this stage you want to study in more depth
- CourseFreeProfessor Messer's Security+ (SY0-701) Course
Professor Messer · Beginner
Free videos covering the core security concepts, from access control to cryptography
Practise
Keep handy
Also worth your time
The four questions, diagrams and STRIDE in one practical page
- roadmap.sh: Cyber SecurityGo deeper
A map of the wider security field, so you know where AI testing sits
Before moving on: A one-page note in your own words on threat modelling, trust boundaries, least privilege, secrets and the classic web weaknesses, plus a threat model diagram of one ordinary web app with its boundaries marked.
Testers who skip the basics write weak reports. Before you test anything AI, make sure you can explain each classic web weakness, rate a finding honestly and write rules of engagement from memory. The Cybersecurity roadmap at /roadmaps/cybersecurity/ covers the general side in depth if you need it.