Week in Review — All Four Domains
44 slides · ← Back to Day 5 · Download .pptx
Day 5 — Week in Review: All Four Domains
Hands-On SecAI+ · Working Connections 2026 · Fri, Jul 24 · 9:30 AM – 5:30 PM Central
- This morning: a guided review of every SecAI+ domain — the exam warm-up
- After lunch: the graded workshop exam (all four domains, blueprint-weighted)
- Rest of the afternoon: lab catch-up — finish anything unfinished
Speaker notes
Set the tone: today is consolidation, not new material. Every slide this morning is a callback to something the room already did hands-on. Keep the pace brisk — the goal is activation of existing knowledge, not re-teaching. Announce the schedule change explicitly if attendees expected a morning exam: review first, exam after lunch.
How today works
- MORNING — this review deck: all four domains, weighted like the exam blueprint
- Six checks-for-understanding are embedded — treat each as a practice exam item
- AFTER LUNCH — the exam opens on the Day 5 page; you have the full afternoon session to pace yourself
- AFTER THE EXAM — lab catch-up: finish any unfinished lab modules; the instructor needs final grades today
Speaker notes
Logistics beat: exam access codes come from the instructor; each code is single-use with one retake. The lab catch-up block matters — completion is recorded today, so anyone with unfinished modules should plan their afternoon around the exam plus that. Fast finishers can revisit the go-deeper bundles or join the showcase conversation if time allows.
The exam at a glance
- 34 questions, blueprint-weighted: D1 Basic AI Concepts 17% · D2 Securing AI Systems 40% · D3 AI-Assisted Security 24% · D4 Governance, Risk & Compliance 19%
- 80% to pass · one retake if needed · auto-graded on submit
- Your access code (SECAI-XXXX) is your identity — no PII to enter
- Multiple-choice and short scenario questions; everything from the week is fair game
Speaker notes
Read the blueprint out loud and let it sink in: D2 alone is 14 of 34 questions. That is why this deck spends the most time there. Remind the room the full mechanics live on the Exam page, and that the workshop exam mirrors the SecAI+ blueprint but uses an 80% workshop mastery bar.
How to use this morning
- Weight your attention like the blueprint weights the points — D2 gets the biggest block
- The checks in this deck are exam warm-up: commit to an answer BEFORE revealing
- When a recap slide feels shaky, note the day it came from — the Day 1–4 pages and end-of-day quizzes are your review material over lunch
- Map every control to the risk it mitigates — that mapping is the exam's favorite question shape
Speaker notes
Coach exam technique now, once: read scenario stems fully, name the framework AND the edition, and for every control ask 'which risk, by number or name?' The week's quizzes were formative practice for exactly these items — a lunch-time skim of the four quizzes is high-yield.
Domain 1 — Basic AI Concepts (17%)
Day 1's shared vocabulary. Six-ish questions ride on these fundamentals.
- The AI umbrella: rule-based/symbolic → classical ML → deep learning → generative AI
- Each layer trades auditability for capability — rule-based is deterministic and readable; generative produces new content and new attack surface
- Modern LLMs are transformers doing autoregressive generation
Speaker notes
Fast layer — this is the room's strongest material by now. The umbrella taxonomy matters for exam items that ask which kind of system has which failure mode: deterministic rules are auditable but brittle; generative output is the thing that makes the OWASP LLM Top 10 necessary.
D1: discriminative vs. generative · LLM vs. SLM
- Discriminative — answers "which class is this?" (the DeBERTa injection classifier)
- Generative — answers "what comes next?" (the LLM itself)
- You deployed BOTH: a cheap classifier in front, an expensive generator behind
- LLM vs. SLM is SCALE, not architecture — qwen2.5:1.5b ran three days of labs on CPU; you escalated to 3b only when tool-calling demanded it
Speaker notes
Two distinctions, both exam-tested. Watch for the classic trap: 'it outputs a label, so it's generative' — no, the question each model type answers is the discriminator. The right-sizing thread (1.5b → 3b → hosted API) recurs in the D3 section; plant it here.
D1: tokens and the context window
- Text is chopped into sub-word tokens; the model reads and writes tokens, not characters
- The context window is the model's ENTIRE world at inference time
- Everything — system prompt, user input, retrieved chunks, prior turns — must fit inside it
- Weights are frozen at inference; anything that looks like memory is context
Speaker notes
Clear the 'the model learns from my chats' misconception one last time — in our stack it never does. Context-as-the-only-world is the setup for the one-stream-of-tokens slide, which is the hinge between D1 and D2.
D1: embeddings, attention, autoregression
- Embeddings — meaning mapped to vectors; similar meanings sit CLOSE in vector space (nomic-embed-text in the labs)
- Attention — every token can weigh every other token in the context
- Autoregressive generation — one token at a time, each fed back in as input
- Together: the output is a probabilistic continuation of everything currently in context
Speaker notes
Keep at intuition level, exactly like Day 1. The exam cares about consequences, not math: semantic similarity is why paraphrases evade keyword filters, attention is why injected content anywhere in context can steer output, and the autoregressive loop is why a hijacked trajectory reinforces itself.
D1 → D2 hinge: one stream of tokens
- The model treats the whole context window as ONE stream of tokens
- No in-band mechanism separates trusted instructions from untrusted data
- System prompt, user input, retrieved documents — all the same tokens
- The root cause of prompt injection, and the architectural fact every defense compensates for
Speaker notes
The single most important sentence of the week — if the room can recite it, half the D2 items fall out logically. Ask for it from memory before revealing the bullets. This is also why 'the system prompt will protect us' is always a wrong answer.
D1: prompt engineering recap
- Zero-shot — instruction only; fast but inconsistent on small models
- One-shot / multi-shot — worked examples anchor format and decision boundary
- Chain-of-thought — step-by-step reasoning for multi-step tasks; costs tokens
- System vs. user roles — placement is STRONGER, but roles are advice, not enforcement: a request, not an ACL
Speaker notes
The Experiment A/B/C structure from the Day 1 lab. The security payload is the last bullet: role separation is convention encoded in training. Real enforcement lives outside the model — which is the D2 thesis, previewed.
D1: the RAG pipeline
- Ingest → Embed → Store → Retrieve → Generate
- The vector store (Chroma) holds numeric embedding vectors of text chunks — not weights, not chat history
- Retrieval = embed the query, fetch the most similar chunks (cosine distance)
- RAG's weak point: whatever chunk is fetched — wrong or poisoned — the model faithfully uses
Speaker notes
The five steps and the what-lives-in-the-store question are both straight exam material. The weak-point bullet is the bridge to indirect injection and LLM08: RAG adds knowledge AND an input channel — anyone who can write into the corpus can steer the model.
Check: Domain 1 warm-up
Check for understanding
In the RAG pipeline you built on Day 1, what does the vector database (Chroma) actually store?
- A.The model's weights, updated as users chat
- B.Numeric embedding vectors of text chunks (plus chunk text/metadata), used for similarity search at query time
- C.Plain-text transcripts of every conversation
- D.The system prompt and API keys
Reveal answer
Correct: B. Numeric embedding vectors of text chunks (plus chunk text/metadata), used for similarity search at query time
An embedding model (nomic-embed-text in the lab) turns each chunk into a vector; the query is embedded too, and the store returns the most similar chunks by cosine distance. It holds neither model weights nor chat history — and weights never update at inference time.
Speaker notes
First warm-up check — model exam behavior: commit before revealing. Anyone picking A still carries the 'model learns from my data' misconception; revisit the frozen-weights point before moving into D2.
Domain 2 — Securing AI Systems (40%)
The biggest domain: 14 of 34 questions. Days 2 and 3-morning both live here.
- Day 2: threat modeling, OWASP LLM Top 10 (2025), MITRE ATLAS, guardrails, gateways
- Day 3 morning: data protection — three states, redaction, log sanitization (D2.4–2.6)
- If you review only one section over lunch, review this one
Speaker notes
Signpost the domain-to-day mapping explicitly — it confuses people: workshop Day 3's MORNING (data protection) is still exam domain D2, while Day 3's AFTERNOON (governance) is domain D4, and Day 4's SecOps material is domain D3. Say it twice.
D2: threat modeling an AI system
- Same discipline, new components: DIAGRAM → ENUMERATE → RANK → ASSIGN controls
- The inventory: data (prompts, retrieved docs, history) · model + runtime · tools · infrastructure (gateway, vector store, logs)
- Trust boundaries: user input IN · retrieved documents INTO the context · model output OUT toward users, logs, and tools
- Each boundary crossing is a place to put a control
Speaker notes
The non-obvious boundary is retrieved-documents-into-context — teams treat their own corpus as trusted, but anything that writes into the corpus writes into the model's context. The output-toward-tools boundary is the Excessive Agency (LLM06) conversation from Day 4.
D2: two frameworks, two jobs — and cite the edition
- OWASP Top 10 for LLM Applications (2025) — a RANKED RISK LIST: what to worry about most
- MITRE ATLAS — an ADVERSARY PLAYBOOK: ATT&CK-style tactics and techniques against AI/ML, backed by real case studies
- Both are threat-modeling REFERENCES, not controls — you don't 'install' either one
- Always name the edition: the 2025 LLM list renumbered entries from 2023; ML Security Top 10 is v0.3
Speaker notes
Two reliable exam patterns here: (1) distinguish the reference from the control — ATLAS is not a scanner; (2) edition hygiene — 'LLM07' means something specific to the 2025 release. The shout-back drill works: 'ranked risk list?' — OWASP; 'adversary playbook?' — ATLAS.
D2: the OWASP LLM Top 10, 2025 edition
All ten are fair game. The fastest way to remember them is by the CONTROL each one needs — and the pattern is that the control lives outside the model:
- LLM01 Prompt Injection → scanners/boundaries · LLM02 Sensitive Disclosure → minimize context, filter output
- LLM03 Supply Chain → vet + verify + PIN · LLM04 Data/Model Poisoning → provenance + corpus write-control
- LLM05 Improper Output Handling → treat output as untrusted · LLM06 Excessive Agency → least privilege + human-in-loop
- LLM07 System Prompt Leakage → no secrets in prompt · LLM08 Vector/Embedding → tenant isolation
- LLM09 Misinformation → grounding + oversight · LLM10 Unbounded Consumption → quotas at the gateway
Speaker notes
The through-line — nearly every control sits OUTSIDE the model, not in a cleverer prompt — is the single most useful idea for reasoning about an unfamiliar Domain-2 question. Know the two new-in-2025 entries cold (LLM07, LLM08) and the two easy-to-confuse pairs below. The full one-line-each reference is on the Day 2 deck and page.
D2: the two exam traps in the Top 10
Two pairs the exam loves to confuse. Know which direction the untrusted data flows and what layer the risk lives in:
- LLM01 vs LLM05 — injection is untrusted input going IN; improper output handling is untrusted output going OUT to a shell/DB/browser
- LLM03 vs LLM04 — supply chain is a bad COMPONENT (model, package, adapter); poisoning is corrupted DATA
- Maps vs controls — OWASP/ATLAS are references you enumerate with; guardrails/gateways are the controls that stop things
- Alignment is not a control — a model's tendency to behave is not an enforcement; that is the whole thesis of Day 2
Check for understanding
Untrusted model output passed to a shell or SQL query without validation is which OWASP LLM risk?
- A.LLM01 Prompt Injection
- B.LLM05 Improper Output Handling
- C.LLM03 Supply Chain
- D.LLM10 Unbounded Consumption
Reveal answer
Correct: B. LLM05 Improper Output Handling
LLM05 — the mirror of injection. LLM01 is untrusted input going IN; LLM05 is trusting output COMING OUT. Same instinct (treat the untrusted side as untrusted), opposite direction.
D2: LLM01 — direct vs. indirect injection
D2: LLM01 — direct vs. indirect injection
- DIRECT — the attacker IS the user: "Ignore your previous instructions and…" straight into the chat
- INDIRECT — the payload rides in content the model later reads: a document, web page, or retrieved RAG chunk
- The classification hinges on the DELIVERY PATH into the context, not on who authored the text
- Your chat-input filters never see an indirect payload — retrieval faithfully delivers it
Speaker notes
The #1 risk and the #1 exam topic. Drill the delivery-path distinction hard — the résumé scenario (attacker-written text arriving via ingestion) is the canonical trap where 'the attacker wrote it' feels direct but is indirect. The next check tests exactly this.
Check: injection delivery paths
Check for understanding
A vendor plants hidden instructions in a PDF datasheet. Weeks later, your procurement team's RAG assistant retrieves that datasheet and begins recommending only that vendor. Which risk and delivery path is this?
- A.LLM01 Prompt Injection — direct, because the vendor authored the instructions
- B.LLM01 Prompt Injection — indirect, because the payload arrived via ingested content the model later read
- C.LLM10 Unbounded Consumption — the PDF consumed context tokens
- D.LLM03 Supply Chain — because a vendor was involved
Reveal answer
Correct: B. LLM01 Prompt Injection — indirect, because the payload arrived via ingested content the model later read
The payload reached the context through the ingestion/retrieval pipeline, not the live user turn — that is indirect prompt injection (LLM01, 2025). Direct vs. indirect is about HOW the payload enters the context. Option D is the distractor to unlearn: 'a vendor did it' does not make every risk supply-chain.
Speaker notes
Same shape as the Day 2 check with a fresh scenario — that's deliberate exam practice. If the room hesitates on D, spell out that LLM03 concerns compromised components/models/dependencies, not any risk that happens to involve a third party.
D2: LLM07 and LLM02 — leakage and disclosure
- LLM07 System Prompt Leakage — the model is coaxed into reciting its instructions; leaked guardrail logic tells attackers what to evade, and any secret in the prompt is simply disclosed
- Design fix: NEVER put secrets or PII in the system prompt
- LLM02 Sensitive Information Disclosure — the broader risk: PII/secrets revealed from context, retrieved documents, history, or training data
- Day 3's DataAssist HR chatbot was both at once: LLM07 the channel, LLM02 the payload
Speaker notes
The DataAssist scenario is the mental anchor: an employee record (name, SSN, salary, address) stuffed into a system prompt, one 'repeat your system prompt verbatim' away from total disclosure. The two-risk pairing — channel plus payload — is a good scenario-question shape.
D2: LLM08 and LLM10 — the store and the meter
- LLM08 Vector and Embedding Weaknesses — poisoned documents, embedding-space attacks, CROSS-TENANT leakage through a shared vector store; controls: tenant isolation, corpus write control, treat retrieved content as untrusted
- LLM10 Unbounded Consumption — resource exhaustion and "denial-of-wallet": the attacker's goal is your bill, not your uptime
- The model has NO concept of a quota, a budget, or an identity
- So consumption controls live OUTSIDE the model — in the gateway
Speaker notes
Both new-ish, both lab-exercised. LLM08's cross-tenant point: a shared vector store without isolation means customer A's documents can surface in customer B's context. LLM10's punchline sets up the guardrail-vs-gateway slide — the model cannot enforce what it cannot conceive of.
D2 thesis: alignment is NOT a control
- Safety training shapes PROBABLE behavior — a tendency, not an enforcement mechanism
- A system prompt is a request, not an ACL; a refusal is a trained habit, one rephrase from failing
- For PII, ONE success out of a hundred attempts is a reportable breach
- Real enforcement lives OUTSIDE the model: input/output scanning, gateway limits, minimization, least privilege, human review
Speaker notes
If attendees remember one sentence from the whole domain, it's 'enforcement lives outside the model.' On the exam, any option that delegates a security property to model behavior — 'ask it nicely,' 'rely on alignment,' 'the system prompt forbids it' — is a wrong answer.
D2: guardrail vs. gateway — content vs. access
- GUARDRAIL (LLM Guard) judges CONTENT: PromptInjection (DeBERTa classifier, blocks pre-inference) + TokenLimit on input; BanSubstrings on output
- GATEWAY (LiteLLM) governs ACCESS + CONSUMPTION: tiered virtual keys (qwen-instructor vs. qwen-student), rate limits (rpm=2 → the 429), token budgets
- Guardrails can't stop denial-of-wallet; gateways can't stop injection — you need both
- Classifiers are PROBABILISTIC: subtle injections slip through, false positives cost you too
Speaker notes
The division of labor is the most-tested mapping in the domain: which layer stops which attack. Re-run the lab memory: the crude 'ignore your instructions' got blocked by the DeBERTa scanner; the student key hit HTTP 429 on request #3. Content vs. access — keep the boundary crisp.
Check: which layer stops it?
Check for understanding
An authenticated user scripts a loop that sends thousands of maximum-length prompts to run up your inference costs. Which control most directly stops this, and which OWASP LLM (2025) risk is it?
- A.The DeBERTa PromptInjection scanner — LLM01
- B.Gateway rate limits and token budgets on the user's virtual key — LLM10 Unbounded Consumption
- C.Output scanning with BanSubstrings — LLM05
- D.A longer system prompt forbidding abuse — LLM07
Reveal answer
Correct: B. Gateway rate limits and token budgets on the user's virtual key — LLM10 Unbounded Consumption
The prompts are benign in content, so a content-judging guardrail scores them clean — this is a consumption attack (LLM10, including denial-of-wallet). The gateway (LiteLLM) enforces what the model cannot: per-key rate limits and token budgets. Option D delegates enforcement to the model — always wrong.
Speaker notes
The control-to-risk mapping in exam form. If anyone picks A, restate the division: guardrails read content, gateways meter access. Note the trap construction — every distractor is a real control from the week, just aimed at the wrong risk.
D2, one layer down: OWASP ML Security Top 10 (v0.3)
- The LLM Top 10 is the APPLICATION layer; ML Security Top 10 v0.3 covers the model/training layer beneath it
- Data poisoning — corrupt the training data, corrupt the learned behavior
- Model theft — exfiltrate weights, or clone behavior via repeated queries
- Adversarial examples — inputs crafted to force misclassification (even your DeBERTa guardrail is an ML model with an ML attack surface)
- Supply-chain integrity in practice: this week's digest-pinned images and checksummed model files
Speaker notes
Keep the two lists distinct — app layer vs. model layer — and cite versions (2025 vs. v0.3). 'Poisoning' is also a shared-vocabulary trap from Day 1: training-data poisoning here, cache/ARP poisoning in classic security. The adversarial-example-vs-guardrail point makes a nice full-circle moment.
D2.4–2.6: data in three states
- IN TRANSIT → TLS on every hop (client → gateway → model → stores)
- AT REST → encrypt prompts, logs, vector stores, results — a vector store full of embedded HR documents IS an HR database
- IN USE → decrypted in memory during inference; dedicated control: confidential computing / TEEs
- Practical workhorse for 'in use': MINIMIZATION — never load sensitive data you don't need
Speaker notes
Entering the Day-3-morning material, still domain D2. The taxonomy is exam-clean: each control protects exactly one state, and inference exposes the state fewest teams cover. The inventory trap: teams encrypt SQL but run Chroma on an unencrypted volume and ship raw prompt logs to a SIEM.
D2: the data-reduction toolkit
- ANONYMIZATION — irreversible; the identity is gone for everyone, forever
- REDACTION — remove sensitive spans from text
- MASKING — partially obscure, format preserved (***-**-1234)
- PSEUDONYMIZATION / TOKENIZATION — REVERSIBLE placeholders under key control; the mapping key becomes a crown jewel
Speaker notes
Reversibility is the axis that matters and the axis the exam tests: 'who needs to un-redact, and how is that key protected?' If nobody needs the real value back, anonymize. Precision drill: 'anonymized' data that can be re-identified is a compliance incident, not anonymization.
D2: Presidio — you cannot leak what is not there
- AnalyzerEngine finds entities, AnonymizerEngine rewrites: <PERSON>, <US_SSN>, <EMAIL_ADDRESS>…
- Two recognizer kinds: PATTERN (regex + checksums — SSNs, cards, IPs) and NER (spaCy en_core_web_lg — names, locations)
- Default gaps: domain identifiers like EMP-2024-00892 sail through — add custom PatternRecognizers, and test against YOUR data
- The payoff: post-redaction, the attacks still 'succeed' — and yield placeholders
Speaker notes
The structural argument of Day 3: the guardrail plays a probabilistic arms race; redaction opts out — the data is simply absent. Runs entirely locally (a cloud PII-check API is itself a PII disclosure). The lab's money shot: prompt-leakage recites <US_SSN> instead of the SSN.
D2: attack family → compensating control
The mapping table to have cold — the exam's favorite shape for this material:
- Direct injection → input redaction + output scanning
- Indirect injection → vector-store isolation, corpus write control, least-privilege context
- Multi-turn / role-play jailbreak → conversation-level monitoring + human review (per-message filters score each turn benign)
- System-prompt leakage → no secrets in prompts, redacted context, output scanning
Speaker notes
Given an attack, name the control; given a control, name the attack. Note what's absent from the right-hand column: alignment. Least-privilege context is the sleeper concept — retrieval scope IS an authorization decision.
D2: logs — the quiet leak
- AI systems log richly: prompts, context, responses — verbatim free text is where the PII lives
- Two-layer sanitizer before logs ship: Layer 1 REGEX (fast — Bearer tokens, sk- keys, AKIA keys, JWTs, SSNs, cards) → Layer 2 PRESIDIO NER (names/locations in free text)
- Fast-and-narrow first, slow-and-smart second — an engineering trade-off at volume
- Then MONITOR the sanitized logs: injection patterns, anomalous token consumption, repeated LLM07 probes
Speaker notes
Order matters and is quiz-tested: regex is microseconds per line so it gates everything; NER runs second on what regex cleaned. A leaked sk- key in a log is a live credential — arguably worse than the PII. Monitoring is the bridge from prevention to detection, i.e., from D2 to D3.
Check: the exfil surface
Check for understanding
After Day 3's lab, attackers can still get injection prompts past DataAssist's guardrail occasionally — yet exfiltration attempts now come back empty. What made the difference?
- A.The model's alignment training improved overnight
- B.PII was redacted at the input layer with Presidio before it ever entered the context — there is nothing sensitive left to leak
- C.The system prompt now firmly forbids revealing PII
- D.The vector database was switched to a faster one
Reveal answer
Correct: B. PII was redacted at the input layer with Presidio before it ever entered the context — there is nothing sensitive left to leak
You cannot leak what is not there. Redaction removes the sensitive data from the context entirely, so even a SUCCESSFUL injection yields placeholders like <US_SSN>. Options A and C are the same wrong answer in different clothes — both delegate a data-security property to model behavior.
Speaker notes
The deepest-layer-defense idea in check form. If anyone picks C after the alignment-is-not-a-control slide, that's the review priority over lunch. Watching an attack succeed and yield nothing is the strongest security argument of the week.
Domain 3 — AI-Assisted Security (24%): the lens flips
Day 4's material: AI joins YOUR side of the SOC. Second-heaviest domain.
- Where AI helps: triaging alerts, summarizing logs, drafting detections, prioritizing vulnerabilities — high volume, repetitive structure, expensive human attention
- The durable pattern: AI DRAFTS, HUMAN DECIDES — every generated artifact is a proposal
- Force-multiplier vs. automation liability: the difference is not the model, it's the PIPELINE around it
Speaker notes
Domain-mapping reminder again: exam D3 is workshop Day 4. The thesis: the same model is an asset or a hazard depending on whether validation and human review gate its output. Everything in this domain is an instance of generate → validate → human.
D3: MCP — one protocol instead of N×M glue
- Model Context Protocol: an OPEN PROTOCOL standardizing how AI applications connect models to external tools, data, and context (lab targets the 2025-11-25 spec — cite the date)
- The round-trip: model reads tool schemas → emits a structured tool_call (name + JSON args) → the RUNNER executes it → result feeds back → grounded answer
- The model NEVER runs the tool — that separation is a security boundary: least privilege and auditing attach to the tool layer
- Why qwen2.5:3b today: reliable tool-calling needs schema-faithful JSON; sub-2B models emit malformed args
Speaker notes
Three exam-tested facts on one slide: what MCP standardizes (the connection — not training, not encryption, not pricing); who executes tools (the runner, never the model); and the right-sizing judgment (name the capability that forces the escalation: schema-faithful JSON emission). Lab tools were triage_logs and lookup_cve.
D3: generate → validate → repair
- GENERATE — the model drafts a Sigma rule (log events) or a Suricata rule (network, Snort-family syntax)
- VALIDATE — statically, offline: sigma check (sigma-cli) for Sigma; suricata -T self-test for Suricata — never live capture
- REPAIR — the validator's error text goes straight back as the repair prompt (bounded attempts)
- Output: a syntactically-valid DRAFT — a human still reviews intent before anything ships
Speaker notes
The day's central pipeline and reliable exam material: LLMs produce plausible-but-invalid rules, and detection rules fail SILENTLY — a broken rule just never fires. Static validation proves well-formed, not well-aimed: a valid rule can still detect the wrong thing, which is why review never disappears.
D3: CVE triage — grounded, not recalled
- The lab triaged 12 real 2024 CVEs from a BUNDLED dataset — no live NVD query
- Two distinct reasons: fully offline, AND asked-from-memory models hallucinate CVSS scores with total confidence
- Output: Patch Immediately / Patch This Week / Monitor, each with a rationale referencing YOUR org profile
- The org profile turns a generic severity list into a prioritization; the analyst confirms or overrules each call
Speaker notes
The 'AND' is the exam point — offline discipline and anti-hallucination grounding are separate benefits of one design choice. Same principle as MCP: the tool/data provides ground truth, the model reasons over it. The analyst seat is the skill: disagreement with the model, articulated well.
D3: the flip side — AI-enabled offense
- Deepfakes and voice cloning — 'recognize the voice' identity verification is already obsolete
- Automated, PERSONALIZED phishing at scale — the cost of convincing lures collapses
- AI-accelerated recon, exploit drafting, and evasion — assume adversaries run your same generate-validate loops
- Your durable edge: ground truth (your telemetry), validation discipline, and the human in the loop — not model access
Speaker notes
Exam discriminator: AI-ENABLED vectors (AI is what makes the attack possible/cheap) vs. ordinary security failures (misconfigured firewall, stolen laptop). Both appear as options; precision decides. End on the asymmetry — defenders own the ground truth and the pipeline.
Check: the validate step
Check for understanding
In the Day 4 detection-engineering loop, why can't you skip static validation and send generated Sigma rules straight to human review?
- A.You can — validation is only for logging purposes
- B.LLMs produce plausible-but-invalid rules; the validator catches syntax/structure errors mechanically and its error text drives the repair loop, so humans spend attention on intent, not typos
- C.Because sigma-cli deploys the rule to production automatically
- D.Because validation encrypts the rule before transmission
Reveal answer
Correct: B. LLMs produce plausible-but-invalid rules; the validator catches syntax/structure errors mechanically and its error text drives the repair loop, so humans spend attention on intent, not typos
The validator (sigma check; suricata -T for network rules) is the mechanical gate: it proves the draft is well-formed, offline, and its failure messages are ideal repair-prompt input. The human review that follows judges correctness of INTENT — a perfectly valid rule can still detect the wrong thing.
Speaker notes
If the room nails this, the D3 core has landed. Worth restating the division: validation gives correctness-of-form, the human gives correctness-of-intent, and nothing proceeds to production without both.
Domain 4 — Governance, Risk & Compliance (19%)
Day 3's afternoon: the rules of the road. Six-ish questions.
- NIST AI RMF 1.0 — four functions: GOVERN · MAP · MEASURE · MANAGE
- NOT the Cybersecurity Framework (Identify/Protect/Detect/Respond/Recover) — the exam uses CSF functions as distractors on purpose
- Govern is cross-cutting: policies, roles, accountability — where Shadow AI and responsible-AI policy live
- You already DID this: the DataAssist worksheet mapped a real deployment onto all four functions
Speaker notes
The CSF-reflex trap is the single most predictable D4 distractor — this room is fluent in CSF, and that fluency is exactly what gets exploited. Thirty seconds of the shout-back drill (function → which framework?) beats re-reading definitions. Voluntary framework vs. binding law is the other axis to hold.
D4: AI 600-1 and the EU AI Act
- NIST AI 600-1 — the Generative AI Profile: maps concrete GenAI risks (data privacy, confabulation, harmful content) onto the RMF's four functions; the bridge from framework to backlog
- EU AI Act — BINDING regulation, tiered by risk: UNACCEPTABLE (banned) · HIGH (heavy obligations) · LIMITED (transparency) · MINIMAL (none)
- High-risk obligations: risk management, data governance, logging, human oversight, conformity assessment — the same controls this course builds, with legal force
- Date this course tracks: 2 December 2027 for high-risk obligations — DEFERRED and PROVISIONAL per the Digital Omnibus; always flag it that way
Speaker notes
Two exam anchors: the four tiers (and that obligations scale with harm), and the framework-vs-law contrast — NIST RMF is voluntary, the Act is binding. Model the epistemic hygiene on the date: provisional, has shifted before, re-verify before relying on it.
D4: responsible AI and Shadow AI
- Six recurring principles: FAIRNESS · TRANSPARENCY · ACCOUNTABILITY · PRIVACY · SAFETY · HUMAN OVERSIGHT — each cashes out as a control you built this week
- Shadow AI — the AI analogue of shadow IT: unsanctioned tools outside governance; every control from this week bypassed at once
- The three-part answer (a GOVERN problem): DISCOVERY → POLICY → a SANCTIONED ALTERNATIVE that actually meets the demand
- Bans without alternatives push usage further into the shadows
Speaker notes
Principles-to-controls mapping: privacy → redaction, human oversight → human-in-the-loop, accountability → sanitized audit logs, transparency → disclosure duties. The three-part Shadow AI response is both the field answer and the exam answer — and this workshop's local governed stack is itself an example of the third leg.
Check: Domain 4 warm-up
Check for understanding
A colleague maps your AI deployment's risks using 'Identify, Protect, Detect, Respond, Recover' and calls it a NIST AI RMF assessment. What's wrong?
- A.Nothing — those are the AI RMF 1.0 functions
- B.Those are the NIST Cybersecurity Framework functions; NIST AI RMF 1.0 uses Govern, Map, Measure, Manage
- C.The AI RMF has no named functions
- D.Those are the EU AI Act's risk tiers
Reveal answer
Correct: B. Those are the NIST Cybersecurity Framework functions; NIST AI RMF 1.0 uses Govern, Map, Measure, Manage
NIST AI RMF 1.0 is organized around Govern, Map, Measure, Manage — Govern cross-cutting, feeding the other three. Identify/Protect/Detect/Respond/Recover is the NIST CSF, a different framework for a different scope, and the exam's favorite D4 distractor.
Speaker notes
The most predictable trap on the exam, in check form. Anyone who picks A just demonstrated the reflex — which makes the point better than any slide. Follow with the EU-tier names out loud (unacceptable/high/limited/minimal) so both taxonomies are fresh.
Exam craft: the question shapes to expect
- MAPPING — given a control, name the risk (by 2025 number); given an attack, name the compensating control
- CLASSIFICATION — direct vs. indirect; discriminative vs. generative; which data state; which RMF function; which EU tier
- DISCRIMINATORS — reference vs. control (ATLAS ≠ scanner) · framework vs. law · AI-enabled vs. merely security-relevant · draft vs. decision
- Distractors are REAL things from the week aimed at the wrong question — read every stem fully before answering
Speaker notes
Ten minutes of meta-review is worth a question or two. The distractor pattern deserves emphasis: wrong options are rarely nonsense — they're correct facts mis-applied (a real control for a different risk, a real framework for a different job). Remind: D2 carries 40% of the points; budget accordingly.
This afternoon: the exam, then lab catch-up
- The exam opens AFTER LUNCH on the Day 5 page — enter your access code (SECAI-XXXX); your code is your identity, no PII to enter
- 34 questions, blueprint-weighted · 80% to pass · one retake if needed · auto-graded on submit
- You have the full afternoon session — pace yourself and submit when ready
- After you finish: LAB CATCH-UP — complete any unfinished lab modules; the instructor records final grades today. Fast finishers: go-deeper bundles, or join the tools showcase conversation
Speaker notes
Close the morning with logistics, not content. Over lunch: skim the four end-of-day quizzes — they were formative practice for exactly these items. After the exam, the room self-organizes: unfinished labs first (completion is recorded today), then go-deeper bundles or the showcase/roundtable material for those already done. Good luck — you built everything this exam asks about.