# AI Security: The OWASP LLM Top 10 in Production > Enterprise · AI Course · ENT-4 > Source: https://ibl.ai/solutions/enterprise/course/ai-security-owasp-llm-top-10 > Last updated: 2026-08-25 **Securing deployed LLM systems — prompt injection, data leakage, supply chain, and excessive agency — with the controls and tests for each.** ## The Short Answer **Indirect prompt injection has no complete mitigation, so enterprise LLM security depends on least-privilege tool design and containment rather than input filtering. ibl.ai runs agents in isolated segments with programmable guardrails, inside infrastructure where you own all the code and the data — so a compromised agent's blast radius stays inside your perimeter.** On ibl.ai you own all the code and the data, run it model-agnostic across any LLM, and pay with no per-seat pricing — so you can deploy anywhere, from your own cloud to a fully air-gapped network. [Request Access](https://ibl.ai/contact) · [Explore Enterprise](https://ibl.ai/solutions/enterprise) ## Course facts - **Level:** Advanced - **Duration:** 7 hours across 8 modules - **Format:** Technical workshop with red-team labs - **Modules:** 8 - **Catalog code:** ENT-4 - **Frameworks covered:** OWASP LLM Top 10, MITRE ATLAS, NIST CSF 2.0, NIST AI 600-1 ## What is this course about? The threat model changes fundamentally when the attacker can write your input. This course works through the OWASP LLM Top 10 as production engineering rather than a checklist: what each risk looks like in a real deployment, which controls actually mitigate it, and how to test continuously. It is honest that indirect prompt injection remains unsolved. ## Who is this course for? - Application and product security engineers - Security architects - AI platform engineers - CISOs and security leadership ### What do I need before starting? - Application security background - Familiarity with LLM application architecture ## What will I be able to do afterwards? - Articulate how the threat model changes when input is attacker-controlled - Assess and mitigate each OWASP LLM Top 10 risk in a real deployment - Design least-privilege tool interfaces that bound excessive agency - Run a structured red-team against an LLM application - Establish continuous security testing tied to model and prompt changes ## What does each module cover? ### Module 1 — What changes when the attacker writes your input? The threat model shift that makes LLM security different from conventional application security. _(45 min)_ **Objectives** - Describe the trust boundary collapse in LLM applications - Map attack surface across prompts, tools, retrieval, and output - Set the security posture before design **Topics:** Trust boundary collapse · Attack surface mapping · Data and control plane mixing · Posture setting **Activity:** Map the attack surface of an existing LLM application in your organization. ### Module 2 — Why is indirect prompt injection unsolved? Direct and indirect injection, and an honest account of what mitigations do and do not achieve. _(60 min)_ **Objectives** - Distinguish direct from indirect injection - Evaluate mitigations honestly against determined attackers - Design for containment rather than prevention **Topics:** Direct injection · Indirect injection via retrieved content · Mitigation limits · Containment design **Activity:** Execute an indirect injection through a retrieval path and attempt to mitigate it. ### Module 3 — How does sensitive information leak? Disclosure through output, logs, error messages, and context that should never have been assembled. _(50 min)_ **Objectives** - Trace disclosure paths through output and telemetry - Prevent context over-assembly - Redact at the right layer **Topics:** Output disclosure · Log and telemetry leakage · Context over-assembly · Redaction placement **Activity:** Audit an application's logs and traces for sensitive content and remediate. ### Module 4 — What is in your AI supply chain? Model weights, adapters, embeddings, and third-party tools as supply chain surface. _(50 min)_ **Objectives** - Inventory the AI supply chain including weights and adapters - Assess provenance and integrity - Establish controls on third-party tool integration **Topics:** Model provenance · Adapter and fine-tune integrity · Third-party tools · Dependency controls **Activity:** Build the AI supply chain inventory for one production application. ### Module 5 — Why is excessive agency the largest blast radius? The agent-specific risk: capability granted beyond what the task requires. _(55 min)_ **Objectives** - Identify excessive permission in existing tool grants - Design least-privilege tool interfaces - Bound blast radius through scoping and approval **Topics:** Permission scoping · Least-privilege tools · Blast radius bounding · Approval gates **Activity:** Audit an agent's tool permissions and reduce each to the minimum that still works. ### Module 6 — How do you handle output safely? Treating model output as untrusted input to whatever consumes it. _(50 min)_ **Objectives** - Treat output as untrusted in downstream systems - Prevent injection through generated code and queries - Sandbox execution of generated artifacts **Topics:** Output as untrusted input · Generated code execution · Query injection · Sandboxing **Activity:** Exploit an insecure output-handling path and then close it. ### Module 7 — How do you red-team an LLM application? Structured methodology rather than ad-hoc prompt experimentation. _(60 min)_ **Objectives** - Run a structured red-team against the Top 10 - Document findings with reproducible steps - Prioritize remediation by exploitability and impact **Topics:** Red-team methodology · Reproducibility · Finding documentation · Remediation prioritization **Activity:** Run a full structured red-team and produce a prioritized findings report. ### Module 8 — How do you test continuously? Security testing tied to model changes, prompt changes, and corpus updates. _(50 min)_ **Objectives** - Automate security tests in the deployment pipeline - Trigger re-testing on model and prompt changes - Monitor for novel attack patterns in production **Topics:** Pipeline automation · Change-triggered testing · Production monitoring · Pattern detection **Activity:** Wire security tests into CI and trigger them with a model version change. ## What is the capstone project? **LLM application security assessment and remediation.** Perform a complete security assessment of a real LLM application against the OWASP Top 10, including a structured red-team with reproducible findings, least-privilege tool remediation, and continuous testing wired into the deployment pipeline. _Deliverable:_ An assessment report with reproducible findings, remediations applied, and an automated test suite. ## How are learners assessed? - Red-team findings must be independently reproducible from the documentation - Tool permission audit verified — every grant justified or removed - CI security suite demonstrated triggering on a model version change ## What ships with the course? - **Facilitator guide.** Session-by-session running order, discussion prompts, and the questions that reliably derail a room. - **Learner workbook.** Exercises, checklists, and the templates each module's activity produces. - **Hands-on lab environment.** A sandboxed ibl.ai deployment so exercises run against real agents, not screenshots. - **Assessment bank.** Scenario questions and rubric criteria mapped to each stated learning outcome. - **Source bibliography.** Every primary regulation and standard cited on this page, linked and dated. ## Which AI agents does this course use? - [IT Help Desk Agent](https://ibl.ai/solutions/enterprise/agent/it-help-desk-agent) - [Engineering Agent](https://ibl.ai/solutions/enterprise/agent/engineering-agent) - [Operations Agent](https://ibl.ai/solutions/enterprise/agent/operations-agent) - [Knowledge Agent](https://ibl.ai/solutions/enterprise/agent/knowledge-agent) ## Where does the course material come from? Every module is grounded in primary sources — the regulation, standard, or research itself, not a summary of it. Each was resolved at authoring time. - [OWASP Top 10 for LLM Applications](https://owasp.org/www-project-top-10-for-large-language-model-applications/) — OWASP. The course's organizing framework. - [MITRE ATLAS](https://atlas.mitre.org/) — MITRE. Adversarial technique taxonomy used in the red-team methodology. - [NIST AI 600-1, Generative AI Profile](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf) — NIST. Risk taxonomy mapped against the Top 10. - [Cybersecurity Framework](https://www.nist.gov/cyberframework) — NIST. Control framework the remediations map into. ## Delivery notes Binding guidance for anyone preparing and delivering this course: - Module 2 must state plainly that indirect prompt injection has no complete mitigation. A course that implies it is solved teaches security engineers something false and they will detect it immediately. - Every lab needs an intentionally vulnerable application. Build and maintain one rather than using a public target, and version it against current model behavior. - Module 5 is the module that matters most for agentic deployments and is under-covered in general LLM security material. Give it the strongest lab. - Findings must be reproducible from the write-up alone. Assess this explicitly — irreproducible red-team findings are the norm and they are useless to the team that has to fix them. - Re-verify every attack against current models before each delivery. Injection techniques age fast and a demo that no longer works undermines the whole course. ## Why run AI training on a platform you own? - **You own the course, not a licence to it.** Course content, learner data, and the platform run inside your perimeter — you own all the code and the data. - **Model-agnostic delivery.** Run the course's AI components on any LLM — Claude, GPT, Llama, Gemini, Command — and switch anytime. - **No per-seat training licences.** Usage-based or self-hosted, so cost tracks actual use rather than headcount. - **Deploy anywhere.** Cloud, private VPC, on-premise, or fully air-gapped — including for cohorts that cannot use public AI tools. ## Frequently asked questions ### What does the AI Security: The OWASP LLM Top 10 in Production course cover? The threat model changes fundamentally when the attacker can write your input. This course works through the OWASP LLM Top 10 as production engineering rather than a checklist: what each risk looks like in a real deployment, which controls actually mitigate it, and how to test continuously. It is honest that indirect prompt injection remains unsolved. It runs 7 hours across 8 modules across 8 modules, at advanced level, and closes with a capstone: LLM application security assessment and remediation. ### Who should take AI Security: The OWASP LLM Top 10 in Production? It is written for Application and product security engineers, Security architects, AI platform engineers, CISOs and security leadership. Prerequisites: Application security background; Familiarity with LLM application architecture. ### Can we run this course on our own infrastructure? Yes. ibl.ai is model-agnostic and deploy-anywhere — cloud, private VPC, on-premise, or fully air-gapped — and you own all the code and the data. Cohort data, submissions, and any material learners upload stay inside your perimeter, which matters for enterprise teams that cannot send work to a public AI tool. ### How do we get access to AI Security: The OWASP LLM Top 10 in Production? Request access and we will set it up for your cohort — hosted by ibl.ai, or running against your own deployment. Tell us the group size and timing you need, and whether it should run inside your own perimeter. ### How much does AI training for enterprise cost on ibl.ai? There is no per-seat pricing — you pay for usage or self-host and pay only for the infrastructure, so a 5,000-person rollout does not cost 5,000 licences. 1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University. ## More Enterprise courses - [Agentic AI for the Enterprise: From Chatbot to Workforce](https://ibl.ai/solutions/enterprise/course/agentic-ai-for-the-enterprise): What separates an agent from a chatbot — tools, memory, autonomy — and the orchestration patterns that let agents finish multi-step work without supervision. - [RAG on Enterprise Knowledge: Architecture, Chunking, Evals](https://ibl.ai/solutions/enterprise/course/rag-on-enterprise-knowledge): Production retrieval over enterprise content — chunking strategy, hybrid search, permission-aware retrieval, and the eval harness that proves it works. - [The Enterprise AI Cost Model: Per-Seat vs Token vs Owned](https://ibl.ai/solutions/enterprise/course/enterprise-ai-cost-model): Model AI spend across pricing shapes at real headcount — where per-seat licensing breaks, what tokens actually cost, and when owning the stack wins. - [AI Governance in Practice: NIST AI RMF, ISO 42001, EU AI Act](https://ibl.ai/solutions/enterprise/course/ai-governance-nist-iso-eu-ai-act): Operationalize three overlapping frameworks into one governance program — inventory, risk classification, controls, and the evidence auditors ask for. - [Building an LLM Eval Harness That Ships](https://ibl.ai/solutions/enterprise/course/llm-eval-harness-that-ships): Move from vibes to measurement — task-specific eval design, LLM-as-judge and its limits, regression gates, and production monitoring. - [Model Context Protocol: Connecting Agents to Enterprise Systems](https://ibl.ai/solutions/enterprise/course/model-context-protocol-enterprise): MCP as the integration layer for enterprise agents — server design, authentication, authorization, and exposing internal systems without exposing them to everyone.