Skip to content
Neural Soft
Contact us Español (View this page in Spanish)

Governance, compliance and security

Generative AI security course: OWASP, risks and practical mitigations

Protect your AI applications from attacks and information leaks.

Request information

Applications built on language models have a new attack surface: a document, a website or an email can contain hidden instructions the model follows, and an agent with too many permissions can do a lot of damage. Classic security controls are not enough.

This course goes through the threats in the OWASP Top 10 for LLM applications with real examples and an attack-and-defence lab: prompt injection, data leakage, RAG weaknesses, excessive agency, supply chain and unbounded consumption. We finish with red teaming and security governance.

What you will learn

  • Understand the threats specific to LLM applications
  • Apply the OWASP Top 10 for LLM applications
  • Design layered defences against prompt injection
  • Protect data, agents and the supply chain
  • Red-team an AI application

Syllabus

8 modules, from the fundamentals to the final project.

  1. The new perimeter

    • Why generative AI opens up new risks
    • Threat model of an LLM application

  2. Prompt injection

    • Direct and indirect (through documents and websites)
    • System prompt leakage
    • Layered defences

  3. Data

    • Sensitive information disclosure
    • Embedding and vector database weaknesses in RAG
    • Data and model poisoning

  4. Outputs and actions

    • Improper output handling
    • Excessive agency of agents and tools
    • Least privilege and approvals

  5. Supply chain

    • Third-party models, libraries and MCP servers
    • Verification and provenance

  6. Availability and misuse

    • Unbounded consumption and costs
    • Misinformation and harmful content

  7. Red teaming

    • Planning adversarial tests
    • Automated testing tools
    • Lab: attack and defend an application

  8. Security governance

    • Policies, logs and incident response
    • AI Act cybersecurity requirements

Tools you will practise with

  • OWASP Top 10 for LLM Applications
  • MITRE ATLAS
  • garak
  • promptfoo (red teaming)
  • Python

Hands-on project

In a lab, you attack a vulnerable AI application (a chat with RAG and tools), document the flaws you find against the OWASP Top 10 for LLMs and apply mitigations until it passes the tests.

Requirements

  • Software development or IT security knowledge.

Other courses

Where it is applied

  • AI integration in apps and systems

    We add AI to the tools your business already uses to automate tasks, search information and connect data without having to change everything.

Want this course for your team?

We adapt the content, length and format to your company.

Request information