Cybrary ForgeCYBRARY / FORGE
Back to Program

Program

AI security

Securing the agents now sitting inside the SOC: prompt injection, poisoned tool catalogs, approval ceilings and the oversight boundary around autonomy.

Who it is for: Analysts and engineers operating or defending AI-assisted workflows.

Browse the labs in this program →All learning paths →Your skills portal →

The path through it

AI security: the agent inside your SOC

Agents now read your alerts, call your tools and close your cases. Learn to treat every part of that pipeline as untrusted input, and to keep autonomy behind a boundary you can defend.

  1. 1 · Basics: how an agent gets used against you

    Two lightweight failures first — a tool that is too helpful, and two servers claiming one name — plus the habit of shipping a tool that cannot be turned around.

    • ag-tool-poisoningThe helpful new tool35 min
    • ag-namespace-squatTwo servers, one name35 min
    • mcp-f1-safe-toolShip a tool nobody can turn against you30 min
  2. 2 · Text as untrusted input

    The first lesson and the one people keep failing: content the agent reads is not instruction — in the alert body, and in the memory that outlives the shift.

    • a-210Prompt injection in an alert body40 min
    • ag-alert-injectionThe alert that gives orders40 min
    • ag-memory-contaminationThe note that outlives the shift40 min
  3. 3 · The tool catalog is a supply chain

    Tool descriptions, manifests, registry entries and vendor builds — the supply chain nobody audits.

    • a-220A poisoned tool in the agent's own catalog45 min
    • mcp-f2-harden-poisonedRewrite the poisoned manifest35 min
    • ag-registry-integritySame entry, different build35 min
    • ag-binary-driftThe vendor hotfix35 min
  4. 4 · Identity, tenancy and the network boundary

    Who the agent is when it calls a tool, which tenant's data it can reach, and what its egress path really resolves to.

    • ag-token-audienceOne token, every door40 min
    • ag-confused-deputyOne credential, three agents35 min
    • ag-cross-tenant-stateThe case one number down35 min
    • ag-discovery-ssrfThe well-known redirect40 min
    • ag-dns-rebindingThe header says it is us40 min
    • ag-sandbox-escapeIt only needs a shell35 min
  5. 5 · Oversight, blast radius and provenance

    Approval ceilings, spend limits, elicitation prompts and the lineage that lets you say which tool produced a claim.

    • ag-blast-radiusContain the site35 min
    • ag-cost-exhaustionFourteen lookups a minute30 min
    • ag-elicitation-abuseSession expired30 min
    • ag-data-exfiltrationThe brief that took the credentials with it35 min
    • ag-lineage-gapWhich tool said that?35 min
    • ag-shadow-discoveryNobody filed a ticket for it35 min
    • ag-x1-samplingThe server that borrowed your model40 min
  6. 6 · Autonomous shifts, graded

    A whole shift with the agent working beside you, the adversarial suite it has to survive, and the debrief the morning after.

    • a-230AI security capstone: autonomous triage under oversight75 min
    • mcp-f3-adversarial-runnerSurvive the whole suite45 min
    • ag-shift-capstoneOne whole shift60 min
    • ag-l20-full-shiftThe whole shift, both chairs75 min
  7. 7 · Enterprise scale

    One held shift is not a governed agent estate. This stage moves the work off the incident and onto the organization: the monitoring that keeps proving agent autonomy between shifts, the review that turns a bad night into a changed control, and an independent assurance pass over what was promised.

    • cmp-201Continuous control monitoring, honestly45 min
    • ir-301The review that changes something60 min
    • dr-405Northwind assurance pass90 min

NICE capabilities this program evidences

  • AI and agent securityfirst proven in ag-tool-poisoningTreat model, prompt and tool metadata as untrusted input, and keep autonomy behind an approval ceiling.
  • Control assurancefirst proven in ag-tool-poisoningProve a control collects, matches and notifies — and find the stage where it does not.
  • Detection engineeringfirst proven in mcp-f1-safe-toolPromote a search into a rule with a threshold, an owner and a tested false-positive budget.
  • Response automationfirst proven in a-210Author, version and safely gate a playbook that changes the estate.
  • Incident triagefirst proven in ag-alert-injectionQualify, scope and prioritize an alert into a case with evidence attached.
  • Vulnerability and patch assurancefirst proven in ag-binary-driftEstablish what a host actually runs, decide whether the fix is really applied, and remediate without masking the finding or taking the service down.
  • Evidence handlingfirst proven in ag-cross-tenant-statePreserve artifacts and keep an auditable chain from observation to conclusion.
  • Threat huntingfirst proven in ag-discovery-ssrfFollow an intrusion across telemetry families from a hypothesis, not an alert.
  • Audit and control evidencefirst proven in cmp-201Test a control against its stated design and produce artifacts an external assessor accepts.
  • Risk and policy governancefirst proven in cmp-201Turn a finding into a rated, owned, dated risk decision that survives the next review.

Roles this program trains toward

  • SOC analyst

    The seat that decides, within minutes, whether an alert is noise, a misconfiguration or an intrusion — and leaves evidence behind either way.

    Role profile →Career guide →
  • AI security engineer (agentic SOC)

    The seat that decides what an agent is allowed to do on its own, and can prove afterwards which tool moved the data.

    Role profile →Career guide →

ATT&CK techniques the agent surface exercises

Agent failures are ordinary adversary behavior once you strip the agent from the story — a poisoned tool description is still a software supply chain compromise. Browse every AI security lab →

  • T1036.005Masquerading: Match Legitimate NameDefense Evasion
  • T1041Exfiltration Over C2 ChannelExfiltration
  • T1046Network Service DiscoveryDiscovery
  • T1059Command and Scripting InterpreterExecution
  • T1059.004Unix ShellExecution
  • T1070Indicator RemovalDefense Evasion
  • T1071.004Application Layer Protocol: DNSCommand and Control
  • T1078Valid AccountsDefense Evasion
  • T1078.004Valid Accounts: Cloud AccountsDefense Evasion
  • T1090ProxyCommand and Control
  • T1190Exploit Public-Facing ApplicationInitial Access
  • T1195.002Compromise Software Supply ChainInitial Access
  • T1204.002User Execution: Malicious FileExecution
  • T1489Service StopImpact
  • T1496Resource HijackingImpact
  • T1505Server Software ComponentPersistence
  • T1526Cloud Service DiscoveryDiscovery
  • T1528Steal Application Access TokenCredential Access
  • T1530Data from Cloud StorageCollection
  • T1531Account Access RemovalImpact
  • T1550.001Use Alternate Auth Material: App Access TokenLateral Movement
  • T1552.005Cloud Instance Metadata APICredential Access
  • T1554Compromise Host Software BinaryPersistence
  • T1562.008Impair Defenses: Disable Cloud LogsDefense Evasion
  • T1565.001Stored Data ManipulationImpact
  • T1566PhishingInitial Access
  • T1567Exfiltration Over Web ServiceExfiltration
  • T1611Escape to HostPrivilege Escalation
  • T1621Multi-Factor Authentication Request GenerationCredential Access

Other programs

  • SOC operations — The detection and response core: query telemetry, triage a queue, hunt a hypothesis, automate the response and prove the control fired.
  • Ransomware resilience — Everything after impact: trustworthy recovery points, isolated proof, forest recovery, staged reconnection and an after-action record that survives review.
  • Governance & audit — Controls, evidence and the paperwork an auditor will actually accept — assessed the way a real assessment runs, on artifacts rather than assertions.
  • Adversary craft & systems — Host-level ground truth: patch state, exploitation preconditions and the machine behavior every detection above it depends on.