Foundations of AI-Based Application Exploitability
Every AI-enabled application has weaknesses. What matters is which ones an adversary can actually exploit, and whether your organization could prove it has them under control. Using Aria, a fictional bank's AI agent, learn to map the attack surface, trace AI attack chains from reach to impact, test exploitability, and build the governance, controls, and evidence that boards and regulators expect.
(Earn 2.5 CPEs)
Add course to library
ENROLL NOW
Course Topics
Orientation
Why AI-enabled apps are a new attack surface. Meet Aria, the bank AI agent used throughout, and learn the four checkpoints: reach, trigger, impact, and evidence.
Vulnerability, Exploitability & Risk
Separate vulnerability, exploitability, and risk. Learn the five exploitability factors and where CVSS, EPSS, KEV, and SSVC fall short for AI.
Attack Surface
Follow one request through a modern app to map where attackers can reach it: APIs, cloud, supply chain, and the AI layer.
How AI Changes Exploitability
Why AI is steerable: one channel for instructions and data, probabilistic behavior, and agency. Learn the lethal trifecta test and how to govern it.
Attack Chains
Walk four complete attack chains against Aria, see where each breaks at a deterministic control, and learn which notification clocks start when one succeeds.
Assessing & Testing
Find attack chains before attackers do. Rate AI findings, combine testing methods, measure end-to-end success rates, and know when to retest.
Governance & Assurance
Close the AI ownership gap. Apply three lines of defense, set risk appetite for probabilistic systems, and report to the board in a way that shows control.
Controls & Capstone
Apply five control principles and a minimum control set for your role, then work a capstone incident from first alert to regulator.
Perry Menezes
It's not whether it's vulnerable, it's whether it's exploitable and whether you could prove control."
Meet the Instructor
Perry Menezes
Perry Menezes is a cyber and AI technology risk and advisory executive with more than fifteen years in cyber and AI risk in financial services, most of it in second line oversight. He was a Partner at KPMG, where he led the cyber advisory practice for banking, and before that served as North American Regional Head of Technology and Cyber Risk at Deutsche Bank.
Enroll Now
Earn your APIsec University Certificate
Earn an APIsec University certificate and badge for completing any of our courses.
Post your badge on LinkedIn and share your accomplishments. You can even receive CPE credits for taking these courses.
