Module 01

How AI Models Handle Your Data

The data lifecycle end to end — prompts, retention, and deployment tiers.

What you will cover

• The anatomy of an AI interaction: prompts, system prompts, context windows, retrieval augmentation, tool calls
• Where your data goes: provider logging, retention windows, abuse-prevention review, human evaluation queues, telemetry
• Deployment tiers and what they actually guarantee: consumer apps, enterprise APIs, private endpoints, local and open-weight models
• Training on your data: when it happens, when it contractually cannot, and what “we don’t train on your data” does and doesn’t cover
• Model memorisation and training-data extraction: what research has demonstrated, what it means for fine-tunes

Practice prompt

Map the journey of one real prompt (sanitised) through a consumer app, an enterprise API and a local model — identify every copy made and every party that can read it.

Module 02

Leakage Pathways: Prompts, Shadow AI & RAG

How data actually escapes — direct disclosure, unsanctioned tools, and over-permissioned retrieval.

What you will cover

• Direct disclosure: sensitive data in prompts — client identifiers, credentials in logs, vulnerability details, personal data
• Shadow AI: unsanctioned tools, personal accounts, browser extensions, AI features silently enabled in existing SaaS
• Agent tool-chains: how a single instruction fans out across email, tickets, code repos and browsers
• RAG over-permissioning: assistants that retrieve documents the user could never open directly
• Case reviews: public incidents of source-code and personal-data leakage via AI tools

Practice prompt

Inventory a fictional SOC’s real AI usage from network, expense and browser artefacts — then score each path’s risk. Note where bans would fail and where sanctioned fast paths would help.

Module 03

Adversarial Data Risks: Injection & Exfiltration

When someone else wants your data — indirect prompt injection and exfil channels.

What you will cover

• Direct vs. indirect prompt injection: malicious instructions smuggled in web pages, emails, tickets, documents and code
• Exfiltration mechanics: tool-call abuse, markdown/link tricks, DNS and image-beacon channels, agent-to-agent spread
• Data poisoning and RAG poisoning: corrupting the knowledge an assistant retrieves and acts on
• AI supply chain: models, datasets, plugins and MCP servers as attack surface
• Defensive patterns: untrusted-content handling, least-privilege tools, egress allow-lists, human-in-the-loop gates

Practice prompt

Design a workflow where an AI SOC assistant reads tickets. List three injection/exfil channels an attacker could use, then name one architectural control that breaks each channel.

Module 04

Governance, Law & Client Confidentiality

The accountable layer — UK GDPR, AI Act awareness, ISO mapping, and vendor diligence.

What you will cover

• UK GDPR and the Data Protection Act applied to AI use: lawful basis, minimisation, processor terms, transfers, DPIAs
• EU AI Act awareness: what touches security teams in practice; UK regulatory direction
• ISO/IEC 42001 and ISO/IEC 27001: where AI data controls slot into an existing ISMS; NIST AI RMF as a checklist
• Client confidentiality under CREST member-company obligations when AI assists
• Vendor due diligence: training-use terms, retention, subprocessors, residency, enterprise vs. consumer APIs

Practice prompt

Draft a one-page DPIA skeleton and a five-question vendor scorecard for “LLM assistant for incident report drafting”.

Module 05

Controls, Architecture & Capstone Audit

Building the defensible workflow — classification, redaction, and usable policy.

What you will cover

• Data classification for AI: public / internal / client / evidential mapped to allowed model tiers
• Redaction and pseudonymisation patterns that preserve analytical value
• Technical controls: DLP for AI endpoints, CASB/proxy patterns, egress allow-lists, permission-aware retrieval, private endpoints
• Writing an AI acceptable-use policy people actually follow, with sanctioned fast paths
• Monitoring and audit: logging AI usage without surveilling the workforce

Capstone prompt (self-paced)

Audit a fictional AI-assisted SOC workflow: map every data flow, find planted risks (shadow AI, over-permissioned RAG, injection path, unlawful transfer), and write a prioritised remediation plan with a one-page policy.

Assessment

Knowledge check

Four scenario questions from the SAN-102 item bank. Learning feedback only — not a formal certification exam.