Good questions start
with deeper understanding.
Browse lessons, guides, courses and posts by topic or format. Each item is labelled free, account or Premium before you open it.
Prefer a sequence? Find your pathAI security glossary
Precise definitions of the vocabulary interviewers expect, each linked to the lesson that teaches it.
Securing an LLM Feature, End to End
Review a fictional support assistant from its first data-flow map to a release decision and incident response. Build an access policy, output contract, tool state machine and evaluation report, then defend what the evidence allows you to ship.
Security Fundamentals, From Packets to Platforms
Review a fictional document service from its TLS connections to its parser, platform evidence and credentials. Learn the mechanisms, interpret an incident evidence packet and finish with a prioritized service review and acceptance tests.
Secure an Engineering Agent, From Task to Release
Build a connected review packet for a fictional maintenance agent. Define task and delegated authority, review workspace changes, reconcile uncertain effects, govern reusable memory and defend a bounded release decision.
Evaluate AI Security, From Protocol to Decision
Build a connected assessment for a fictional event-planning assistant. Audit its observations and review samples, compare defenses, interpret zero-event evidence and investigate changed scores before defending a recommendation.
Operate Application Security From Code to Deployment
Build and test an application-security evidence chain. Use offline Python to reconcile artifacts, scan scope, pipeline authority, credential lineage and infrastructure state; independently validate an AI-proposed patch before defending rollout closure.
Review Cloud Exposure, Identity and Data Security
Review a fictional customer platform and acquired service using concrete cloud records. Run offline Python for coverage, access paths, versioned data reads, runtime intervals, AI authority and staged integration decisions.
Build Security Operations From Events to Response
Investigate a fictional customer-platform export from raw events to recovery. Run offline Python for normalization, correlation, intelligence lifecycle, content-rule fixtures and response state; defend a final evidence-based incident decision.
Agent Identity Explained: How AI Agents Get Credentials, Prove Who They Are and Get Switched Off
The three identity problems agents create (acting for a user, proving themselves to websites, and being governed as a fleet), and the mechanisms that answer each in 2026: delegated OAuth tokens, Web Bot Auth signatures, agent registries and gateways.
Agent Payments Explained: How AP2, ACP and Card Networks Let AI Agents Buy Things Safely
How AI agents pay without holding card numbers: signed mandates for user consent, scoped payment tokens, signed agent requests for merchants, and the liability questions that remain open in 2026.
AI That Finds and Fixes Vulnerabilities: CodeMender, Mythos, Codex Security and How to Judge Them
How AI vulnerability-discovery and auto-remediation systems work in 2026, what Google, Anthropic, OpenAI and Microsoft have shipped, why validation is the hard part, and the interview questions this now produces.
Browser Extension Security Explained: Why Trusted Extensions Turn Malicious and How Companies Control Them
How browser extensions get access to every session, how developer phishing and ownership changes turn trusted extensions malicious, what the Cyberhaven incident showed, and the Chrome enterprise controls that limit the damage.