- Time
- 25–34 weeks + Ongoing
- Before this
- AI and machine learning, Cybersecurity fundamentals
- Leads to
- AI security engineer, AI red teamer, ML security researcher, AI governance and risk specialist
People who know the basics of both machine learning and security, and want to work where the two meet.
Only attack models, apps and systems you own or have written permission to test. Use the labs and open-source tools below.
-
Stage 1: Foundations: machine learning and security basics , 4–6 weeks
What to learn
Free resources
Build: Draw the architecture of a small ML or LLM app (data, model, API, users) and mark every place an attacker could reach.
Move on when: You can train a simple classifier and explain the OWASP Top 10 web risks. If not, do the first stages of the AI and machine learning and Cybersecurity fundamentals paths first.
-
Stage 2: Threats to AI systems , 3–4 weeks
What to learn
Free resources
Build: A threat model for your app from stage 1, mapped to OWASP LLM risks and MITRE ATLAS techniques, with one mitigation for each.
Move on when: For any AI feature, you can name the three most likely attacks and where each one enters.
-
Stage 3: Adversarial machine learning , 8–10 weeks
What to learn
Free resources
Build: Attack your own image or text classifier with an evasion attack using the Adversarial Robustness Toolbox, then add a defence and measure how much it really helps.
Move on when: You can run an evasion and a poisoning attack on your own model and explain why most simple defences fail.
-
Stage 4: LLM security in practice , 6–8 weeks
What to learn
Free resources
Build: Build a small LLM app that reads documents, red-team it with garak or PyRIT, then add guardrails and show the before and after results.
Move on when: You can find a prompt injection in an LLM app you didn't write, explain the root cause and propose a fix that doesn't rely on the prompt alone.
-
Stage 5: Governance, risk and regulation , 4–6 weeks
What to learn
Free resources
Build: A two-page risk assessment for your LLM app using the NIST AI RMF functions (Govern, Map, Measure, Manage), including which EU AI Act risk level it would fall under.
Move on when: You can explain to a manager what the EU AI Act asks of a high-risk system and how the NIST AI RMF helps meet it.
-
Stage 6: Specialise and keep up , Ongoing
What to learn
Free resources
Build: Publish something others can use: a write-up of an AI CTF, a reproduction of a recent attack paper, or a small open-source tool.
Move on when: This stage never ends. New attacks on AI appear every month.
Specialise: security roadmaps Certification roadmaps Back to all paths