Stage 1 of 9 · 7 lessons · ~4 weeks

Security foundations for AI builders

The security ideas every AI security task stands on: threat modelling, trust boundaries, least privilege, secrets, the classic web weaknesses AI apps inherit, and the rules on what you may test.

Start: Threat modelling in four questions

Lessons· one lesson for each topic, in this order

Do this

Draw a threat model diagram for one small web app and answer the four questions.
Mark every trust boundary on it with a dashed line.
Move every secret in your projects out of code and scan your repositories with Gitleaks.
Complete three web security labs on injection, XSS and access control.
Write your own one-paragraph rules of engagement for practising on apps you own.

Start with· follow one of these

RoadmapFree
Sefism Cybersecurity Roadmap
Sefism · Beginner
Sefism's general security roadmap, for any foundation in this stage you want to study in more depth
CourseFree
Professor Messer's Security+ (SY0-701) Course
Professor Messer · Beginner
Free videos covering the core security concepts, from access control to cryptography

Practise

Web Security Academy
Free labs on injection, XSS, access control and SSRF, the weaknesses AI apps inherit
OWASP Juice Shop
A deliberately vulnerable web app to run locally and practise finding and fixing classic bugs

Keep handy

OWASP Cheat Sheet Series
Short, reliable guides on threat modelling, secrets, output encoding and SSRF prevention
Gitleaks
Scan your repositories for committed keys before you build anything with a model API

Also worth your time

Threat Modeling Cheat Sheet (opens in a new tab)Read
The four questions, diagrams and STRIDE in one practical page
OWASP Application Security Verification Standard (ASVS)Go deeper
Turn "secure enough" into testable requirements for the apps you build

Before moving on: A one-page note in your own words on threat modelling, trust boundaries, least privilege, secrets and the classic web weaknesses, plus a threat model diagram of one ordinary web app with its boundaries marked.

Tauseef's advice

If you have no security background, do this stage properly, and use the Cybersecurity roadmap at /roadmaps/cybersecurity/ for anything that feels thin. AI security is ordinary security with a new and slippery component in the middle. People who skip the basics end up collecting prompt tricks; people who know them design systems where tricks do little harm.