Applied AI Security Certificate Program
IDCYSE.AAICP

Hands-on Training from Experts Live Online or Self-Paced

Three courses that secure an AI system end to end — hardening the attack surface, watching it in production, then deliberately trying to break it and proving it is trustworthy enough to run.

Book self-paced course Request group training
Loading...

This program includes

  • 32 hours of live, project-based training from experts
  • Retake for free within 1 year
  • Verified digital certificate of completion
  • Learn at an accredited institution

This certificate treats AI systems as systems, covering the data, the model, the pipeline and the application rather than treating AI as a policy topic. It opens by separating traditional cybersecurity risk from genuinely AI-specific risk, then runs the AI lifecycle from design through retirement with security gates at each stage. The core is adversarial machine learning — poisoning attacks against training data, evasion attacks against deployed models, privacy attacks that target training information, and model extraction — grounded in the NIST adversarial machine learning taxonomy. Generative AI gets its own treatment: direct and indirect prompt injection, insecure output handling, and the risks introduced by retrieval-augmented generation, plugins and external data sources.

It then moves from building to watching, and finally to breaking. An AI system can be compromised without anyone touching the server it runs on, so monitoring has to move from whether the system is running to whether it is behaving the way it is supposed to, on data it is supposed to see. The path covers the four categories of AI monitoring and the signals that distinguish them — a sustained spike in near-identical unusual inputs reads as adversarial probing, a slow accuracy decline reads as drift, an unexplained query spike from one credential reads as an extraction attempt — along with the evidence responders routinely fail to preserve, meaning model version, prompt and response logs, training data lineage and guardrail configuration. Severity is classified by impact rather than technical complexity, on the principle that an incorrect benefits determination caused by a data integrity failure is high severity even though nothing technically broke. It closes on adversarial testing and assurance, separating two things agencies routinely conflate: red teaming is deliberately trying to break a system, while assurance is the documented evidence that it is trustworthy enough for its purpose. That means the engagement lifecycle, rules of engagement, and the assurance case as claim, argument and evidence in a form an oversight body can audit — then extends everything to foundation models and to agentic AI, where the attack surface expands from what a system says to what a system does.

Read more

Courses in this Certificate Program

This is the recommended order, but some courses may be taken in a different order.

Download Syllabus PDF

Unit 1 12 Hours

Securing AI/ML Systems: Protecting the Intelligent Attack Surface Course

An intermediate engineering course on securing AI and machine learning systems across data, model, pipeline and application, centred on adversarial machine learning and generative AI security.

  • AI/ML system architecture, and models, datasets, pipelines, applications and infrastructure distinguished
  • Traditional cybersecurity risk separated from AI-specific risk
  • Security across the full AI lifecycle, from design through retirement
  • Confidentiality, integrity, availability and provenance of training and operational data
  • Data poisoning and manipulation across collection, labeling and preprocessing
  • Poisoning, evasion, privacy and model-extraction attacks, with defenses that raise robustness
  • Models, weights and checkpoints as protected assets, with provenance and integrity verification
  • Third-party models, datasets, libraries and frameworks as supply-chain dependencies
  • Direct and indirect prompt injection, insecure output handling, and RAG risk
  • Securing ML pipelines, orchestration platforms, APIs and deployment
  • Detecting abnormal inputs, outputs and behavior, and telling degradation from compromise
  • AI-specific incident response, including containment, model rollback and post-incident validation

Unit 2 12 Hours

AI Red Teaming and Assurance Course

Advanced adversarial testing and assurance for AI systems — the capstone that connects breaking a system to proving it is trustworthy enough to run.

  • Red teaming separated from adjacent assurance activities and placed in the assurance lifecycle
  • The engagement lifecycle from planning through reporting
  • Scoping to a system's risk classification and setting usable objectives
  • Rules of engagement, team composition and deconfliction
  • Matching adversarial testing techniques to the attack surface
  • Manual expert-driven testing against automated and tool-assisted approaches
  • Generative AI probing techniques
  • Separating a genuine red-team finding from an ordinary bug
  • TEVV records that support a risk decision
  • Assurance cases built as claim, argument and evidence
  • Model cards, system cards, and independent evaluation results
  • Findings reports prioritized by impact over technical complexity
  • Remediation, retesting, and human oversight as a mitigation category
  • When a finding becomes an incident
  • Extending testing and assurance to foundation models and agentic systems

Unit 3 8 Hours

AI Security Monitoring and Incident Response Course

AI security monitoring and incident response for practitioners: what to watch for, distinguishing incidents from anomalies, and the first-hour response.

  • AI security risks that differ from or compound traditional IT risk
  • Working vocabulary: data poisoning, adversarial examples, prompt injection, drift, extraction
  • What continuous monitoring means for a high-impact AI system
  • The four AI monitoring categories and matching techniques
  • Risk-based security event logging for AI systems
  • Reading monitoring signals and identifying likely causes
  • Distinguishing anomalies from AI security incidents
  • Preserving model version, prompt and response logs, and training data lineage
  • Severity classified by impact on safety, rights, mission and data
  • The four-phase incident response lifecycle applied to AI
  • AI-specific containment including model rollback and disabling automated decisioning
  • Post-incident root cause analysis and revalidation

Schedule & Enrollment: Applied AI Security Certificate Program

  • 32 Hours
  • Price before discounts: $2,897 Full tuition: $2,299
  • Live Online
  • Free retake
  • Expert instructors
  • Small classes
  • Self-Paced More details
    Start anytime Online only
  • Custom Schedule
    G
A group of adult learners sits in a classroom, smiling and engaged in a government training session.
A government training instructor in a suit gestures while teaching in front of a whiteboard covered with notes and diagrams.
A person in professional attire holds a Graduate School USA folder, symbolizing participation in government training programs.

Group Training

Since 1921, Graduate School USA has partnered with over 125 federal agencies and trained more than one million federal employees. Led by instructors with deep, real-world knowledge of federal regulations, policies, and practices, our private group programs are practical, mission-driven, and tailored to your agency’s objectives. We offer expertise across key federal domains—including human resources, financial management, acquisition and contracting, leadership, and more—to deliver training where and how your team needs it.

Complete this form and we’ll get back to you within 1 business hour.

The Fact Is – We’ve Been Government’s Training Partner Since 1921

400+ Courses & Certificates 125+ Federal Agencies Served 200+ Subject-Matter Experts