Learners complete the governance-framework arc, examining how organizations select and apply the EU AI Act, ISO 42001, OECD principles, and the NIST AI RMF, how AI business use cases are governed through intake and privacy review workflows, and the strategic differences between consumer and enterprise AI adoption, including shadow AI and data residency risk. By the end of this module, learners can evaluate and recommend a governance framework for a given organizational context.

Learners work through the policy and procedural backbone of an AI program: buy-vs-build decision governance, AI policy and responsible-use development, procedures and manuals, AI asset inventories, model cards and documentation standards, data classification and discovery, data augmentation controls, and secure data storage. By the end of this module, learners can build the documentation and data-security controls an AI program depends on.

Learners build the AI security program itself: data destruction and retention, developing an AI security program plan, aligning AI security with enterprise InfoSec, structuring an AI security team, AI-enabled security tools, security metrics/KPIs/KRIs, executive management reporting, and AI incident detection and notification. By the end of this module, learners can stand up and report on an AI security program end to end.

Learners learn to classify AI incidents by severity, design AI-specific business continuity plans, establish red-button and break-glass emergency controls, and apply RTO/RPO thinking to AI disaster recovery. By the end of this module, learners can build a resiliency plan that accounts for AI-specific failure modes.

Learners move into hands-on risk practice: AI risk assessment and impact analysis, risk documentation and treatment decisions, penetration testing methodology, and red-teaming and adversarial-threat techniques used against real AI systems. By the end of this module, learners can plan and interpret an adversarial test against an AI system.

Learners study AI-specific attack chains through a threat-intelligence lens and learn to recognize deepfakes, insider threats, and the emerging risks posed by autonomous AI agents. By the end of this module, learners can map an AI attack chain and identify the threat actor techniques behind it.

Learners cover vendor due diligence and contracts, provider-versus-deployer accountability, third-, fourth-, and fifth-party supply-chain risk, IP ownership and liability, and ongoing vendor monitoring. By the end of this module, learners can run a full AI vendor risk review from intake through ongoing monitoring.

Learners work through AI security architecture and change management, model testing, regression, and TEVV, and the data management practices that guard against data poisoning. By the end of this module, learners can evaluate an AI system's architecture and testing regime for security gaps.

Learners close out the course by applying privacy, ethical, and trust controls, learning control selection and lifecycle management, and building the continuous security-monitoring practices that keep AI systems secure after deployment. By the end of this module, learners can design a monitoring program that keeps a production AI system accountable over time.