Development & technology · Security & DevSecOps
AI training for Security and DevSecOps Teams
AI coding assistants and agents affect application security from two directions. They speed up threat modelling, code review and detection engineering, yet they also produce new code faster than traditional security gates can absorb. Security and DevSecOps teams therefore use AI to triage SAST findings, propose fixes for vulnerabilities, harden CI/CD pipelines and scan infrastructure as code for misconfigurations. What matters is a controlled setup: agents running with least privilege, no secrets in the prompt context, every change traceable through a pull request and human sign-off on security-critical decisions. In this course you learn to use AI as a force multiplier for your security programme while keeping the new risks of generated code, prompt injection and insecure tool integrations firmly under control.
Who is this course for?
- Application security engineers and security champions in development teams
- DevSecOps and platform engineers responsible for CI/CD pipelines
- Penetration testers and red team members
- SOC analysts and detection engineers
- Developers accountable for secure software supply chains
Typical challenges we address
- A flood of SAST, DAST and SCA findings with a high share of false positives
- Security review becomes a bottleneck as AI-assisted teams ship far more code
- Misconfigurations in Terraform, Kubernetes manifests and cloud policies go unnoticed
- New attack surfaces from LLM integrations, prompt injection and over-privileged agents
Practical scenarios from your field
Faster threat modelling
Derive STRIDE-based threat analyses from architecture descriptions and data flow diagrams, identify trust boundaries and turn countermeasures into testable requirements ready for the backlog. The model is updated rather than rebuilt when the architecture changes.
SAST finding triage
Match static analysis results against real code context, assess reachability and exploitability, dismiss false positives with a documented rationale and prepare minimal fixes for genuine vulnerabilities as pull requests.
Secure code review
Have pull requests checked specifically for injection flaws, broken authorisation, insecure deserialisation and cryptographic mistakes, with references to OWASP categories and a clear explanation for every finding.
Hardening IaC and containers
Analyse Terraform modules, Helm charts and Dockerfiles for over-privileged roles, exposed ports, missing encryption and unsafe base images, then generate hardened versions backed by policy-as-code rules.
Detection engineering
Draft Sigma rules, YARA signatures and SIEM queries from threat descriptions, validate them against test data and enrich documentation with the relevant MITRE ATT&CK techniques.
Securing the supply chain
Evaluate SBOMs, prioritise vulnerable dependencies, analyse upgrade paths including breaking changes and add pipeline steps for signing, provenance attestation and dependency pinning. Each update pull request explains the risk.
Possible hands-on projects
Finding triage bot
A script that ingests SARIF output from the pipeline, deduplicates findings, enriches them with code context and opens prioritised tickets with a suggested fix.
Secret scanning hook
A pre-commit hook with custom patterns for internal token formats, allowlist management and clear guidance on how to rotate a leaked secret.
Threat model generator
A small web app that turns a system description into a structured threat model with data flows, risks and mitigations, exportable as a document.
All 10 courses for Security and DevSecOps Teams
Vibe & agentic coding (10)
- Claude Code for Security and DevSecOps Teams
- Vibe Coding for Security and DevSecOps Teams
- Agentic Coding for Security and DevSecOps Teams
- Cursor for Security and DevSecOps Teams
- GitHub Copilot for Security and DevSecOps Teams
- OpenAI Codex for Security and DevSecOps Teams
- Windsurf for Security and DevSecOps Teams
- Model Context Protocol (MCP) for Security and DevSecOps Teams
- AI Agent Development for Security and DevSecOps Teams
- RAG & LLM Applications for Security and DevSecOps Teams
Data protection & compliance
Source code, vulnerability data and logs are highly sensitive: you learn which data may be shared with AI services, how to keep secrets out of the context and how AI use aligns with NIS2, the Cyber Resilience Act, the GDPR and the EU AI Act.
Prerequisites
You have hands-on experience in software development or operations and a working knowledge of application security, such as the OWASP Top 10 and CI/CD pipelines.
Frequently asked questions
Is AI-generated code a security risk?
AI assistants sometimes reproduce insecure patterns, outdated libraries or even non-existent package names. The risk is manageable when generated code passes the same gates as hand-written code: peer review, SAST, dependency scanning and tests. In the course you set up exactly these guardrails while using AI yourself to find and fix vulnerabilities faster.
Should an AI agent be allowed to apply security fixes on its own?
We recommend a tiered model: the agent analyses, proposes fixes and opens pull requests, while humans approve the merge. For low-risk routine work such as dependency updates with passing tests, more automation can make sense. You learn to design permissions, sandboxing and audit trails so every decision remains traceable.
Request without obligation
We will get back to you within one working day with a confirmation or an alternative suggestion.