Skip to content
AI Security
THE LEARNING PATHS

Build intuition.
Then put it to work.

Follow a sequence through the published lessons, or rehearse the 25-step interview review. Answer each question before opening the worked answer, then use the linked lessons to fix what you missed.

Check your starting point
FROM FINDING TO VERIFIED REPAIR

Code, pipelines and application posture

Connect application inventory, code and dependency evidence, pipeline authority, secret response and infrastructure drift. Finish by defending closure on the actual deployed service.

Bring with you
You can follow a code change through a build and deployment.
Work toward
Produce a release evidence manifest and explain which repairs reached which deployments.
A good fit if
You review application security findings or own the delivery pipeline for an AI-enabled service.
Not in this path
Cloud incident investigation and SOC response automation have separate learning paths.
Start this path
EVIDENCE YOU CAN SHOW

  • Trace a finding to a revision, digest, deployment and accountable owner.

    Redo if You close the service risk when the source ticket closes.

  • Separate contribution checks from the authority to publish or deploy.

    Redo if A successful scan grants contributor-controlled code a release credential.

  • Explain how a leaked credential is contained across copies and derived access.

    Redo if Your response ends after deleting the source line.

  1. Inventory and analysis
    01
    Lesson · Free

    Application Security Posture Management: From Findings to Owners

    Map application ownership and source-to-runtime evidence.

  2. 02
    Lesson · Free

    Code Scanning: What SAST, DAST and SCA Actually Observe

    Compare the scope of source, dependency and dynamic assessments.

  3. 03
    Lesson · Free

    Software Composition Analysis and Reachability Evidence

    Review dependency identity and reachability limits.

  4. Delivery authority
    04
    Lesson · Free

    CI/CD Pipeline Security and Build Authority

    Bound triggers, runners, tokens and release authority.

  5. 05
    Lesson · Free

    Secret Scanning and Credential Remediation

    Separate secret cleanup from credential containment.

  6. 06
    Lesson · Free

    Infrastructure as Code Scanning and Runtime Drift

    Reconcile source, resolved plan and live configuration.

  7. Repair evidence
    07
    Worked question · Premium

    All release checks are green, but they assessed different revisions. Can the release proceed?

    Review assessment records that refer to different inputs.

  8. 08
    Worked question · Premium

    An ASPM dashboard says a shared library is fixed. What would you verify before closing the risk?

    Defend closure across independently deployed services.

HOW TO REHEARSE A WORKED ANSWER
  1. Read only the question. List the clarifying questions you would put to the interviewer; what the prompt leaves out is often the test.
  2. Write your answer as a threat model first: the asset, the attacker, the path in, then the control that breaks that path and how it fails.
  3. Open the worked answer and mark the first step where yours differs. That step teaches more than whether you reached the same conclusion.
  4. Score yourself with the Weak, Hire and Strong Hire descriptions in “How it’s scored”, and rework whatever held you below the next level.
  5. Change one condition, such as giving the agent a new tool or letting it read email, and predict which part of your answer stops holding.
A NOTE ON THE CURRICULUM

These paths string together pages that already exist and show the access each one needs. The courses add purpose-written lessons, exercises and progress tracking.

Explore the courses