Cyber CommonsCyber CommonsNavigating Cyber Singularity
Curriculum

All lessons

149 lessons0 recorded

Working through a function, or running it for other people? There is a course guide for each of the six.

Function A — Getting Started — Building Agentic AI

A0 Set Up — Your Machine, How to Use This, and the Words for an Agent Course guide →

· A0.0 Set up your computer — what this is, who it is for, and the model every lesson runs on

· A0.1 Nine words for an agent — harness to multi-agent, and where each is built

A1 Build the Agent — From a Loop to a Running Platform Course guide →

· A1.0 What an agent is, and what you are about to build

· A1.1 The loop — model, tools, and the step that turns text into an action

· A1.2 Tools over MCP — a resource server, and why it is a separate process

· A1.3 Identity — the human, the workload, and the call

· A1.4 Delegation — one token per action

· A1.5 Memory — what it remembers, and where that came from

· A1.6 Agent to agent — handing work over without laundering authority

· A1.7 The human gate, and the budget that stops the loop

A2 Harness Engineering — Making a Demo Into a System Course guide →

· A2.0 Why a demo is not a system — the harness around the loop

· A2.1 Observability — the run as spans

· A2.2 The audit trail, and the four questions it has to answer

· A2.3 Evaluating what you built, before anybody attacks it

· A2.4 Evaluating the agent's behaviour — tool calls, outputs, and the model as judge

· A2.5 What you have built — and every way it can now go wrong

Function B — Securing AI Architectures

B1 CyberTravels' Architecture, and Every Risk It Carries Course guide →

· B1.0 Start here — what securing an AI architecture means

· B1.1 The reference architecture for agentic AI

· B1.2 Prompt injection

· B1.3 Indirect prompt injection

· B1.4 Memory poisoning

· B1.5 Tool misuse

· B1.6 Privilege compromise

· B1.7 Identity spoofing and impersonation

· B1.8 Malicious code execution

· B1.9 Injection through content the agent was asked to read

· B1.10 Agent communication poisoning

· B1.11 Rogue agents in a multi-agent system

· B1.12 Cascading hallucination

· B1.13 Resource overload

· B1.14 Repudiation and untraceability

· B1.15 Overwhelming the human in the loop

· B1.16 Misaligned and deceptive behaviour

· B1.17 Attacks that target the humans

· B1.18 The CyberTravels risk register

· B1.19 The control index — every control CyberTravels needs, not only the new ones

B2 Securing the Architecture — Identity and Ingress Course guide →

· B2.1 Agent identity — user, workload, agent

· B2.2 Bootstrapping the first credential

· B2.3 Delegation that narrows, and survives audit

· B2.4 Just-in-time authority

· B2.5 The non-human identity lifecycle

· B2.6 Ingress: marking untrusted content at the door

· B2.7 Attribution: an audit trail that answers "who"

· B2.8 An audit trail the workload cannot forge

B3 Securing the Architecture — Runtime and the Gateway Course guide →

· B3.1 Default-deny on the tool call

· B3.2 Sandboxed execution

· B3.3 Egress control

· B3.4 Budgets and stop conditions

· B3.5 Validating what comes back

· B3.6 Human approval that survives volume

· B3.7 The agent gateway — one choke point when you scale

· B3.8 Shared infrastructure between agent runs

· B3.9 Turning a control off without turning the system into an experiment

· B3.10 The agent's escalation path

· B3.11 Securing the developers' coding agents

Function C — Application Security with an AI SDLC

C2 The AI SDLC — an Agentic AppSec Pipeline, Before and After Deploy Course guide →

· C2.0 The AI SDLC — what runs before a deploy, and what runs after

· C2.1 What building a harness means in security engineering

· C2.2 Threat modelling from what the estate already knows

· C2.3 SAST for agentic code — deterministic Semgrep, then the model pass

· C2.4 Deduplication and contextual verification

· C2.5 Feasibility filtering, reachability and dead code

· C2.6 Sandbox replication

· C2.7 Supply chain — SBOM, dependency vulnerabilities, and decompiling the libraries

· C2.8 Dynamic exploitation (DAST)

· C2.9 Exploit chaining

· C2.10 Agentic penetration testing — the loop, and who runs each turn

· C2.11 White-box agentic pentest — the source, and what it lets you prove

· C2.12 Black-box agentic pentest — inference, and refusing to report it as fact

· C2.13 Grey-box agentic pentest — one credential per role, and the matrix it fills

· C2.14 Bonus — testing safely: the controls an offensive agent runs inside

· C2.15 Severity calibration, triaging and reporting

· C2.16 Remediation engineering — proven in a sandbox before the merge request

· C2.17 Context engineering — cutting the false positives

· C2.18 Agentic AI in the pipeline — attesting control intent for agents and MCP servers

· C2.19 Bonus — Google Mantis, the pipeline in production

Function D — Agentic Evaluation and Red Teaming

D1 One Red-Team Lifecycle, End to End Course guide →

· D1.0 Start here — the evolution of non-deterministic threat simulation

· D1.1 Platform ingestion and supply-chain risks

· D1.2 Weaponizing the ingestion path

· D1.3 Cognitive vulnerability and elicitation scaling

· D1.4 Establishing telemetry and detecting the actor

· D1.5 Emergent swarms and multi-agent proliferation

· D1.6 High-concurrency detection engineering

· D1.7 Triaging the non-deterministic swarm

· D1.8 Defensive deception and threshold failures

· D1.9 Machine-speed containment and fleet revocation

· D1.10 Forensic replay and control architecture

· D1.11 Institutional governance and compliance

Function E — The Agentic SOC

E1 Discover — the Sensors, and the Agent-Shaped Hole in Them Course guide →

· E1.0 Start here — the agentic SOC, and the stack that runs it

· E1.1 The sensor estate — EDR, DLP, CSPM and CNAPP against an agent

· E1.2 Drift monitoring — behaviour that changes without a code change

· E1.3 Bonus — finding the agents, and keeping what they emit

E2 Detect — the Lake, and Rules Mapped to MITRE Course guide →

· E2.1 The detection data lake — where agent telemetry lands

· E2.2 Detections whose subject is the agent — mapped to ATT&CK and ATLAS

· E2.3 Detections whose subject is the agent platform

· E2.4 Agent-assisted detection engineering — written by a loop, shipped by a human

· E2.5 Rules generated from an incident — and the benign corpus that decides them

· E2.6 Honeypots, canaries and deception — the detector with no threshold

E3 Understand — Correlation, Intel and the Hunt Course guide →

· E3.1 From alert queue to loop operator

· E3.2 Admission rules — what the investigating agent may touch

· E3.3 The context that makes agent triage work

· E3.4 When the actor is an agent — three instincts that misfire

· E3.5 Agent-assisted reconstruction — a timeline you can challenge

· E3.6 Plan, then replan — an investigation that changes its mind

· E3.7 Scoping an agentic incident — following the delegation graph

· E3.8 Fleet-level correlation — seeing a swarm

· E3.9 Third-party threat intelligence, and the tactics it names

· E3.10 Hunting in agent telemetry

E4 Respond — From a Conclusion to the Actor Stopped Course guide →

· E4.1 Remediation policy — what may be done without asking

· E4.2 Runbook tiers — fully automated, human in the loop, manual

· E4.3 Containment at machine speed

· E4.4 Stop authority — who halts a fleet, and how long it takes

· E4.5 The fleet kill switch

E5 Recover and Root Cause — From Stopped to Back at Target Course guide →

· E5.1 Replay and forensics — reproducing a run you can defend

· E5.2 The root cause record — naming a control, not a person

· E5.3 Post-incident change surface — picking the layer the fix belongs in

· E5.4 Validating the fix — re-measuring the indicators the incident moved

· E5.5 Proposing the policy change — the diff, and what it does not fix

· E5.6 The regulatory clock — awareness, not confirmation

Function F — AI Governance for Agentic Systems

F1 Building the Governance Framework — Risk and Control Course guide →

· F1.0 Start here — what AI governance means

· F1.1 From framework control to key control indicator

· F1.2 Building the AI and agent inventory

· F1.3 Risk tiering agentic use cases

· F1.4 Control mapping for agents

· F1.5 Evaluation output as audit evidence

· F1.6 Operating vs outcome guardrails

· F1.7 Continuous control verification

· F1.8 Third-party and model supply chain risk

· F1.9 Model and agent lifecycle governance

· F1.10 The stakeholder map — who owns what

· F1.11 Model risk management for AI systems

· F1.12 Working the seams

· F1.13 Measuring the controls on CyberTravels — gaps and mitigations

F2 Building the Governance Platform — Regulatory and Compliance Course guide →

· F2.1 The regulatory map

· F2.2 Horizontal AI regulation

· F2.3 Voluntary frameworks as your spine

· F2.4 Sector overlays

· F2.5 Privacy and data protection

· F2.6 Incident and disclosure obligations

· F2.7 Documentation that survives supervision

· F2.8 Auditability of autonomous action

· F2.9 Regulator and auditor conversations

F3 Running the Programme — the CISO Office Course guide →

· F3.1 Translating agentic risk upward

· F3.2 Governing autonomy rather than approving tools

· F3.3 Sequencing the programme

· F3.4 Org design and ownership

· F3.5 The metrics that matter at your level

· F3.6 Saying no, and saying yes with conditions

· F3.7 Building the capability

· F3.8 Resilience over perfection