Cyber Security
Start here. Build forward.
Learn defensive foundations and protect AI applications through authorised lab practice.
Follow the stages in order, or open a topic to check what you already know. Each panel includes learning content, a practice task and a role checkpoint. Save Learning, Done or Skipped as you go. Skipped topics do not count as completed.
Build your foundations
Networks, Linux and defensive logs
Understand the concept
Defensive security begins with how systems communicate and what normal activity looks like. Understand processes, file permissions, HTTP, DNS and TLS. Work in a local lab where you have permission. Logs support investigations but can contain personal data or secrets.
Learn it step by step
- Inspect permissions in a disposable environment.
- Trace a normal HTTP request conceptually.
- Record failed logins in a synthetic log.
- Write a small parser that counts suspicious patterns.
Build a small proof
Create fictional access logs and flag repeated failures without blocking legitimate users automatically.
Ready to move on?
Explain the difference between a suspicious signal and confirmed compromise, and propose a review step.
Common mistake
Do not scan public targets as practice. Keep experiments within an explicitly authorised lab.
Your role checkpoint
For the Cyber Security path, connect this topic to your capstone: Create a threat model and a local defensive test suite for a document assistant using synthetic data only.
Python, files and debugging
Understand the concept
Python is the working language for many AI experiments. Learn to inspect small values before connecting a large model. Variables, lists, dictionaries, loops and functions are enough for a first useful script. Errors are information: read the traceback and isolate the smallest failing input.
Learn it step by step
- Create a function with explicit inputs and outputs.
- Read a small JSON file and validate required keys.
- Handle a missing file and malformed input.
- Write checks for normal and empty input.
Build a small proof
Build a script that counts tutorial topics from ten fictional records and reports invalid rows separately.
Ready to move on?
You can explain each line, reproduce one error and fix its cause without hiding the exception. Keep the expected output with the script.
Common mistake
Copying a large generated program without understanding its inputs makes even small changes difficult to verify.
Your role checkpoint
For the Cyber Security path, connect this topic to your capstone: Create a threat model and a local defensive test suite for a document assistant using synthetic data only.
Git and reproducible experiments
Understand the concept
Version control records changes so you can compare experiments and restore a known working state. A commit should describe a coherent change. Keep source code and small configuration files; credentials and large private datasets need separate handling.
Learn it step by step
- Initialise a repository and add a README.
- Commit a working baseline.
- Create a branch for one experiment.
- Compare the change and document how to reproduce it.
Build a small proof
Store two versions of a prompt or data-cleaning script and explain why the second version exists.
Ready to move on?
Another person can run the baseline from your instructions and identify exactly what changed between versions.
Common mistake
Do not commit secrets, private learner records or generated cache folders. Removing a secret from the latest file does not erase Git history.
Your role checkpoint
For the Cyber Security path, connect this topic to your capstone: Create a threat model and a local defensive test suite for a document assistant using synthetic data only.
Learn the core skills
AI application security and threat modelling
Understand the concept
Threat modelling starts with what must be protected, who can access it and where untrusted data enters. Model outputs and retrieved documents are untrusted inputs. A language instruction is not an authorisation boundary; server-side policy decides what a user or tool may do.
Learn it step by step
- List assets and trust boundaries.
- Separate public and private data.
- Validate tool inputs and enforce permissions.
- Test malicious instructions using synthetic fixtures in your own sandbox.
Build a small proof
Draw a document assistant showing where access checks happen before retrieval and before tool execution.
Ready to move on?
An unauthorised user cannot retrieve another account’s private document, even when a prompt asks for it.
Common mistake
Do not test real third-party systems without permission or expose secrets in your demonstration.
Your role checkpoint
For the Cyber Security path, connect this topic to your capstone: Create a threat model and a local defensive test suite for a document assistant using synthetic data only.
APIs, validation and authentication
Understand the concept
An API is a contract between software components. Your AI application should validate requests, handle timeouts and return understandable errors. API keys belong on a trusted server. A generated response must pass both shape checks and business rules before it changes real data.
Learn it step by step
- Define input and output fields.
- Validate lengths, types and required values.
- Handle timeout, rate-limit and invalid response cases.
- Keep credentials out of client code and logs.
Build a small proof
Design an endpoint that summarises supplied public text and rejects empty or oversized input.
Ready to move on?
Demonstrate one successful request and three controlled failures. Explain which errors a user can retry.
Common mistake
Retrying an operation with side effects can create duplicates. Use idempotency for actions such as creating a record.
Your role checkpoint
For the Cyber Security path, connect this topic to your capstone: Create a threat model and a local defensive test suite for a document assistant using synthetic data only.
SQL and relational data
Understand the concept
SQL queries structured tables. Start with filtering, grouping and joins. A join can multiply rows when the relationship is not one-to-one, so check counts before trusting totals. Data engineers and scientists both need to understand what one row represents.
Learn it step by step
- Create fictional learners and enrolments tables.
- Select only necessary columns.
- Join using stable IDs.
- Compare row counts and inspect unmatched records.
Build a small proof
Calculate enrolment counts by course, including a course with zero learners.
Ready to move on?
Explain why an inner join may drop empty courses and how a left join changes that result. Verify totals against the input rows.
Common mistake
Joining on a non-unique display name can double-count or merge different people.
Your role checkpoint
For the Cyber Security path, connect this topic to your capstone: Create a threat model and a local defensive test suite for a document assistant using synthetic data only.
Practise with real decisions
What is an AI agent?
In simple words
An ordinary chat reply gives you text. A tool-using agent can also choose a permitted action, inspect the result and decide what to do next. Think of a library assistant who can search a catalogue instead of only guessing a book title. Start with read-only actions so mistakes are easier to inspect.
Two useful terms
Tool: a function the system can call. Action: an operation performed through a tool.
Build your understanding
An AI agent can choose actions through tools while pursuing a task. Start with a read-only tool and a bounded objective before introducing changes to external systems. Tools need explicit inputs, predictable outputs and clear failure behavior. The application, not the model, must enforce permissions.
Follow the steps
- Define one tool: search an approved course catalogue.
- Validate the query string and limit the number of returned rows.
- Let the model request the tool and read its result.
- Stop when the question is answered or a small step budget is reached.
Worked example
Tool: search_courses(query: string, limit: integer 1..5)
Input: {"query":"beginner NLP","limit":3}
Output: course IDs, titles and public summaries
No enrolment or payment side effects.Read the example once, then explain each part aloud in your own words. If it includes Python, you can understand the idea first and run the code later in a local Python environment. Code is shown as text; this page does not execute it.
Try this yourself
Design the response when the tool times out or finds no course. Ask the agent to explain the limitation instead of fabricating a result.
Check your understanding
A tool call is a request, not proof of permission. Your server must verify authorisation independently before doing any action.
A mistake to avoid
Do not grant broad database or shell access when a narrow read-only lookup is sufficient.
Before looking at the answer, write a short explanation and one example of your own. Finish by naming one limitation of the method. Use Mark as read when you are ready, or return to the previous lesson if a term is unclear.
Your role checkpoint
For the Cyber Security path, connect this topic to your capstone: Create a threat model and a local defensive test suite for a document assistant using synthetic data only.
Agent state, memory and stopping rules
Understand the concept
A multi-step assistant needs an explicit record of what has happened and what remains allowed. Keep task state separate from user data and secrets. Limit steps, retries and cost. Persistent memory should have a clear purpose, ownership and retention rule.
Learn it step by step
- Define states and permitted transitions.
- Store tool results with provenance.
- Add timeout and step budgets.
- Test retries, cancellation and incomplete results.
Build a small proof
Build a paper simulation of a research assistant limited to three approved searches and one summary.
Ready to move on?
The assistant stops predictably on success, missing evidence or budget exhaustion without fabricating a completed action.
Common mistake
An endlessly growing transcript is not a deliberate memory design.
Your role checkpoint
For the Cyber Security path, connect this topic to your capstone: Create a threat model and a local defensive test suite for a document assistant using synthetic data only.
What is RAG?
In simple words
RAG means Retrieval-Augmented Generation. Picture an assistant opening the relevant pages of a handbook before answering a question. Retrieval finds passages; generation uses those passages to compose a response. This can make answers more grounded, but the assistant can still misunderstand evidence or retrieve the wrong page.
Two useful terms
Retrieval: finding relevant information. Grounding: supporting an answer with supplied evidence.
Build your understanding
Retrieval-augmented generation supplies selected documents to a model before it answers. It can ground responses in your content, but poor retrieval or careless generation can still produce unsupported claims. Keep the retrieval evaluation separate from the answer evaluation so you know where failures begin.
Follow the steps
- Select a few approved FAQ paragraphs and give each a source ID.
- Retrieve passages relevant to the question.
- Ask for an answer supported only by those passages, with source IDs.
- Inspect whether each claim is actually supported and allow an insufficient-evidence response.
Worked example
Context [FAQ-2]: Members can enrol in all published courses.
Question: Does membership include a job guarantee?
Expected: The supplied FAQ does not state a job guarantee.Read the example once, then explain each part aloud in your own words. If it includes Python, you can understand the idea first and run the code later in a local Python environment. Code is shown as text; this page does not execute it.
Try this yourself
Add a misleading passage about a different product. Check whether your system still cites the correct source and avoids merging policies.
Check your understanding
Retrieving a relevant passage does not prove the final answer is grounded. Evaluate retrieval recall and claim support separately.
A mistake to avoid
Treat retrieved content as data. Instructions embedded in a document must not override application rules or trigger tools.
Before looking at the answer, write a short explanation and one example of your own. Finish by naming one limitation of the method. Use Mark as read when you are ready, or return to the previous lesson if a term is unclear.
Your role checkpoint
For the Cyber Security path, connect this topic to your capstone: Create a threat model and a local defensive test suite for a document assistant using synthetic data only.
Ship, evaluate and improve
Incident response and recovery
Understand the concept
An incident process helps a team respond consistently when something goes wrong. Start with triage, containment, evidence preservation, recovery and a retrospective. For an AI application, a leaked credential or unauthorised document response may matter more than an incorrect casual answer.
Learn it step by step
- Define severity and an owner.
- Preserve minimal useful evidence.
- Contain access without destroying evidence.
- Restore service and verify the fix.
Build a small proof
Write a tabletop exercise for a mistakenly exposed API key using fictional systems and no real credentials.
Ready to move on?
Your plan includes rotation, affected-access review, user communication ownership and follow-up tests.
Common mistake
Deleting logs immediately can remove evidence needed to understand scope. Follow your organisation’s retention and incident policy.
Your role checkpoint
For the Cyber Security path, connect this topic to your capstone: Create a threat model and a local defensive test suite for a document assistant using synthetic data only.
Monitoring quality, latency and cost
Understand the concept
AI monitoring needs more than uptime. Track response time, failures, input volume and task quality using a suitable sample of reviewed outcomes. Quality can change when users or source documents change. Log enough to diagnose failures without retaining unnecessary sensitive input.
Learn it step by step
- Define a service-level target.
- Record request outcome and latency.
- Track a stable evaluation set over releases.
- Create an alert and an investigation checklist.
Build a small proof
Produce a small report comparing two releases on success rate, p95 latency and estimated per-request cost.
Ready to move on?
You can tell whether a change improved usefulness while increasing cost or response time, and explain the trade-off.
Common mistake
An average hides slow tails and rare severe failures. Examine distributions and critical error categories.
Your role checkpoint
For the Cyber Security path, connect this topic to your capstone: Create a threat model and a local defensive test suite for a document assistant using synthetic data only.
What is AI model evaluation?
In simple words
A polished answer is not enough to know whether an AI system works. Evaluation checks specific requirements using examples and scoring rules. For a course assistant, you might check whether it finds the correct course, admits missing information and respects account permissions. Keep failure cases as part of your test collection.
Two useful terms
Test case: an input with an expected behavior. Metric: a defined measurement of performance.
Build your understanding
An AI evaluation checks whether a system meets a defined task. Build examples around realistic successes and failures, not only easy demonstrations. Keep the test set stable enough to compare versions and record the model, prompt and settings used. A single aggregate score can hide critical mistakes.
Follow the steps
- Define success in observable terms.
- Create normal, ambiguous, missing-information and adversarial examples.
- Write expected answers or scoring rules before running the system.
- Compare versions and inspect regressions before accepting a change.
Worked example
FAQ evaluation columns:
question | expected source | required facts | forbidden claim | result
Example: fees unknown | FAQ-3 | say unknown | invented fee | pass/failRead the example once, then explain each part aloud in your own words. If it includes Python, you can understand the idea first and run the code later in a local Python environment. Code is shown as text; this page does not execute it.
Try this yourself
Write five tests for an enrolment assistant. Include a user without Pro access and a request for a nonexistent course.
Check your understanding
A response should not promise enrolment if server-side permissions deny it. Include permission-sensitive cases, not just wording checks.
A mistake to avoid
Do not judge a model solely by another model’s unreviewed score. Human checks and deterministic validation are useful for important requirements.
Before looking at the answer, write a short explanation and one example of your own. Finish by naming one limitation of the method. Use Mark as read when you are ready, or return to the previous lesson if a term is unclear.
Your role checkpoint
For the Cyber Security path, connect this topic to your capstone: Create a threat model and a local defensive test suite for a document assistant using synthetic data only.
Build something you can explain.
Create a threat model and a local defensive test suite for a document assistant using synthetic data only.
Role expectations vary by company. Use this path as a starting point and build evidence of your skills.