Training
Featured Course View All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Group Purchasing
Group Purchasing
AI-FOCUSEDNEW

SEC411L: AI Security Principles and Practices: GenAI and LLM Defense (Live Cohort)

SEC411Cyber Defense, Artificial Intelligence
  • 3 Days (Instructor-Led)
  • 24 Hours (Self-Paced)
Course authored by:
Seth Misenar
Seth Misenar
SEC411
Course authored by:
Seth Misenar
Seth Misenar
  • 24 CPEs

    Apply your credits to renew your certifications

  • Intermediate Skill Level

    Course material is geared for cyber security professionals with hands-on experience

  • 5 Hands-On Lab(s)

    Apply what you learn with hands-on exercises and labs

Jump to:

Learn AI security live with the course author, then keep going with the complete SEC411 OnDemand course. Always current. Always hands-on. Always relevant.

Course Overview

SEC411L is the live cohort version of SEC411, the living, practitioner-focused AI security course for cybersecurity professionals entering GenAI and LLM defense. Three days of author-led instruction, delivered by course author and SANS Fellow Seth Misenar, come bundled with the complete SEC411 OnDemand course, so the class is where your learning starts, not where it ends. No prior AI experience required. 

How Does SEC411L (Live Cohort) Differ From SEC411 OnDemand?

SEC411L (Live Cohort) includes everything in SEC411 OnDemand and adds three days of live instruction on top of it. You are not choosing between live and OnDemand. You get both.

The live days focus on what is hardest to get from video alone: working through difficult concepts with the course author, live demonstrations, real-time answers to your questions, and discussion with other practitioners working through the same problems. Each lab gets a guided start in class, so you leave with momentum instead of a blank screen.

Each SEC411L run is its own cohort. Everyone in your class learns together in the same format, whether Live Online or In-Person, and you join a private Slack channel in the SEC411 workspace dedicated to your class. The questions, discoveries, and conversations from the live days have a place to continue as you work through the labs.

After class, your included OnDemand access lets you finish all five labs at your own pace, rewatch any module, and pick up new content as the curriculum is updated. You also get a recording of your own live class, so you can revisit the discussion and demonstrations exactly as they happened.

What You’ll Learn

  • Master AI security fundamentals including tokenization, attack surface analysis, and OWASP Top 10 for LLMs.
  • Exploit and defend against prompt injection, jailbreaking, RAG manipulation, MCP security, and context hijacking across 125+ hands-on lab tasks.
  • Implement production-ready defenses for inference runtime, system prompts, and RAG applications.
  • Secure agentic workflows, autonomous systems, and reasoning models against manipulation and misuse.
  • Apply OWASP Top 10 for LLMs, MITRE ATLAS, and NIST AI RMF in real security operations scenarios.
  • Bridge traditional cybersecurity skills to AI-specific requirements and SOC integration.
  • Design defense-in-depth strategies that balance security and usability across the AI lifecycle.
  • Protect Model Context Protocol (MCP) environments by identifying attack surfaces and enforcing controls.
  • Master prompt-injection techniques from direct instruction attacks and encoding-based obfuscation to context-window manipulation and social-engineering.
  • Build a vendor-neutral detection and incident-response capability spanning prompt, retrieval, tool, and memory-based attacks, grounded in OWASP's Agentic Top 10 threat categories including Tool Misuse and Memory Poisoning.
  • Critically evaluate Anthropic's Fable 5 and Mythos 5 safety disclosures and government-driven access changes, translating a fast-moving capability and access-governance story into concrete defensive action.

Business Takeaways

  • Get two learning formats for one registration: three days of live instruction plus four months of the complete SEC411 OnDemand course and labs.
  • Give your team live time with the course author to ask questions and discuss how the material applies to their work.
  • Keep learning momentum after class with a private Slack channel dedicated to each run's cohort.
  • Close critical skill gaps quickly with progressive learning paths building on existing expertise.
  • Maximize training ROI with a living curriculum that adds new modules and labs throughout 4-month access.
  • Apply learning immediately with Docker-based hands-on labs that build skills teams can use in real production environments.
  • Accelerate team readiness with gamified labs and an integrated Learning Assistant for faster competency.
  • Reduce deployment risk with comprehensive OWASP Top 10 for LLMs and production security controls coverage.
  • Support compliance with NIST AI RMF, EU AI Act, and other standards connected to existing security ops.
  • Reduce response gaps with a unified monitoring and incident-response framework for the major ways untrusted content reaches AI systems.

Meet Your Author

Seth Misenar
Seth Misenar

Seth Misenar

Fellow

Seth, SANS Faculty Fellow and author of SEC411, LDR414, and SEC511, combines cutting-edge consulting and education to equip defenders worldwide. Founder of Context Security and GSE #28, he brings clarity, humor, and purpose to cybersecurity training.

Read more about Seth Misenar

Course Syllabus

The live days cover all three sections in course order. The complete video modules and all five labs are also included in your OnDemand access.

Section 1KNOW - Understanding the AI Threat Landscape

Build essential AI literacy for security professionals. Learn how LLMs operate, identify AI-specific attack surfaces, and develop intuition about GenAI and LLM applications. This foundation bridges traditional security experience to AI threats with hands-on exploration of tokenization security.

Full Lab Details

  • Lab 0: LLM Basics
    • Level 0: Mission Briefing: Orient to the lab interface, toolbox, and keyboard shortcuts
    • Level 1: Temperature and Creativity: Control output randomness from deterministic to creative
    • Level 2: Context Windows and Tokens: Explore how tokenization and window size constrain model behavior
    • Level 3: System Prompts and Roles: Shape model behavior through system prompts as a security boundary
    • Level 4: Boundaries and Blind Spots: Probe knowledge cutoff, confabulation, safety refusals, and prompt fragility
  • Lab 1: Tokenizer Security Explorer
    • Level 1: Discovery: Analyze basic tokenization and its security impact
    • Level 2: Model Comparison: Compare tokenization behaviors across multiple models
    • Level 3: Attack and Defense: Hands-on exploration of tokenization attack techniques and token-aware defense implementation
    • Level 4: Tokenizer Forensics: Fingerprint models and analyze tokenization patterns, including BPE vs. WordPiece comparison and multilingual filter bypass techniques
    • Level 5: Advanced Challenges: Comprehensive tokenization attack/defend scenarios

Full Topic Details

  • Security implications of LLM architecture, training processes, and inference mechanisms
  • AI system attack surface mapping and threat modeling using MITRE ATLAS
  • Tokenization vulnerabilities and exploitation techniques across different model families
  • AI supply chain security, training data poisoning, and model manipulation tactics

Section 2DEFEND – Securing the AI Lifecycle

Secure AI systems from training to runtime. Implement practical defenses for training pipelines, inference environments, and RAG systems. Master input and output filtering, guardrail implementation, and RAG-specific security controls through progressive attack and defense challenges.

Full Lab Details

  • Lab 2: Prompt Injection Attacks and Defenses
    • Level 1: System Prompt Attacks: Override weak system prompts to extract protected information
    • Level 2: Input Filtering: Bypass keyword blacklist filters using encoding and obfuscation
    • Level 3: Output Filtering: Extract sensitive data past post-LLM response pattern scanning
    • Level 4: Semantic Detection: Defeat LLM-based intent classification through social engineering and payload splitting
    • Level 5: Challenge Mode: Progressive defense challenges where each task isolates a single defense layer
  • Lab 3: RAG Security Attacks and Defenses
    • Level 1: Information Leakage: Exploit RAG knowledge bases through indirect queries
    • Level 2: Semantic Bypass: Circumvent input filters using semantic manipulation
    • Level 3: Document Poisoning: Inject malicious documents and craft trigger queries
    • Level 4: Access Control Bypass: Escalate privileges from guest to captain-level access
    • Level 5: Defense Implementation: Configure security controls for filtering, monitoring, and source citation

Full Topic Details

  • Training pipeline security with data validation, poisoning detection, and secure infrastructure
  • Inference runtime defenses using input sanitization, output validation, and semantic analysis
  • OWASP Top 10 for LLM Applications, from prompt injection to model theft
  • Advanced prompt attack techniques such as jailbreaking, system prompt extraction, and context manipulation
  • Advanced prompt-injection techniques, including instruction manipulation, encoding and obfuscation, conversational-window exploitation, and social-engineering tactics
  • RAG system security including vector database protection, retrieval poisoning, and access control
  • Production security controls that balance protection and usability

Section 3DEPLOY – Integration, Autonomy, and Advanced AI

Integrate AI security into enterprise architecture and protect autonomous systems. Deploy secure LLM applications, implement robust API security, connect AI monitoring with SOC operations, and address new threats in agentic systems and reasoning models using production-ready strategies.

Full Lab Details

  • Lab 4: MCP Protocol Security
    • Level 1: Reading the Fine Print: Discover hidden instructions in tool descriptions that poison LLM behavior
    • Level 2: The Switcheroo: Detect rug pull attacks where servers mutate descriptions between connections
    • Level 3: Cross-Fire: Observe cross-server contamination through shared context in multi-tool environments
    • Level 4: Lockdown Protocol: Configure defenses including human in-the-loop, description pinning, and context isolation

Full Topic Details

  • Secure AI deployment architectures and API protections for LLM services
  • Authentication, authorization, and monitoring integrated with existing security operations
  • Security for agentic systems, including permission models, tool validation, and agent control
  • Reasoning model security, focusing on chain-of-thought protection and defending against reasoning manipulation
  • Incident response for AI security events and development of enterprise AI security programs
  • MCP protocol security, including attack surface and defensive controls
  • Unified detection, monitoring, and incident-response practices for context-injection attacks, covering direct prompts, RAG/retrieval poisoning, tool and protocol abuse, and persistent agent-memory poisoning
  • Current-events case study examining Anthropic's Fable 5 and Mythos 5 safety disclosures alongside a real US government access suspension, translating a fast-moving capability and governance story into concrete organizational defenses

Things You Need To Know

Important! Bring your own system configured according to these instructions.

Docker-based hands-on labs are used in this course. Students will need a laptop capable of running Docker. See the SANS website for full laptop requirements. Please install your lab environment before the first live day so class time goes to learning instead of setup. 

If you have additional questions about the laptop specifications, please contact customer service.

SEC411L adds three days (18 hours) of live, author-led training to the complete SEC411 OnDemand course, which is included with your registration. Each run is delivered either Live Online or In-Person, so the whole class shares the same experience. Live sessions focus on difficult concepts, demonstrations, discussion, Q&A, and a guided start on each lab.

You also join a private Slack channel in the SEC411 workspace for your run's cohort, alongside the broader SEC411 student community. Your four months of included OnDemand access let you finish the labs, revisit modules, and receive curriculum updates as they are released. A recording of your live class is also provided.

Like SEC411 OnDemand, this course does not have a traditional hard-copy coursebook. A digital copy will be provided. 

Cybersecurity professionals entering GenAI and LLM defense. No prior AI background needed. Intermediate skill level, geared for practitioners with hands-on security experience. SEC411L is a strong fit for learners who prefer to start with live instruction and discussion, and for teams that want to train together. 

  • Three days (18 hours) of live instruction with the course author, Live Online or In-Person
  • A recording of your live class
  • A private Slack channel for your run's cohort
  • The complete SEC411 OnDemand course: 24+ hours of expert-led videos
  • Five progressive hands-on labs with 125+ tasks
  • Continuous updates during 4-month access window
  • Access to a student Slack community for support and collaboration

There are no prerequisites for this course.

The SEC411L course is a part of the "Artificial Intelligence" Learning Path, designed to train cybersecurity professionals in AI security essentials.

Depending on your current or desired future role, one of these courses is a great next step in your cybersecurity journey:

  • SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals | GMLE
  • SEC545: GenAI and LLM Application Security

AI Security Principles form the foundation of AI risk management and LLM security, helping cybersecurity professionals identify, assess, and defend against threats unique to Generative AI systems. These principles include AI threat modeling, input and output validation, data integrity protection, and AI governance controls that keep models secure, transparent, and compliant. As organizations integrate AI and LLM technologies into critical operations, applying strong AI security practices is essential to prevent model abuse, data leakage, and adversarial manipulation.

SEC411 provides a direct path for cybersecurity professionals to develop in-demand expertise in AI security. You’ll gain practical experience identifying and mitigating GenAI and LLM threats, bridging traditional cybersecurity operations with emerging AI defense strategies. Graduates will be prepared to lead AI risk assessments, advise on secure deployments, and contribute to building resilient, compliant AI ecosystems within their organizations.

Relevant Job Roles

AI Governance and Security Risk Lead

Artificial Intelligence

AI Governance and Security Risk Leads turn AI risk into workable controls, running risk assessments and mapping policy to the frameworks regulators and auditors expect.

Explore learning path

Artificial Intelligence and Data Ethics (AIDE)

Skills Framework for the Information Age

Responsible design, development, and governance of AI and data-driven systems. Ethical principles are embedded into algorithms, models, and automated decision-making to ensure fairness, transparency, and accountability.

Explore learning path

We're updating our course schedule - please check back later.

Benefits of Learning with SANS

Bryan Simon: Teacher Standing Next to Smartboard and Explaining Concept

Get feedback from the world’s best cybersecurity experts and instructors

OnDemand Mobile App

Choose how you want to learn - online, on demand, or at our live in-person training events

Close Up of Woman Holding a Pen and Documents

Get access to our range of industry-leading courses and resources