PUBLIC ROADMAP

AI Security Engineer roadmap

A metadata-only view of the sequence, milestones, and free-preview boundary.

AVAILABLE CURRICULUM: 35 units
Free preview: 3 free-preview units

Threat-Modeled AI Application and First Security Gate

First Attack

Launch the ready-made Aegis Vulnerable AI Lab, reproduce a deterministic cross-tenant security failure, implement and verify tenant-scoped retrieval, map the AI data flow and trust boundaries, implement object authorization through a second learner-owned policy seam, convert observed threats into testable requirements, and pass a cumulative attack-plus-utility gate.

Aegis Vulnerable AI LabThreat-Modeled AI ApplicationFirst Exploit + Tenant Boundary + Threat Model

6 units

01
Launch Aegis and reproduce the first security failure
A01 · Starter path
02
Fix the first tenant boundary and prove utility
A02 · Starter path
Milestone
03
Map the AI data flow and trust boundaries
A03 · Starter path
Milestone
04
Strengthen identity, authorization, and tenant context
A04
05
Build the threat model and verification requirements
A05
06
Threat-Modeled AI Application capstone
A06
Milestone

Your phase progress will appear here after account access is connected.

Secure RAG and Data Boundaries

Secure RAG

Reproduce a direct and an indirect prompt-injection case against the local Aegis lab, implement a retrieved-content-trust boundary so authorized content stops acting as instruction, extend authorization across retrieval-evidence caching and revalidation, validate structured model output before any downstream interpretation, add document-provenance and local-egress controls through two bounded sublabs, and pass a cumulative gate proving all five Phase B boundaries hold together without destroying legitimate RAG utility.

Aegis Vulnerable AI LabInjection-Resistant Multi-Tenant RAGPrompt Injection + Retrieval Authorization + Output Boundary + Provenance/Egress

6 units

01
Reproduce direct and indirect prompt-injection cases
B07
02
Implement the retrieved-content trust boundary
B08
Milestone
03
Implement retrieval-evidence authorization and cache revalidation
B09
Milestone
04
Validate structured model output before interpretation
B10
05
Document provenance and local egress: two bounded sublabs
B11
06
Secure RAG cumulative capstone
B12
Milestone

Your phase progress will appear here after account access is connected.

Least-Privilege Agent Runtime

Agent Security

Inventory the ready-made Aegis agent runtime's capabilities and separate model proposal from application permission (C13), implement the paired tool-authorization and approval policies that stop confused-deputy and non-approver-grant attacks (C14), implement the memory-trust boundary that keeps an unprovenanced write from being admitted as trusted context (C15), implement per-call MCP capability authorization against the fixed local training server (C16), implement the browser sensitive-action approval boundary (C17), and pass a cumulative gate proving all five Phase C boundaries hold together while every declared utility workflow keeps working (C18).

Aegis Vulnerable AI LabLeast-Privilege Agent RuntimeCapability Inventory + Tool Authorization/Approval + Memory Trust + MCP + Browser

6 units

01
Inventory capabilities and separate proposal from permission
C13
02
Authorize tools and restrict who may approve them
C14
Milestone
03
Admit only well-provenanced memory as trusted context
C15
Milestone
04
Authorize MCP capability calls per actor role
C16
05
Require approval for sensitive browser actions
C17
06
Least-Privilege Agent Runtime capstone
C18
Milestone

Your phase progress will appear here after account access is connected.

AI Red Teaming and Security Evals

Security Evals

Use the ready-made, already-complete Aegis evaluation harness to convert the threat model and controls from Phases A-C into a repeatable AI security test program: write falsifiable threat hypotheses against real Aegis evidence (D19), implement the two decisions the harness cannot make on its own -- whether execution evidence really shows containment, and whether a completed run really shows legitimate utility (D20), prove adversarially that protected holdout inputs are not exposed through learner-readable dataset interfaces (D21), learn to read a declarative release gate that cannot be fooled by a high average (D23), and re-run the same two accepted policies, unmodified, across the full four-partition dataset for a reproducible capstone release decision (D24).

Aegis Vulnerable AI LabRepeatable AI Security Test ProgramThreat Hypotheses + Evidence-Based Scoring + Protected Inputs + Release Gates

5 units

01
Define threat hypotheses and observable evidence
D19
02
Implement evidence-based security and utility scoring
D20
Milestone
03
Prove protected-input visibility protection
D21
04
Read the release gate D20 already passed
D23
05
Repeatable AI Security Test Program capstone
D24
Milestone

Your phase progress will appear here after account access is connected.

Verified AI Runtime and Supply Chain

Runtime Integrity

Use the ready-made Aegis integrity and constrained-runtime surfaces to read a real AI asset inventory and provenance model (E25), read Aegis's real, already-unconditional tool/MCP origin-argument-schema binding as dependency, tool, and MCP integrity evidence (E26), implement the one genuine gap -- a lightweight artifact-verification and attestation decision that binds a claimed statement to the trusted inventory's observed subject, digest, and builder authority (E27), read Aegis's real, already-enforced egress, sensitive-field, and capability-authorization boundaries as the constraining evidence a full sandbox would otherwise have to build (E28), read Aegis's real, already-fixed agent/handoff/MCP/browser resource budgets and the canonical budget-exhaustion event as denial-of-wallet evidence (E29), and re-run the accepted E27 policy, unmodified, composed with E26/E28/E29's read-only structural evidence, for a reproducible capstone release decision (E30).

Aegis Vulnerable AI LabVerified and Constrained AI RuntimeInventory Literacy + Integrity Literacy + Artifact Verification + Boundary Literacy + Budget Literacy

6 units

01
Read the real AI asset inventory and provenance model
E25
02
Read the real dependency, tool, and MCP integrity binding
E26
03
Implement lightweight artifact verification and attestation
E27
Milestone
04
Read the real egress, sensitive-field, and capability boundaries
E28
05
Read the real resource budgets and denial-of-wallet evidence
E29
06
Verified and Constrained AI Runtime capstone
E30
Milestone

Your phase progress will appear here after account access is connected.

AI Security Operations and Purple-Team Capstone

Security Operations

Use the ready-made Aegis incident, response, replay, evidence, and Control Plane surfaces to read real canonical-event detection evidence (F31), read real incident-triage and evidence-preservation behavior (F32), implement the one genuine gap -- a response-authorization decision that binds a proposed response's target to the incident's own recorded affected scope (F33), reuse the already-accepted Phase D evaluation harness to reason about remediation verification (F34), read the real, already-non-authoritative AI Security Control Plane (F35), and compose one end-to-end purple-team incident that reuses F33's own seam through a fresh authorization cycle for the final course release decision (F36).

Aegis Vulnerable AI LabAI Security Control PlaneDetect + Triage + Authorize + Remediate + Observe + Recover

6 units

01
Read real detection evidence from canonical events
F31
Milestone
02
Read real incident-triage and evidence-preservation behavior
F32
03
Implement scoped response authorization
F33
Milestone
04
Reason about remediation verification using Phase D's harness
F34
05
Read the real, non-authoritative AI Security Control Plane
F35
06
Purple-Team Incident and Recovery capstone
F36
Milestone

Your phase progress will appear here after account access is connected.

AI Security Engineer Find your path

Loading workspace

Threat-Modeled AI Application and First Security Gate

Secure RAG and Data Boundaries

Least-Privilege Agent Runtime

AI Red Teaming and Security Evals

Verified AI Runtime and Supply Chain

AI Security Operations and Purple-Team Capstone