QSECDEF AI Security & Resilience Leadership Bootcamp

Introduce the whole programme. Establish what modern AI systems are made of, where their security boundaries sit, why AI is an enterprise risk and who is accountable before deployment. Regulation is introduced here as a landscape and examined in depth in Week 9.

Beyond the Model: AI Systems, Agents and Their Security Boundaries

An AI system is far more than a model. It combines training and retrieval data, prompts, tools, APIs, orchestration, hosting and suppliers, and increasingly agents that plan and act. This opening lecture provides the map the rest of the programme follows: every later week examines one part of it.

AI Risk and Accountability: Responsibilities Before Deployment

AI can affect decisions, sensitive information, customers and operations, and it can enter an organisation through formal procurement, embedded software or individual use. This session reframes AI as an enterprise system with accountable owners, and shows how context and evidence matter when deciding whether and how to deploy it.

Learning outcome

By the end of this session you will be able to describe the components of an AI system, identify where its security boundaries sit, distinguish the responsibilities of providers, deployers and data owners, and list the leadership questions to answer before deploying AI.

Who should attend?

CISOs and security architects, AI and technology leaders, risk, governance and compliance professionals, programme managers and anyone responsible for approving or overseeing AI adoption.

Who can attend?

Anyone may attend the free weekly sessions. No prior experience is required, and no background in cryptography, quantum physics or AI engineering is needed.

Make AI dependencies visible and strengthen procurement, lifecycle and supplier oversight.

Know What You're Running: AI Inventories, Model Lineage and AI-BOMs

Organisations cannot reliably govern systems they cannot identify. The session covers models, code, data sources, interfaces and dependencies for security teams and owners who need traceability and repeatable review.

Buying AI Safely: Supplier Due Diligence, Contracts and IP Risk

Supplier contracts influence data use, incident handling, liability and exit options. This session gives procurement, legal, security and business owners a common set of topics without treating any clause as universally sufficient.

Learning outcome

By the end of this session you will be able to explain AI asset inventories and bill-of-materials approaches, identify the components to track, and list the security, privacy, intellectual-property and continuity questions to put to any AI supplier.

Who should attend?

Security architects, technology and data leaders, procurement and supplier-risk managers, legal and privacy teams, and governance specialists.

Who can attend?

Anyone may attend the free weekly sessions. No prior experience is required, and no background in cryptography, quantum physics or AI engineering is needed.

Explain practical AI attack paths and controls that reduce likelihood and impact.

Can You Trust the Data? Poisoning, Provenance and Ingestion Controls

AI behaviour depends partly on data used to train, fine-tune, retrieve or operate a system. The risk depends on design and attacker access; this session is relevant to data owners, AI engineers and assurance teams.

Prompt Injection and Data Leakage: Controlling What AI Can Do

Prompt injection can influence how an application interprets instructions or retrieved content. Risk increases when the system connects to confidential data or action-taking tools. No single prompt or filter reliably eliminates it.

Learning outcome

By the end of this session you will be able to describe data-poisoning and prompt-injection risks, explain why model instructions are not a security control, and identify layered controls that limit what an AI system can access and do.

Who should attend?

AI and data professionals, security engineers and architects, application owners, CISOs and technology-risk teams.

Who can attend?

Anyone may attend the free weekly sessions. No prior experience is required, and no background in cryptography, quantum physics or AI engineering is needed.

Address risks when AI reaches internal systems, retrieves documents or acts on behalf of users.

AI Agents Need Identity Too: Permissions, Secrets and Zero Trust

Agents can invoke tools, access APIs and perform tasks previously requiring a person or service account. Their privileges need deliberate design and monitoring.

Private Data in AI: Securing RAG, Vector Databases and Retrieval

RAG retrieves organisational information to inform responses, but does not automatically make data private or enforce authorised access. This matters for internal knowledge assistants and data-connected applications.

Learning outcome

By the end of this session you will be able to explain identity and access-management principles for AI agents, identify the controls that limit the impact of a compromised or misused agent, and describe the main access-control risks in RAG and vector-search pipelines.

Who should attend?

Identity and access-management professionals, security architects, AI platform and data teams, cloud-security specialists and application owners.

Who can attend?

Anyone may attend the free weekly sessions. No prior experience is required, and no background in cryptography, quantum physics or AI engineering is needed.

Separate demonstrated AI-enabled cyber activity from emerging research and speculative scenarios.

AI in the Attack Chain: Threats, Defence and the Limits of Automation

AI can support reconnaissance, social engineering, coding assistance and analysis. It can also help defenders with investigation, alert triage, code review and vulnerability prioritisation. Both offensive and defensive uses require evidence, validation and appropriate controls; neither should be treated as universally reliable or fully autonomous.

Quantum Computing, Geopolitics and AI Security: What Is Real?

Quantum computing and quantum machine learning are active research areas, but claims about imminent automated malware, universal speedups or routine quantum-enabled cyberattacks are not established operational facts. At the same time, concentration of advanced compute, models, data and critical suppliers can create genuine strategic dependencies. The priority is proportionate monitoring and cryptographic readiness.

Learning outcome

By the end of this session you will be able to describe credible uses of AI in cyber operations and defence, distinguish increased scale from fundamentally new capability, separate established quantum-computing facts from speculation, and explain how compute and supplier dependencies create strategic risk.

Who should attend?

Cybersecurity leaders, threat-intelligence and SOC teams, security architects, risk professionals, technology executives and policy advisers.

Who can attend?

Anyone may attend the free weekly sessions. No prior experience is required, and no background in cryptography, quantum physics or AI engineering is needed.

Connect enterprise AI risk to long-term confidentiality, authenticity and cryptographic resilience. HNDL and TNFL are explained as distinct risk pathways, not interchangeable labels.

Who Owns AI Risk? Governance, Accountability and Enterprise Exposure

AI failures may arise from data, permissions, suppliers, oversight or operational dependencies, not just the model. This session gives leaders a framework for ownership, risk appetite and escalation.

Long-Term Data and Trust: HNDL, TNFL and Quantum Readiness

Harvest Now, Decrypt Later (HNDL) concerns the possible future decryption of retained encrypted information when vulnerable cryptography is involved. Trust Now, Forge Later (TNFL) is shorthand for potential future risks to signature authenticity and trust mechanisms. The conditions and impacts differ; neither implies that all data or signatures are already compromised.

Learning outcome

By the end of this session you will be able to explain how AI risks are owned and escalated across functions, and distinguish future decryption risk from future signature-authenticity risk, identifying why information lifetimes and cryptographic dependencies matter to AI systems.

Who should attend?

CISOs, technology-risk leaders, AI governance professionals, operational-resilience teams, data owners, programme managers and cryptography practitioners.

Who can attend?

Anyone may attend the free weekly sessions. No prior experience is required, and no background in cryptography, quantum physics or AI engineering is needed.

Move from understanding the risk to a manageable cryptographic migration programme.

You Can't Migrate What You Can't See: CBOM and Cryptographic Discovery

Cryptography is embedded across applications, devices, protocols, certificates, suppliers and services. An inventory helps identify dependencies and difficult replacements.

Planning the PQC Transition: Standards, Timelines and Procurement

PQC migration involves discovery, design, testing, procurement and deployment. The roadmap must reflect the organisation's own estate and obligations; timing varies across systems and suppliers.

Learning outcome

By the end of this session you will be able to describe the purpose of a cryptographic inventory and how a CBOM supports migration governance, identify the main NIST PQC standards, and explain how to translate guidance into a realistic, phased migration roadmap.

Who should attend?

Security architects, infrastructure and PKI leaders, cryptography professionals, CISOs, technology-risk teams, procurement and programme managers.

Who can attend?

Anyone may attend the free weekly sessions. No prior experience is required, and no background in cryptography, quantum physics or AI engineering is needed.

Connect signatures, provenance and tamper-evident records to AI artefacts and data, and show how enforceable boundaries keep AI agents and collaborative AI accountable, without suggesting that PQC or blockchain solves every AI-security problem.

Protecting AI Models, Updates and Data: Signatures, Provenance and Audit Trails

Models, weights, code, configuration and training data move through supply chains. Signatures can help verify origin and detect modification, and provenance records can show how an output was produced, but both depend on secure keys, trusted validation, sound processes and the recognition that the integrity of a record is not the same as the truth of its content.

Guardrails for AI Agents and Collaborative AI: Zero Trust, Limits, Recovery and Secure Data Collaboration

Agents should not be relied on to enforce their own limits. Controls belong in the surrounding systems. Likewise, collaborative AI such as federated learning can support work on sensitive data without centrally collecting it, but does not automatically prevent leakage or misuse. In both cases the design of the boundary, not the technology alone, determines the protection.

Learning outcome

By the end of this session you will be able to explain how signatures, provenance and audit trails verify AI artefacts and data origin, compare distributed ledgers with conventional controls, describe practical methods for constraining agent actions, and distinguish federated learning's goals from the protections of encryption and PQC.

Who should attend?

Product-security teams, AI platform architects, software supply-chain security professionals, data leaders, PQC practitioners and anyone deploying agents or collaborative AI.

Who can attend?

Anyone may attend the free weekly sessions. No prior experience is required, and no background in cryptography, quantum physics or AI engineering is needed.

Having built the technical and organisational understanding, examine in depth the regulatory landscape introduced in Week 1: what is binding, what is guidance, who it applies to and how obligations connect to the controls covered in earlier weeks. All references are educational context, not legal advice.

The AI Regulatory Landscape: EU AI Act, Roles, Obligations and Standards

The EU AI Act is the first comprehensive AI law and the reference point for many organisations, but it sits alongside data protection, product and sector rules, harmonised standards and voluntary frameworks. Leaders need to know which role they occupy, which obligations follow and what evidence demonstrates compliance.

Cyber Resilience, Product Security and Cryptographic Obligations: CRA, NIS2, DORA and the PQC Timeline

AI-enabled systems are also products with digital elements, components of essential services and parts of financial ICT estates. The Cyber Resilience Act, NIS2 and DORA each bring obligations that apply regardless of whether AI is involved, while national and European PQC roadmaps increasingly set expectations for cryptographic migration. This session connects those obligations to the inventories, supplier assurance and migration planning covered in Weeks 2, 6 and 7.

Learning outcome

By the end of this session you will be able to explain the EU AI Act's structure and role-specific obligations, distinguish legal requirements from standards and guidance, identify the main European cyber-resilience obligations relevant to AI-enabled systems, and explain how regulatory timelines shape post-quantum migration planning.

Who should attend?

Governance, risk and compliance professionals, legal and privacy teams, CISOs, AI governance leads, product owners in regulated sectors and advisers to critical-infrastructure organisations.

Who can attend?

Anyone may attend the free weekly sessions. No prior experience is required, and no background in cryptography, quantum physics or AI engineering is needed.

Bring the programme together into an executive-friendly approach to assurance and deployment decisions.

Assuring AI Before Deployment: Red Teaming, Testing and Evidence

AI systems need testing that reflects their risks, but red teaming complements conventional penetration testing, secure development, privacy review and operational testing. Decision-makers should understand scope, methods and limitations of the evidence.

The Executive AI Resilience Scorecard: From Risk to a Defensible Decision

The final session brings together AI governance, security, supplier assurance and PQC readiness. The Five Pillars and Traffic Light Matrix are QSECDEF organising frameworks, not external standards, formal certifications or automatic legal protection.

Learning outcome

By the end of this session you will be able to explain AI red teaming's role in wider assurance, identify the evidence decision-makers should review before deployment, and use the Five Pillars and Traffic Light Matrix to communicate risk-based deployment decisions.

Who should attend?

CISOs, CIOs and CTOs, AI governance leaders, technology-risk professionals, programme managers, board advisers and anyone who signs off AI deployments.

Who can attend?

Anyone may attend the free weekly sessions. No prior experience is required, and no background in cryptography, quantum physics or AI engineering is needed.