What is this course about?
The threat model changes fundamentally when the attacker can write your input. This course works through the OWASP LLM Top 10 as production engineering rather than a checklist: what each risk looks like in a real deployment, which controls actually mitigate it, and how to test continuously. It is honest that indirect prompt injection remains unsolved.
Who is this course for?
- Application and product security engineers
- Security architects
- AI platform engineers
- CISOs and security leadership
What do I need before starting?
- Application security background
- Familiarity with LLM application architecture
What will I be able to do afterwards?
- Articulate how the threat model changes when input is attacker-controlled
- Assess and mitigate each OWASP LLM Top 10 risk in a real deployment
- Design least-privilege tool interfaces that bound excessive agency
- Run a structured red-team against an LLM application
- Establish continuous security testing tied to model and prompt changes
What does each module cover?
What changes when the attacker writes your input?
45 minThe threat model shift that makes LLM security different from conventional application security.
Objectives
- Describe the trust boundary collapse in LLM applications
- Map attack surface across prompts, tools, retrieval, and output
- Set the security posture before design
Topics
Activity. Map the attack surface of an existing LLM application in your organization.
Why is indirect prompt injection unsolved?
60 minDirect and indirect injection, and an honest account of what mitigations do and do not achieve.
Objectives
- Distinguish direct from indirect injection
- Evaluate mitigations honestly against determined attackers
- Design for containment rather than prevention
Topics
Activity. Execute an indirect injection through a retrieval path and attempt to mitigate it.
How does sensitive information leak?
50 minDisclosure through output, logs, error messages, and context that should never have been assembled.
Objectives
- Trace disclosure paths through output and telemetry
- Prevent context over-assembly
- Redact at the right layer
Topics
Activity. Audit an application's logs and traces for sensitive content and remediate.
What is in your AI supply chain?
50 minModel weights, adapters, embeddings, and third-party tools as supply chain surface.
Objectives
- Inventory the AI supply chain including weights and adapters
- Assess provenance and integrity
- Establish controls on third-party tool integration
Topics
Activity. Build the AI supply chain inventory for one production application.
Why is excessive agency the largest blast radius?
55 minThe agent-specific risk: capability granted beyond what the task requires.
Objectives
- Identify excessive permission in existing tool grants
- Design least-privilege tool interfaces
- Bound blast radius through scoping and approval
Topics
Activity. Audit an agent's tool permissions and reduce each to the minimum that still works.
How do you handle output safely?
50 minTreating model output as untrusted input to whatever consumes it.
Objectives
- Treat output as untrusted in downstream systems
- Prevent injection through generated code and queries
- Sandbox execution of generated artifacts
Topics
Activity. Exploit an insecure output-handling path and then close it.
How do you red-team an LLM application?
60 minStructured methodology rather than ad-hoc prompt experimentation.
Objectives
- Run a structured red-team against the Top 10
- Document findings with reproducible steps
- Prioritize remediation by exploitability and impact
Topics
Activity. Run a full structured red-team and produce a prioritized findings report.
How do you test continuously?
50 minSecurity testing tied to model changes, prompt changes, and corpus updates.
Objectives
- Automate security tests in the deployment pipeline
- Trigger re-testing on model and prompt changes
- Monitor for novel attack patterns in production
Topics
Activity. Wire security tests into CI and trigger them with a model version change.
What is the capstone project?
LLM application security assessment and remediation
Perform a complete security assessment of a real LLM application against the OWASP Top 10, including a structured red-team with reproducible findings, least-privilege tool remediation, and continuous testing wired into the deployment pipeline.
Deliverable: An assessment report with reproducible findings, remediations applied, and an automated test suite.
How are learners assessed?
- Red-team findings must be independently reproducible from the documentation
- Tool permission audit verified — every grant justified or removed
- CI security suite demonstrated triggering on a model version change
What ships with the course?
Facilitator guide
Session-by-session running order, discussion prompts, and the questions that reliably derail a room.
Learner workbook
Exercises, checklists, and the templates each module's activity produces.
Hands-on lab environment
A sandboxed ibl.ai deployment so exercises run against real agents, not screenshots.
Assessment bank
Scenario questions and rubric criteria mapped to each stated learning outcome.
Source bibliography
Every primary regulation and standard cited on this page, linked and dated.
Which AI agents does this course use?
The hands-on modules run against agents already deployable on the ibl.ai platform for enterprise.
Where does the course material come from?
Every module is grounded in primary sources — the regulation, standard, or research itself, not a summary of it. Each was resolved at authoring time.
- OWASP Top 10 for LLM Applications
OWASP
The course's organizing framework.
- MITRE ATLAS
MITRE
Adversarial technique taxonomy used in the red-team methodology.
- NIST AI 600-1, Generative AI Profile
NIST
Risk taxonomy mapped against the Top 10.
- Cybersecurity Framework
NIST
Control framework the remediations map into.
Delivery notes
Binding guidance for anyone preparing and delivering this course.
- Module 2 must state plainly that indirect prompt injection has no complete mitigation. A course that implies it is solved teaches security engineers something false and they will detect it immediately.
- Every lab needs an intentionally vulnerable application. Build and maintain one rather than using a public target, and version it against current model behavior.
- Module 5 is the module that matters most for agentic deployments and is under-covered in general LLM security material. Give it the strongest lab.
- Findings must be reproducible from the write-up alone. Assess this explicitly — irreproducible red-team findings are the norm and they are useless to the team that has to fix them.
- Re-verify every attack against current models before each delivery. Injection techniques age fast and a demo that no longer works undermines the whole course.
Why run AI training on a platform you own?
You own the course, not a licence to it
Course content, learner data, and the platform run inside your perimeter — you own all the code and the data.
Model-agnostic delivery
Run the course's AI components on any LLM — Claude, GPT, Llama, Gemini, Command — and switch anytime.
No per-seat training licences
Usage-based or self-hosted, so cost tracks actual use rather than headcount.
Deploy anywhere
Cloud, private VPC, on-premise, or fully air-gapped — including for cohorts that cannot use public AI tools.
Frequently asked questions
What does the AI Security: The OWASP LLM Top 10 in Production course cover?
The threat model changes fundamentally when the attacker can write your input. This course works through the OWASP LLM Top 10 as production engineering rather than a checklist: what each risk looks like in a real deployment, which controls actually mitigate it, and how to test continuously. It is honest that indirect prompt injection remains unsolved. It runs 7 hours across 8 modules across 8 modules, at advanced level, and closes with a capstone: LLM application security assessment and remediation.
Who should take AI Security: The OWASP LLM Top 10 in Production?
It is written for Application and product security engineers, Security architects, AI platform engineers, CISOs and security leadership. Prerequisites: Application security background; Familiarity with LLM application architecture.
Can we run this course on our own infrastructure?
Yes. ibl.ai is model-agnostic and deploy-anywhere — cloud, private VPC, on-premise, or fully air-gapped — and you own all the code and the data. Cohort data, submissions, and any material learners upload stay inside your perimeter, which matters for enterprise teams that cannot send work to a public AI tool.
How do we get access to AI Security: The OWASP LLM Top 10 in Production?
Request access and we will set it up for your cohort — hosted by ibl.ai, or running against your own deployment. Tell us the group size and timing you need, and whether it should run inside your own perimeter.
How much does AI training for enterprise cost on ibl.ai?
There is no per-seat pricing — you pay for usage or self-host and pay only for the infrastructure, so a 5,000-person rollout does not cost 5,000 licences. 1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University.