Skip to main content
AI Act

Certified Artificial Intelligence Security Professional (CAISP)

Attack and defend AI systems. Prompt injection, poisoned training data, compromised supply chains, and agents with permissions nobody audited, mapped against MITRE ATLAS and the OWASP LLM Top 10, with hands-on red teaming and the PECB exam on day five.

PECBExpert5 daysLiveSelf-pacedIn-house
  • Practitioner-led, taught by a working CISO
  • Exam & certificate included
  • Re-sit covered if needed
Christophe Mazzola

Taught by

Christophe Mazzola

Practicing CISO · Founder of Cyber Academy

See full profile →

Why this cohort

How this course is run

  • Cohort capped at 6 people
  • Practitioner-led, taught by a working CISO
  • PECB Gold Certified Trainer
  • 99.3% exam pass rateAll candidates since 2023, PECB exams.
  • Certified or Refund

Included

What is included

  • 5 days of training
  • PECB certification exam
  • Course licence and materials
  • Certificate
  • Support throughout the course

Outcomes

What you'll be able to do

  • 1Explain how machine learning, deep learning, LLMs, and AI agents work, and locate the risk their design creates
  • 2Map threats to an AI or LLM system against MITRE ATLAS and the OWASP Top 10 for LLM Applications
  • 3Test a deployed model for prompt injection and document what you found and how
  • 4Apply AI security controls and monitoring that detect adversarial activity standard logging misses
  • 5Run a threat intelligence workflow that covers model, data, and supply-chain compromise
  • 6Contain and investigate an incident involving a model, its training data, or its tooling
  • 7Design and evaluate an AI security programme covering incident response, supply chain, and secure architecture
  • 8Red team an AI system and report the findings in terms an owner can act on

Programme

Day by day

Day 1AI, ML, and deep learning fundamentals

  • How these systems are actually built

    Machine learning, deep learning, and the training pipeline, covered at the depth a security professional needs: where data enters, where weights are stored, what runs at inference, and who can touch each stage.

  • Security foundations for AI and ML

    Mapping the familiar security model onto an unfamiliar asset. What confidentiality, integrity, and availability mean for a model, a dataset, and a prompt, and which of your existing controls stop at the boundary.

By end of day

  • • Diagram an AI pipeline and mark every point where an attacker could reach it
  • • State what integrity means for a model and for its training data, separately
Day 2LLM architecture, training workflows, and attack tactics

  • Inside an LLM deployment

    Architecture, training workflows, context handling, retrieval, and tool use. The structure has to be clear before the attack tactics against it make sense.

  • Attack techniques and adversarial threats

    Prompt injection, data poisoning, model extraction, and supply-chain compromise, organised against MITRE ATLAS and the OWASP Top 10 for LLM Applications so the catalogue is navigable rather than anecdotal.

  • Lab: prompt injection testing

    Hands-on testing against a live deployment, including the indirect paths through retrieved content and tool output that direct prompt testing never reaches.

By end of day

  • • Classify a real finding against MITRE ATLAS and the OWASP LLM Top 10
  • • Demonstrate an indirect prompt injection and explain why input filtering did not stop it
Day 3AI security controls and mitigation strategies

  • Controls that hold

    Input and output handling, isolation, least privilege for agent tooling, guardrails, and evaluation harnesses. Which mitigations survive an adversary who knows they are there, and which only raise the cost of the first attempt.

  • Supply chain and model provenance

    Pretrained weights, third-party datasets, fine-tuning services, and model registries, assessed as the dependency chain they are, with the governance that makes provenance verifiable.

By end of day

  • • Select and justify a control set for one AI system against its documented threats
  • • Assess a model supply chain and name the dependency you cannot currently verify
Day 4Detection, response, and secure deployment

  • Detection and threat intelligence

    Monitoring that surfaces adversarial activity, including AI-enhanced security analysis and AI-assisted malware analysis, plus the threat intelligence workflow that feeds it.

  • Responding to an AI incident

    Containment, investigation, and recovery when the compromised asset is a model, a dataset, or an agent with credentials. Why the familiar playbook needs new steps and what they are.

  • Secure architecture and red teaming

    Designing the boundary around an AI system, then testing it. AI red teaming as a repeatable exercise, with a reporting format an owner can act on, inside an AI security programme covering governance and regulatory obligations.

By end of day

  • • Write the detection logic for one documented AI attack technique
  • • Run a red team pass against an AI system and report findings by severity
Day 5Consolidation and exam preparation

  • Review across the five competency domains

    A pass over security foundations, attack techniques, controls and defensive operations, AI-enhanced analysis and threat intelligence, and governance with secure architecture.

  • Exam orientation and questions

    How the assessment is structured and how its questions are framed, with open time for whatever is still unresolved. The in-course quizzes mirror the exam structure, so this is consolidation rather than a first look.

By end of day

  • • Identify your own weak domain before the exam rather than during it
  • • Sit the assessment knowing its scope and structure

For

Right fit if you are.

  • ✓Cybersecurity and information security professionals whose estate has just acquired models and agents
  • ✓SOC analysts and threat intelligence staff with AI systems now in scope
  • ✓AI and machine learning engineers responsible for the security of what they ship
  • ✓IT security architects designing the boundary around a model and its tooling
  • ✓Risk and compliance professionals who have to assess AI security posture rather than take it on trust
  • ✓Data scientists and AI developers who need the attacker view of their own pipeline
  • ✓Technology managers accountable for AI security

Honest call

NOT for. When to skip it.

We'd rather you keep your money than buy the wrong path.

  • ✗Anyone without a security background. This course assumes threat modelling, access control, and incident response are already familiar. Cybersecurity Foundation is the on-ramp
  • ✗Teams looking for a governance framework to certify against. ISO 42001 Lead Implementer builds the management system. CAISP works at the attack surface
  • ✗Managers who need the strategic picture rather than the technical one. Certified Artificial Intelligence Manager (CAIM) covers oversight without the labs

Prerequisites

  • A solid foundation in core cybersecurity and information security concepts is expected
  • Working familiarity with threat modelling, access control, incident response, and security monitoring
  • A basic understanding of how machine learning systems are built and served. You do not need to be a data scientist

Public sessions

Upcoming public sessions

Open-enrolment cohorts. Pick a date and book your seat. Want a private cohort for your team instead? Request an in-house quote.

No confirmed live cohort right now. You can still:

Buy the self-paced licenceRequest an in-house quote

No date yet for this course. Tell us where to reach you and you will hear from us as soon as one is confirmed.

Ready to get certified?

Taught by a practicing CISO. Prices and exam terms shown up front.

Buy a live seatBuy self-paced licenceRequest a quote

Deep dive

Everything inside this certification

The detail behind the headline. Read at your own pace. Each section answers a buyer question we get on discovery calls.

Why attend

An AI system carries risk that traditional IT controls were not built to catch. It can be manipulated through its inputs, corrupted through its training data, compromised through its model supply chain, and exploited through the tools and permissions it was handed, frequently without producing a single entry in the logs you currently watch.

This course covers how these systems are attacked, how they are defended, and how that defence is governed. It is hands-on throughout: prompt injection testing, AI red teaming, threat intelligence workflows, and AI-assisted malware analysis, built on MITRE ATLAS and the OWASP Top 10 for LLM Applications. Four teaching days, then the certification exam.

What the exam covers

  • Domain 1: Security foundations for AI and ML
  • Domain 2: AI attack techniques and adversarial threats
  • Domain 3: AI security controls and defensive operations
  • Domain 4: AI enhanced security analysis and threat intelligence
  • Domain 5: AI governance, risk management, and secure architecture

How the course runs

Instructor-led sessions are paired with hands-on lab exercises and real-world scenarios, and the labs use the tooling the work actually involves rather than a simulation of it. Each section is reinforced by practice immediately after the theory, and the in-course quizzes mirror the structure of the certification exam, so the assessment on day five is familiar ground.

Participants who attend receive an attestation of course completion worth 31 CPD credits.

FAQ

Buyers always ask

How technical is this course?+

Technical enough that a security background is a real prerequisite. PECB expects threat modelling, access control, incident response, and security monitoring to be familiar already, plus a basic understanding of how machine learning systems work.

The labs are hands-on: prompt injection testing, AI red teaming, threat intelligence workflows, and AI-assisted malware analysis, using real tooling. You are not asked to train models, but you are asked to attack and defend running ones.

Why will my existing controls not cover AI systems?+

Because the attack paths are new. An AI system can be manipulated through its inputs, corrupted through its training data, compromised through its model supply chain, and exploited through the tools and permissions it was given, often without leaving anything in standard logs.

The controls you already run still matter. The course covers what they stop at, and what you add at that boundary: input and output handling, isolation, least privilege for agent tooling, provenance verification, and detection logic written for adversarial behaviour.

What frameworks does the course build on?+

MITRE ATLAS and the OWASP Top 10 for LLM Applications are the two reference frameworks, used to organise attack techniques into something you can work through systematically rather than a list of anecdotes.

That matters for reporting as much as for testing. A finding mapped to a recognised framework travels further inside an organisation than one described in your own words.

What does the credential require beyond the exam?+

Two grades exist. PECB Certified Provisional Artificial Intelligence Security Professional requires passing the exam and signing the PECB Code of Ethics, with no experience requirement.

The full PECB Certified Artificial Intelligence Security Professional credential requires five years of professional experience, two of them in information or cyber security, and 300 project hours. Requirements are set by PECB and can change, so confirm the current ones before applying.

How does CAISP sit alongside ISO 42001?+

They answer different questions. ISO 42001 builds an AI management system you can be audited against: scope, policy, roles, risk treatment, and continual improvement. It is the governance layer.

CAISP works below it, at the attack surface, and assumes someone will ask whether a specific deployment can be broken. Senior people in AI-heavy estates increasingly hold both, because a management system with no technical testing behind it is a document.

Next step

Where this leads

Pillar guide

Read the full AI Act guide

EU AI Act readiness work for providers and deployers across the four risk tiers.

CAISP: AI Security Professional Training · Cyber Academy