The AI security concept map
147 lessons across 17 tracks, drawn with the 480 links between them. 219 of those links (46%) cross tracks, which is the part worth looking at: the ideas that decide AI security interviews are rarely the ones that sit neatly inside one topic. Hover a lesson to see only what it touches. Click to read it.
same trackcrosses tracks free membersbigger dot = more connections147 shown
Where the map is dense
The most-connected concepts are the ones the rest of the library keeps reaching for, which makes them the highest-leverage things to be solid on: The Lethal Trifecta (16), The Confused Deputy (15), Excessive Agency (15), What Is Prompt Injection? (14), and What Containers Isolate, and What They Do Not (13). If you are deciding where to spend a week, start with a hub rather than a leaf.
Every concept, by track
Systems & OS Security9
- How the Kernel Isolates Processes10
- Secure Boot, Measured Boot and Remote Attestation in Depth7
- Memory Corruption and the Mitigations Against It6
- Active Directory Attack Paths and How Tiering Breaks Them6
- The Linux Privilege Model: Permissions, setuid, Capabilities and MAC5
- Linux Sandboxing Primitives: Namespaces, cgroups, seccomp and Landlock5
- Windows and Active Directory Security for Interviews5
- Reverse Engineering as a Security Method4
- Software Protection and Its Limits4
Network Security8
- Segmentation and Egress Control11
- Trust on the Wire: HSTS, Certificate Transparency, Pinning and Interception8
- Attacker Positions on the Network7
- TCP/IP for Security Engineers7
- Wi-Fi Security and 802.1X5
- DNS Security: Resolution, Poisoning, DNSSEC and Encrypted DNS4
- How Tunnels and VPNs Work4
- External Exposure Management and Asset Attribution4
Identity & Access12
- The Confused Deputy15
- Authentication versus Authorization12
- Delegated Authorization for AI Agents12
- Sessions, Cookies and Tokens10
- OAuth 2.0 and PKCE10
- Workload Identity and SPIFFE: Identity for Services, Pipelines and Agents8
- Access-Control Models: RBAC, ABAC and ReBAC in Depth6
- Validating JWTs Safely6
- Sender-Constrained Tokens: DPoP, mTLS and Token Exchange6
- Passkeys, WebAuthn and Phishing Resistance6
- OpenID Connect and ID Tokens5
- Cloud Infrastructure Entitlement Management: Effective Permissions4
Application Security11
- Injection Vulnerabilities12
- Server-Side Request Forgery9
- Cross-Site Scripting and Output Encoding8
- Broken Access Control and IDOR7
- How Browsers Separate Origins: SOP, CORS and CSRF6
- Content Security Policy in Depth5
- Insecure Deserialization5
- HTTP/2, HTTP/3 and Request Smuggling5
- AI Vulnerability Discovery and Remediation4
- Application Security Posture Management: From Findings to Owners4
- Code Scanning: What SAST, DAST and SCA Actually Observe2
Infrastructure Security13
- What Containers Isolate, and What They Do Not13
- Sandboxing Untrusted Code12
- Cloud IAM and Privilege Escalation Paths12
- Protecting Model Weights8
- The Inference Stack as Attack Surface8
- Self-Hosted Inference Servers: A Secure Reference Deployment7
- Multi-Tenant Inference Isolation: Caches, Batches, GPUs and Side Channels5
- Cloud Security Posture Management and Public Exposure4
- Infrastructure as Code Scanning and Runtime Drift3
- CNAPP: Connecting Cloud Posture, Workloads and Code3
- Data Security Posture Management: Discover, Classify, Assess3
- CWPP and Runtime Sensors: Observation Versus Enforcement3
- Container and Kubernetes Security Across the Workload Lifecycle2
Supply Chain Security10
- How Code Signing Works10
- SBOMs and AI Bills of Materials10
- SLSA and Build Provenance8
- Unsafe Model Files: Pickle versus Safetensors7
- Model Registries and Promotion Pipelines7
- Package Ecosystem Attacks: npm, PyPI and Beyond6
- Sigstore and Keyless Signing5
- CI/CD Pipeline Security and Build Authority4
- Software Composition Analysis and Reachability Evidence2
- Secret Scanning and Credential Remediation2
Detection & Response15
- Incident Handling: Declare, Contain, Scope, Recover, Learn11
- Endpoint and Network Telemetry for Detection10
- Detection Engineering: From Hypothesis to Tested Alert7
- Threat Hunting versus Detection Engineering7
- Vulnerability Management by Risk: CVSS, EPSS, KEV and Context7
- Infostealers and Session Theft7
- MITRE ATT&CK and Sigma: a Shared Language for Detections6
- SIEM Connectors, Normalization and Detection Evidence3
- Cloud Detection and Response: From Audit Events to Containment3
- Threat Intelligence Platforms, Sharing and Evidence Provenance3
- YARA Rules, Live Hunting and Retrospective Search3
- SOAR Playbooks and Safe Response Automation2
- EDR and XDR: Endpoint Evidence and Cross-Domain Correlation2
- Malware Scanning, Sample Privacy and Verdict Limits2
- Vulnerability Assessment Coverage and Verified Remediation2
How LLM Systems Work8
- AI Gateways and Model Routing as a Security Control Point9
- How LLM Applications Work7
- How LLMs Are Trained and Aligned7
- Tool Calling and the Agent Loop7
- The OWASP Top 10 for LLM Applications7
- Context Windows, System Prompts and Chat Templates5
- Third-Party Model Access: Relays, Routers and Model Substitution5
- Retrieval-Augmented Generation as a Data Flow4
Prompt Injection9
- What Is Prompt Injection?14
- Indirect Prompt Injection10
- What Prompt-Injection Filters Can and Cannot Establish8
- Jailbreak Technique Families7
- System Prompt Leakage7
- Design Patterns That Bound Prompt Injection7
- Evaluating Prompt-Injection Defences: Adaptive Attacks, Utility and Benchmarks6
- Prompt Injection versus Jailbreaking5
- Multimodal Prompt Injection: Images, Audio and Screenshots5
The map is for orientation. If you would rather be told what to do in order, the start-here path sequences the same material by background and stage, and the study paths connect concepts to experiments and worked questions.