AI Security Engineer Foundations + Certificate — Javier Garza, Snyk
This workshop provides a comprehensive overview of AI security engineering, detailing the shift from traditional software security models to address the unique risks posed by Large Language Models (LLMs) and agentic workflows. Key areas covered include the OWASP Top 10 for LLMs, securing the supply chain of AI components (AI Bomb), and implementing proactive AI-native threat modeling. The session emphasizes that security must be integrated early in the design lifecycle, requiring continuous monitoring, strict guardrails, and human-in-the-loop processes to manage non-deterministic AI behavior.
Key takeaways
-
AI Systems are Non-Deterministic
21:40
Unlike traditional software, AI systems are probabilistic. This necessitates a fundamental shift in threat modeling, moving from reactive scanning to proactive, AI-centric design and continuous iteration.
-
AI Bomb (CBEM) is Essential for Inventory
26:40
An AI Bill of Materials (AI Bomb) is required to create a searchable inventory of all AI assets—including models, datasets, agents, and pipelines—to track vulnerabilities and impact in the event of a supply chain attack.
-
Defense Requires Guardrails and Education
16:40
Technical controls (like sanitizing inputs and using function calls) must be paired with organizational guardrails, developer training, and clear policies to prevent workarounds and misuse.
-
Secure Development Requires Hooks and CI/CD Integration
30:00
Security checks must be integrated into the development pipeline (CI/CD) using hooks and agent rules to automatically scan generated code and prevent vulnerabilities before deployment.