AI Security Basics

#### The problem
Most IT and security staff can name ChatGPT but can't explain why an LLM hallucinates, what makes prompt injection different from SQL injection, or why a RAG pipeline or an agent with tool access changes your attack surface. Vendors sell AI tools faster than security teams can assess them, and decisions about AI get made without anyone in the room who understands how these systems actually work or fail. This course gives you that grounding before you go deeper into AI-specific threat modelling, risk management, or governance.

#### What you will learn
- Explain what AI, machine learning and deep learning are, how they learn, and where today's models (transformers, LLMs, diffusion models, multimodal and reasoning systems) came from
- Recognise current AI tool categories — assistants, copilots, RAG, agents with tool access and MCP, open-weight versus hosted models — and apply criteria for choosing and vetting them
- Describe how the AI attack surface differs from classic IT: data, model, infrastructure and use, and what confidentiality, integrity and availability mean for AI systems
- Identify core attack vectors — data poisoning, evasion, model extraction, membership inference, prompt injection, jailbreaks, supply chain risks — and map them to OWASP Top 10 for LLM Applications and MITRE ATLAS
- Compare how attackers weaponise AI (phishing, deepfakes, voice clones, malware) against how defenders use it (detection, triage, SOC assistance), and see the limits of both
- Apply the GNSEC ZoneLock Security Model (ZLSM 2026) at a basic level to reason about zones, exposure and flows in one worked AI example

#### Who it is for
This course is for IT and security staff, developers, project managers, auditors and managers who need to understand AI well enough to secure it, staff it or decide on it, but have no AI background. It requires basic IT knowledge; no maths or programming is assumed. It is the entry point to Quantropic's AI security track and the required foundation for "AI Security for Cybersecurity Experts" and "AI Risk Management for Cybersecurity Experts".