What level is the AI for Cybersecurity program?

Intermediate. Total program length is 12 Weeks (160+ Hours of combined live instruction and lab time).

What prerequisites do I need?

Python proficiency; Basic networking knowledge; Familiarity with ML concepts

Does this course include hands-on lab work?

Yes. This program includes hands-on lab time in 3 cloud lab environments provisioned by AI Labs. Every student gets a personal cloud workspace plus on-prem workstation access at our Houston Training Center.

Is this delivered online or in person?

Both. The default delivery is Online lectures + Cyber Range lab + Red/blue team exercises. In-person sessions are available at our Houston Training Center for any student who prefers on-site delivery.

What roles does this program prepare me for?

AI Security Engineer, Threat Intelligence Analyst, Security Data Scientist, ML Security Researcher.

Do I receive a certificate at the end?

Yes. Every program ends with a capstone project and a verifiable AI Labs completion certificate. Certificates are issued via our LMS and include the capstone work as a portfolio link.

How much does the program cost and are payment plans available?

Program tuition is $2,500. Most students use our 2-installment plan (50% at enrollment, 50% midway through). Enterprise + nonprofit pricing is available — contact us for a quote.

AI for Cybersecurity

Name: AI for Cybersecurity
Price: 2500 USD
Availability: InStock

MOD 01

Week 1 — Security Fundamentals

Networking, attack vectors, security telemetry, and the Cyber Range setup you will use all course

11h 20m ▾

📘

Networking & TCP/IP Refresher for Security Engineers Topic

OSI model layers, the TCP/IP stack, sockets, protocols students will see in PCAPs all course

1 hr

📘

Attack Vectors — How Adversaries Get In Topic

Phishing, MITM, SQL injection, brute force, credential stuffing, supply-chain attacks

45 min

📘

Network Scanning with Nmap Topic

Host discovery, SYN/connect scanning, service enumeration, NSE scripts, OS fingerprinting

50 min

📘

Security Telemetry Sources & Log Formats Topic

syslog, NetFlow, PCAP, endpoint telemetry; CEF / LEEF / structured JSON conventions

45 min

📖

NIST SP 800-53 Quick Reference for AI Engineers Reading

Self-paced reading on the control families you will reference across the course

30 min

💻

Coding Exercise — Parse PCAP Files with Scapy Exercise

Filter packets by protocol, extract conversation flows, plot top-talkers from a sample capture

1h 30m

💬

Discussion — What Is Your Threat Model? Forum

Share a brief writeup describing the threats most relevant to your current or target role

30 min

🔬

Lab 1 — Stand Up Your Cyber Range Lab 🧪 Cyber Range Lab · Intermediate

6-step lab: provision attacker, target, and monitoring VMs; configure private subnet; run Nmap SYN scan; capture traffic; parse XML output

2h 30m

🔬

Lab 2 — Vulnerability Assessment + Structured Findings Report Lab 🧪 Cyber Range Lab · Intermediate

Run OpenVAS scan against Metasploitable, parse XML, enrich with CVSS v3.1 scores, generate executive Markdown report

2h 30m

📋

Week 1 Knowledge Check Quiz

25-question quiz covering protocols, scanning concepts, and telemetry sources

30 min

MOD 02

Week 2 — Threat Intelligence

MITRE ATT&CK, kill chains, IoCs, and the parsing pipelines that feed downstream ML models

12 hrs ▾

📘

MITRE ATT&CK — Tactics, Techniques, and Procedures Topic

Tactic columns, technique IDs, sub-techniques, the matrices for Enterprise / Mobile / ICS

1 hr

📘

Lockheed Martin Cyber Kill Chain Topic

Seven phases from recon to actions on objectives, how to map kill chains to your detection coverage

45 min

📘

Indicators of Compromise — Atomic, Computed, Behavioral Topic

File hashes, IP/domain reputation, URL patterns, behavioral IoCs and their relative half-lives

45 min

📘

STIX 2.1 and TAXII — How Intel Travels Topic

Object types, relationship objects, TAXII servers and discovery — the wire format of threat intel

45 min

📖

Reading — A Year of APT Reports Reading

Skim three recent APT writeups; map each campaign to ATT&CK techniques

45 min

💻

Exercise — Write Grok Patterns for Three Log Formats Exercise

Build Grok patterns for syslog auth.log, Apache combined, and Cisco firewall logs; validate against samples

1h 30m

💬

Discussion — Which IoCs Decay Fastest? Forum

Rank atomic vs computed vs behavioral IoCs by useful lifetime; defend your ordering

30 min

🔬

Lab 1 — Multi-Source Log Parser with Event Correlation Lab 🧪 Cyber Range Lab · Intermediate

Collect auth + Apache + firewall logs into a unified JSON schema; correlate failed SSH with subsequent firewall denies to find brute-force runs

3 hrs

🔬

Lab 2 — Map a Simulated Attack to MITRE ATT&CK Lab 🧪 Cyber Range Lab · Intermediate

Execute multi-stage attack scenario, collect logs + PCAPs, map each phase to ATT&CK IDs, extract IoCs as STIX 2.1 objects

2h 30m

📋

Week 2 Knowledge Check Quiz

25 questions on ATT&CK, kill chain, IoC types, and STIX

30 min

MOD 03

Week 3 — Anomaly Detection for IDS

Statistical and ML-based intrusion detection on real network-flow datasets

11h 50m ▾

📘

Statistical Anomaly Detection — Z-score, IQR, EWMA Topic

When each method fits, threshold selection, and why most production IDS still ships z-scores

50 min

📘

ML-Based IDS Architecture Topic

Feature pipeline → model → scoring → alerting loop; offline training vs streaming inference tradeoffs

50 min

📘

Feature Engineering from Network Flows Topic

Flow duration, byte/packet ratios, TCP flag counts, inter-arrival timings, port entropy

55 min

📘

Evaluation Metrics for IDS — Why Accuracy Lies Topic

Detection rate, false positive rate, precision/recall, F-beta, and the cost of a 0.5% FPR at scale

45 min

📖

Reading — CIC-IDS Dataset Documentation Reading

Read the dataset companion paper end-to-end; note attack categories and label distribution

30 min

💻

Exercise — Implement SMOTE for Class Imbalance Exercise

Hand-code a SMOTE oversampler from scratch, then compare against imbalanced-learn

1h 30m

💬

Discussion — Supervised vs Unsupervised IDS in Production Forum

Which approach would you trust for a production deployment, and why?

30 min

🔬

Lab 1 — ML-Based IDS on CIC-IDS Dataset Lab 🧪 Jupyter Notebook Lab · Intermediate

Load CIC-IDS2017, clean + engineer features, apply SMOTE, train RF + XGBoost, compare detection rate vs FPR; confusion matrix per attack family

3 hrs

🔬

Lab 2 — Unsupervised Anomaly Detection for Zero-Days Lab 🧪 GPU Training Lab · Advanced

Train autoencoder + Isolation Forest on benign-only traffic; tune anomaly thresholds for target FPR; KS-test concept-drift detector

2h 30m

📋

Week 3 Knowledge Check Quiz

25 questions on anomaly detection methods, metrics, and feature engineering

30 min

MOD 04

Week 4 — Traffic Analysis & UEBA

Deep packet inspection, user behavior profiling, and lateral movement detection

11h 45m ▾

📘

DPI vs Flow Analysis — When to Reach for Each Topic

Encrypted traffic, performance budgets, what gets lost at each layer

45 min

📘

User Behavior Profiling Fundamentals Topic

Login patterns, resource access frequency, peer-group baselines, weekend vs weekday signals

50 min

📘

UEBA Risk Scoring — Combining Signals Topic

Multiplicative vs additive scores, decay functions, suppression rules, alert-fatigue tradeoffs

50 min

📘

Lateral Movement Detection — East-West Anomalies Topic

Service-account abuse, pass-the-hash, golden ticket attacks and the network signatures they leave

50 min

📖

Reading — Real-World UEBA Failure Case Studies Reading

Two writeups on UEBA programs that drowned in false positives — what we learn

30 min

💻

Exercise — Session Reconstruction from Flow Logs Exercise

Group raw flow records into application sessions using timing + IP/port heuristics

1h 30m

💬

Discussion — Insider Threat: Detection vs Privacy Forum

Where do you draw the line between behavioral monitoring and workplace surveillance?

30 min

🔬

Lab 1 — DNN Traffic Classifier on PCAPs Lab 🧪 GPU Training Lab · Advanced

Extract flow features with CICFlowMeter, normalize + select features, train 3-layer DNN with early stopping; ROC-AUC + detection latency

3 hrs

🔬

Lab 2 — UEBA Insider-Threat Detector with Isolation Forest Lab 🧪 Jupyter Notebook Lab · Intermediate

Build per-user behavioral profiles, train Isolation Forest, implement risk scoring with privilege weighting, validate with insider-threat sim

2h 30m

📋

Week 4 Knowledge Check Quiz

25 questions on DPI, UEBA, risk scoring, and lateral movement

30 min

MOD 05

Week 5 — Static Malware Analysis

PE file internals, YARA, feature extraction, and the ML classifier you will train on real samples

12 hrs ▾

📘

The PE File Format Up Close Topic

DOS header, PE header, section table, import/export tables, anchor offsets attackers tamper with

1 hr

📘

Feature Extraction — Byte n-grams, API Calls, Strings Topic

Choosing features that survive obfuscation, vocabulary explosion management

50 min

📘

Packing Detection via Entropy Analysis Topic

UPX, Themida, custom packers; section-level entropy thresholds and shortcomings

45 min

📘

Writing Production-Grade YARA Rules Topic

Pattern syntax, conditions, modules, performance considerations, false-positive triage workflow

55 min

📖

Reading — Sandbox Evasion Techniques in Modern Malware Reading

Timing checks, environment detection, anti-debug tricks samples use to defeat dynamic analysis

30 min

💻

Exercise — Extract PE Header Fields with pefile Exercise

Parse 50 PE samples, extract 20+ header features, output as CSV ready for ML

1h 30m

💬

Discussion — When Does Static Analysis Stop Working? Forum

Identify two real malware families where static features fail and why

30 min

🔬

Lab 1 — Static-Feature Malware Classifier Lab 🧪 Cyber Range Lab · Advanced

Combine PE header features + byte entropy + string n-grams; write 3 YARA rules; train gradient-boosting classifier with full metrics

3 hrs

🔬

Lab 2 — Detonate Samples in a Cuckoo Sandbox Lab 🧪 Cyber Range Lab · Advanced

Stand up Cuckoo with snapshotted Windows VMs, submit 30 samples, extract behavioral n-grams + dynamic features, train XGBoost vs static baseline

2h 30m

📋

Week 5 Knowledge Check Quiz

25 questions on PE format, feature extraction, packing, and YARA

30 min

MOD 06

Week 6 — ML-Based Malware Classification

CNNs on binary-as-image, RNNs on API sequences, and NLP-based phishing detection

12h 20m ▾

📘

Malware Visualization — Binary as Grayscale Image Topic

Why this trick works, image-size choices, family-level visual patterns

45 min

📘

CNN Architectures for Malware Image Classification Topic

Designing a CNN for fixed-size binary images, data augmentation strategies that actually help

55 min

📘

RNNs + Attention on API Call Sequences Topic

Sequence modeling for behavioral data, choosing between LSTMs, GRUs, and transformer-style attention

55 min

📘

Concept Drift in Malware Families Topic

Why your model decays in production, monitoring strategies, retraining cadence

45 min

📖

Reading — Phishing Detection Beyond URL Heuristics Reading

Review of header-based, content-based, and URL-based phishing features

30 min

💻

Exercise — Augment Malware Binary Images Exercise

Implement rotation, flipping, gaussian noise; measure effect on family classification accuracy

1h 30m

💬

Discussion — Multi-Class vs Binary Detection Forum

When is family classification worth the extra labeling cost?

30 min

🔬

Lab 1 — CNN Malware Family Classifier Lab 🧪 GPU Training Lab · Advanced

5-step lab: convert binaries to 256×256 grayscale, stratified split, train 3-block CNN on GPU with augmentation, per-family report + confusion matrix

3 hrs

🔬

Lab 2 — NLP Phishing Email Detector Lab 🧪 Jupyter Notebook Lab · Intermediate

Header features (SPF/DKIM, sender age), URL features (domain length, redirects), TF-IDF body content; logistic baseline vs fine-tuned BERT

3 hrs

📋

Week 6 Knowledge Check Quiz

25 questions on CNNs for malware, RNNs for sequences, concept drift, and phishing features

30 min

MOD 07

Week 7 — Automated Log Analysis

Elastic SIEM, detection-rule authoring, anomaly scoring, and automated alert prioritization

12h 20m ▾

📘

Log Ingestion Pipelines with Filebeat + Logstash Topic

Shippers, transforms, parsers; designing pipelines that survive log-format changes

50 min

📘

Elastic SIEM — Index Patterns and Detection Rules Topic

Time-based indices, detection rule types, rule scheduling, performance tuning

50 min

📘

Anomaly Scoring on Log Streams Topic

Window-based statistics, rule-based vs ML-based scoring, false-positive suppression

50 min

📘

Alert Prioritization & Enrichment Topic

Severity × confidence × asset criticality; GeoIP + threat-feed correlation; asset-tagging strategies

50 min

📖

Reading — Sigma Rules: The Open Detection Language Reading

Sigma rule structure, conversion targets, the maturing rule-sharing ecosystem

30 min

💻

Exercise — Write a Log Anomaly Scoring Library Exercise

Build a Python lib that computes rolling z-scores per event-type and emits alerts past threshold

1h 30m

💬

Discussion — How Many Alerts Per Day Per Analyst? Forum

Share your team's reality vs aspirational alert volume — what tuning got you closer?

30 min

🔬

Lab 1 — Elastic SIEM End-to-End Lab 🧪 Cyber Range Lab · Advanced

Stand up Elastic + Kibana, ship logs via Filebeat, write Logstash Grok filters, author 3 detection rules, integrate Python anomaly scorer, verify on simulated attack

3h 30m

🔬

Lab 2 — Sigma Rules from APT PCAPs Lab 🧪 Jupyter Notebook Lab · Advanced

Take 5 Malware-Traffic-Analysis PCAPs, identify TTPs → MITRE IDs, author Sigma rules in YAML, convert to Elastic DSL, measure detection coverage

2h 30m

📋

Week 7 Knowledge Check Quiz

25 questions on ingestion pipelines, SIEM rules, anomaly scoring, prioritization

30 min

MOD 08

Week 8 — LLMs for Security Operations

Using language models for alert triage, report generation, and SOAR playbook automation

12h 25m ▾

📘

LLMs in the SOC — Where They Actually Help Topic

Triage, summarization, report drafting; what to never trust an LLM with

50 min

📘

Prompt Templates for Alert Triage Topic

System / user prompt design, structured output enforcement, few-shot examples, eval rigor

55 min

📘

LLM-Assisted Code Review for Vulnerability Detection Topic

Where LLMs catch real bugs, what they miss, how to integrate with existing SAST tools

50 min

📘

SOAR Playbook Design — Triggers, Conditions, Actions Topic

Designing playbooks that auto-respond safely, kill-switch patterns, rollback workflows

50 min

📖

Reading — Auto-Isolation: When It Saves You vs Hurts You Reading

Case studies on autonomic response done well and done badly

30 min

💻

Exercise — Evaluate LLM Triage Quality Exercise

Build a triage-eval harness with human-labeled ground truth and compute agreement metrics

1h 30m

💬

Discussion — Trust Boundary for LLM Actions Forum

Which SOAR actions would you let an LLM trigger unsupervised, and which would always need a human?

30 min

🔬

Lab 1 — LLM-Powered Security Analyst Assistant Lab 🧪 Jupyter Notebook Lab · Intermediate

Process 20 raw alerts through an LLM triage pipeline; structured severity + IoC + action extraction; threat-report generator in Markdown

3 hrs

🔬

Lab 2 — SOAR Playbook with Auto-Isolation Lab 🧪 Cyber Range Lab · Advanced

Define playbook schema, write orchestration script, implement firewall-API host isolation + Slack notification; verify response in <60s

3 hrs

📋

Week 8 Knowledge Check Quiz

25 questions on LLM triage, prompts, SOAR design, automated response

30 min

MOD 09

Week 9 — Adversarial Attacks

Evasion, poisoning, model extraction — attacking the ML systems we just built

12h 35m ▾

📘

Threat Model for ML Systems Topic

Attack surfaces across training and inference, adversary capabilities, goals, knowledge levels

50 min

📘

Evasion Attacks — FGSM, PGD, Carlini-Wagner Topic

Gradient-based perturbations, L∞/L2 constraints, why iterative attacks beat single-step

1 hr

📘

Training-Data Poisoning and Backdoors Topic

Clean-label poisoning, backdoor triggers, why poisoning gets harder with model scale

55 min

📘

Model Extraction & Membership Inference Topic

Stealing decision boundaries via query access, reconstructing training-set membership

50 min

📖

Reading — Adversarial Patches in the Physical World Reading

Stop-sign attacks, glasses that fool face recognition — what works outside a lab

30 min

💻

Exercise — Implement FGSM From Scratch Exercise

Hand-code the FGSM attack against a CIFAR-10 model; verify against an established library

1h 30m

💬

Discussion — Threat Model for Your Own System Forum

Describe an adversary that worries you most about a system you actually maintain

30 min

🔬

Lab 1 — Evasion Attacks vs ResNet-50 Lab 🧪 GPU Training Lab · Advanced

FGSM + 20-iteration PGD vs pre-trained ResNet-50; measure attack success rate; test transferability to VGG-16; targeted attack on a stop sign

3 hrs

🔬

Lab 2 — Poisoning + Backdoor + Extraction Chain Lab 🧪 GPU Training Lab · Advanced

Poison Week-5 PE classifier at 1/5/10% rates; design backdoor trigger; verify 95% backdoor success; build a surrogate via model extraction

3 hrs

📋

Week 9 Knowledge Check Quiz

25 questions on evasion, poisoning, extraction, and transferability

30 min

MOD 10

Week 10 — Adversarial Defense

Adversarial training, input preprocessing, certified robustness, and red-team / blue-team

12h 20m ▾

📘

Adversarial Training Methodology Topic

Generating adversarial examples on-the-fly during training, batch composition strategies

55 min

📘

Input Preprocessing Defenses & Their Limits Topic

Gaussian smoothing, JPEG compression, spatial squeezing — and the adaptive attacks that break them

45 min

📘

Certified Robustness via Randomized Smoothing Topic

Smoothing-based certificates, how to read robustness radii, computational cost in practice

55 min

📘

Ensemble Defenses and Diversity Strategies Topic

Majority voting, model diversity metrics, why ensemble defenses sometimes hurt

45 min

📖

Reading — Red Team / Blue Team Programs for ML Systems Reading

How mature teams structure adversarial assessments — rules of engagement, reporting

30 min

💻

Exercise — Build a Defense Evaluation Harness Exercise

Reusable test rig that measures clean accuracy + FGSM/PGD accuracy across defense configurations

1h 30m

💬

Discussion — Defense in Depth for ML Forum

Stack two defenses you would always combine, and explain why they cover each other's gaps

30 min

🔬

Lab 1 — Adversarial Training Robustness Measurement Lab 🧪 GPU Training Lab · Advanced

Retrain ResNet-50 with PGD adversarial training; measure clean vs adversarial accuracy; compare against preprocessing defenses; write tradeoff report

3 hrs

🔬

Lab 2 — Red Team / Blue Team on the Week-3 IDS Lab 🧪 Cyber Range Lab · Advanced

Deploy IDS as live service; red team crafts evasive flows + extraction queries; blue team monitors + tunes thresholds; joint after-action report

3 hrs

📋

Week 10 Knowledge Check Quiz

25 questions on adversarial training, preprocessing, certified robustness, ensembles

30 min

MOD 11

Week 11 — ML Pipeline Security

Supply-chain risk, model signing, secure serving, differential privacy, federated learning

12h 25m ▾

📘

Supply Chain Risks in the ML Pipeline Topic

Compromised dependencies, poisoned pre-trained weights, training-data provenance gaps

50 min

📘

Model Signing & Verification Topic

Cryptographic model integrity, signing workflows from training through deployment

45 min

📘

Secure Model Serving — Auth, Encryption, Input Validation Topic

AuthN/Z patterns, mTLS, rate limiting, payload-size limits, prompt-injection defenses

55 min

📘

Differential Privacy Fundamentals Topic

ε-δ guarantees, sensitivity calibration, DP-SGD, the privacy-accuracy tradeoff

55 min

📖

Reading — Federated Learning in the Wild Reading

Privacy benefits, communication costs, why it has not displaced centralized training

30 min

💻

Exercise — Audit a Requirements.txt for CVE Vulnerabilities Exercise

Wire up pip-audit + safety against a deliberately stale requirements file; produce remediation plan

1h 30m

💬

Discussion — Whose Privacy Budget Is It Anyway? Forum

When should the privacy budget be per-user, per-query, or per-deployment?

30 min

🔬

Lab 1 — Full ML Pipeline Security Audit Lab 🧪 Cyber Range Lab · Advanced

Inventory components + dependencies; CVE scan; test serving endpoint for injection + auth bypass; categorized severity report with remediation

3 hrs

🔬

Lab 2 — Differential Privacy with Opacus Lab 🧪 GPU Training Lab · Advanced

Train baseline → DP-SGD at ε = 1.0 / 5.0 / 10.0 with per-sample gradient clipping; privacy-accuracy curve; membership-inference attack pre vs post

3 hrs

📋

Week 11 Knowledge Check Quiz

25 questions on supply chain, model signing, secure serving, DP, federated learning

30 min

MOD 12

Week 12 — Compliance & Capstone

NIST AI RMF, SOC 2, GDPR, and the end-to-end capstone project

18h 20m ▾

📘

NIST AI Risk Management Framework Topic

Govern, Map, Measure, Manage functions; how to actually run an AI risk assessment

1 hr

📘

SOC 2 + GDPR Considerations for ML Systems Topic

Right to erasure, automated decision-making, audit trails, vendor-management implications

55 min

📘

Designing an End-to-End AI Security System Topic

Integrating detection + response + monitoring; component coupling and failure modes

55 min

📖

Reading — Incident Response Playbook for AI-Related Events Reading

Classification taxonomy, escalation paths, post-incident review template

30 min

💬

Capstone Peer Review Forum

Review two peers' capstone submissions using the provided rubric

1 hr

💬

Showcase — Present Your Capstone Forum

Share your design, results, and the most interesting failure you debugged

45 min

🧭

Career Outcomes Roundup — AI Security Roles Career

AI Security Engineer / Threat Intel Analyst / Security Data Scientist / ML Security Researcher pathways

30 min

🔬

Capstone — Comprehensive AI-Powered Security System Lab 🧪 Cyber Range Lab · Advanced

7-step capstone: design architecture (data sources + ML models + workflows); deploy IDS + UEBA; integrate SOAR auto-isolation; audit trail; multi-stage attack test; compliance assessment vs NIST AI RMF; final project report + presentation

12 hrs

📋

Final Course Assessment Quiz

40 questions covering all 12 weeks of material; 75% passing score

45 min

AI for Cybersecurity

AI for Cybersecurity — June Cohort 2026

AI for Cybersecurity — July Cohort 2026

$2,500

Frequently asked questions about this program

Labs used in this course

Cyber Range Lab

GPU Training Lab

Jupyter Notebook Lab

Related courses

AI for Healthcare & Life Sciences

Deep Learning Mastery: Neural Architectures to Real-World Applications

Machine Learning Engineering: Build, Optimize & Deploy Intelligent Models