S0–S12 · 80 hours
The 13 security stages
Stage 0 is application security foundations, added because nothing else holds without it. Stages 1–8 are practical product-security capabilities; 9–10 and parts of 11–12 are specialist or post-core work.
- S0Web AppSec Foundations (IDOR/BOLA, SSRF, Auth, STRIDE)In Core·19 study days·R01 R02 R03 R09 R10 R39 R40
- S1AI Attack Surfaces & Threat Modeling6h·8 study days·R04 R05 R39 R41
- S2Advanced Prompt Injection & Jailbreak Resilience6h·7 study days·R04 R05 R28
- S3Agentic Security & MCP Tool Poisoning7h·11 study days·R02 R05 R07 R21 R27
- S4RAG Security, Provenance & Data Poisoning5h·12 study days·R04 R05 R13 R14 R15 R45
- S5PII, Privacy & Cryptographic Guardrails5h·5 study days·R16 R17 R18
- S6Identity, Auth & Delegated Agent Access (OAuth/A2A/HITL)7h·7 study days·R21 R22 R23 R24 R41
- S7Output Validation & Constrained Generation (CFG)3h·7 study days·R07 R30
- S8Automated Red Teaming & Fuzzing (PyRIT / Garak)6h·8 study days·R28 R29
- S9Model Extraction & IP Protection4h·2 study days·R03 R04 R05 R45
- S10Mechanistic Interpretability & Alignment Research8h·6 study days·R31 R34 R42 R45
- S11Compliance, Auditing & Governance (NIST RMF, EU AI Act)4h·12 study days·R27 R31 R32 R38 R42 R44
- S12CVEs, Security Teardowns, Disclosure & Portfolio8h·6 study days·R02 R05 R35 R39 R40
Scope note
Installing a tool is not completing a stage. Every stage is closed by reproducible tests and a written evidence record, not by reading a checklist.