One-day developer course · Sydney, Melbourne and online
Securing LLM applications
A one-day, hands-on course for the engineers who build and run AI features. You will attack a realistic assistant, then defend it: prompt injection, data exfiltration through retrieval, over-privileged agents, logging of personal information, and the controls that hold up in production.
Who it's for
Engineers responsible for AI features that handle customer data.
Software engineers
Who have shipped an assistant, agent or RAG system and need to know how it can be abused.
Technical leads
Who review AI designs and set the security bar for their team.
Security engineers
Who know application security and need the LLM-specific threat model.
Technical founders
Who are about to put an AI feature in front of enterprise customers and their questionnaires.
What you'll be able to do
By the end of the day you will be able to:
- Explain the OWASP Top 10 for LLM applications and map it to your own system
- Perform direct and indirect prompt-injection attacks, and defend against them in layers
- Apply access control to retrieval indexes so users only see what they are entitled to
- Constrain agents: least-privilege tools, step and spend limits, human approval for consequential actions
- Keep personal information out of prompts and logs, and meet Privacy Act obligations
- Write a security test suite for an LLM feature that runs in CI
Agenda
A full day, roughly half explanation and half labs against a deliberately vulnerable assistant.
- 9:00
The LLM threat model
What is new about securing AI features, and what is not. The OWASP LLM Top 10, with examples from Australian businesses.
- 10:00
Prompt injection
Direct and indirect injection, jailbreaks and tool-call hijacking. Lab: extract the system prompt and a hidden record from the assistant.
- 11:30
Defence in depth
Input handling, output validation, instruction hierarchy, allow-lists and guardrail models. Lab: defend the assistant and re-test.
- 13:30
Retrieval and data exposure
Access control for indexes, tenant isolation and document-level permissions. Lab: find and fix a cross-tenant leak.
- 14:45
Agents and permissions
Least-privilege tools, step and spend limits, approval gates and audit logs. Lab: contain a runaway agent.
- 16:00
Logging, privacy and testing
Keeping personal information out of logs, Privacy Act obligations, and building an LLM security test suite for CI.
What's included
You keep everything you build and break.
- The vulnerable lab application and its hardened version
- A security test suite template for LLM features
- An LLM security review checklist aligned to the OWASP LLM Top 10
- Slides, reading list and a certificate of completion
- A 30-minute design review of your own AI feature within a month
Questions
Is this an application security course?
It assumes basic web security knowledge and focuses on what is specific to LLM applications: prompt injection, retrieval exposure, agent permissions and privacy. It pairs well with any general AppSec training.
Which frameworks and providers are covered?
The techniques apply to any provider. Labs use a Python or TypeScript application against Amazon Bedrock and the OpenAI API, and the defences are framework-agnostic.
Can you run this against our own application?
In an in-house session, yes. Testing your own system during the course is often the most valuable part, and we agree the rules in writing first.
Does this replace an AI security review?
No. The course gives your engineers the skills; the AI security review is an independent assessment of your business and systems. Many clients do both.
Related courses
Building cost-efficient LLM applications
For developers. Token-level cost attribution, evaluation, model routing, caching, prompt and retrieval trimming, and agent limits, applied to a working application.
Course detailsHalf day · $290 per seatAI for business leaders
What today's AI can and can't do, how to find real opportunities, and how to manage the risk. No code.
Course detailsOne day or more · From $3,900 per dayCustom in-house training programs
Any course, or a mix, delivered to your team on your systems and your data. Up to 12 people per session.
Course detailsTrain the people who build your AI features
Public cohorts run monthly in Sydney, Melbourne and online. Register your interest and we will send the next dates.