You Don’t Need a Data Science Degree to Get Good at AI Security. You Need These Resources.

A Security Engineer actual reading list for closing the AI security gap — verified resources, no fluff, no affiliate links

Audience: SOC analysts, security engineers, anyone already in the field who keeps seeing “AI security” everywhere and isn’t sure where to start Time investment: This entire list can be worked through in under a week of evenings This is a companion piece to my AI Governance series — this one is about closing the skills gap, not the policy gap

I Kept Seeing the Same Mistake

Every “learn AI security” list I found online had the same problem: it assumed I knew nothing about security. Half the resources were teaching SQL injection to people who have been writing detection rules for years. The other half were data science bootcamps that wanted me to learn TensorFlow before I understood what a prompt injection actually looks like in production.

That is backwards. If you already work in a SOC, you do not need to start from zero. You need to redirect skills you already have toward a target that changed shape.

So here is the list I actually used — verified, current, and organized by what you are trying to do, not by marketing tier.

First, Decide Which Side of the Fence You’re On

There are two genuinely different skill paths here, and conflating them is why most learning plans stall halfway through.

Defending with AI — using machine learning and LLM tools to do your existing job faster. Alert triage, log summarization, automated rule generation. If you read my piece on the CISA KEV pipeline, this is exactly that category.

Defending against AI — understanding how AI systems themselves get attacked. Prompt injection, model poisoning, adversarial inputs, jailbreaks. This is a genuinely new vulnerability class that most security teams have not built muscle for yet.

Pick based on where you sit. If you are Tier 1/2 SOC, start with the first. If you do red team, appsec, or research, the second is where the actual gaps are.

Both tracks need the same starting point: a working AI threat vocabulary

Orientation — One Afternoon, Free

**OWASP GenAI Security Project — LLM Top 10** The OWASP Top 10 for LLM Applications is to AI security what the original OWASP Top 10 was to web security twenty years ago — the thing everyone eventually converges on as the shared vocabulary. It is free, framework-agnostic, and gets you fluent in the actual vulnerability classes (prompt injection, insecure output handling, training data poisoning, model denial of service) in one sitting. This is genuinely the starting point — not because it is comprehensive, but because every other resource on this list assumes you already know these ten terms.

MITRE ATLAS If you already think in ATT&CK — tactics, techniques, real-world case studies — ATLAS is the same structure applied to AI systems. It currently documents over a dozen tactics and dozens of techniques specifically targeting machine learning pipelines, with real case studies of production AI systems being attacked. The matrix format means you can scan it the way you already scan ATT&CK: find the tactic that matches your concern, drill into the technique, read the mitigation. No new mental model required — you are applying a framework you already trust to a target you do not yet fully understand.

Hands-On Practice — Where the Learning Actually Sticks

Reading frameworks gets you vocabulary. Nothing builds intuition like trying to break something.

**Lakera’s Gandalf** This is a free, browser-based prompt injection game and it is, without exaggeration, the fastest way to internalize how fragile LLM guardrails actually are. You are trying to extract a secret password from an AI that has been explicitly instructed not to reveal it. Seven levels, each with progressively harder defenses — keyword filters, semantic guards, secondary LLM checks. By level four or five you stop thinking like a user and start thinking like an attacker: encoding tricks, role-play framing, asking the model to “summarize the previous paragraph” instead of asking directly.

What makes this valuable for working security people specifically: every technique that works on Gandalf is a technique that works on production chatbots, and AI copilots deployed inside real companies right now. If your organization has a GenAI tool that summarizes logs or drafts incident reports, you should be asking whether someone has run anything like this against it.

**GitHub Security Lab — Secure Code Game** A free, open-source, in-editor challenge where you find and fix intentionally vulnerable code. The newest season is built specifically around agentic AI security — the emerging problem of AI agents that take real actions (file system access, API calls, code execution) rather than just generating text. This is squarely in “new vulnerability class” territory. If your organization is experimenting with AI agents or copilots that can actually do things rather than just respond, this is the most directly relevant hands-on resource currently available for free.

Going Deeper — Structured Courses

**SANS Critical AI Security Guidelines** SANS released a free, plain-language framework specifically built for security professionals — not data scientists — covering how AI systems get attacked and how to protect them. It is explicitly aligned with the OWASP AI Exchange (more below), and SANS has since formalized a direct partnership with OWASP to standardize AI security controls jointly. When two of the most trusted names in the field formally align their guidance, that alignment is worth paying attention to — it usually means the terminology and control structure you learn here will still be relevant in two years, not superseded by the next framework fad.

**OWASP AI Exchange** This is the resource I keep coming back to. Over 300 pages, fully free, CC0-licensed (use any part with zero attribution required), and it is not trying to sell you anything — which is rare in this space. It covers threats, controls, and risk analysis across every type of AI system, not just generative AI, and it directly feeds into ISO/IEC standards and the EU AI Act through formal standards partnerships. If you read my earlier piece on the EU AI Act and NIST AI RMF, this is the technical security layer that sits underneath those governance frameworks — where governance tells you what is required, the AI Exchange tells you the actual control to implement.

SANS AI Security Maturity Model A newer release that I think solves a real gap the other resources leave open: NIST, the EU AI Act, ISO 42001, and OWASP each describe what mature AI security looks like, but none of them tell you what to do first. This maturity model is explicitly built as the operational bridge — stage-by-stage, mapped to all four of those frameworks simultaneously. If you are the person at your organization who has to turn “we should probably do something about AI security” into an actual roadmap, this is built for exactly that conversation.

The Threat Intelligence Habit

**AI Incident Database** A structured, searchable collection of real-world AI failures and incidents — not all of them security-specific, and that is precisely what makes it useful. Reading these the way you would read security incident post-mortems builds pattern recognition that no course can substitute for. You start noticing: most AI failures are not exotic zero-days, they are the AI equivalent of misconfigurations — a model trusting input it should have sanitized, a guardrail that only checked for one phrasing of a malicious request, a deployment that nobody load-tested against adversarial volume.

My Actual Order of Operations

If you are starting from genuinely nothing in this space, here is the sequence that worked for me:

1. OWASP LLM Top 10 — one sitting, get the vocabulary
2. Play Gandalf to at least level 5 — feel how fragile guardrails are
3. Read the SANS Critical AI Security Guidelines — orient on controls
4. Skim MITRE ATLAS — find the tactics relevant to your environment
5. Pick ONE deep resource (OWASP AI Exchange or a SANS course) and commit
6. Build one thing — a Sigma rule generated via an LLM, a prompt
   injection test against your own org's chatbot, anything concrete

Step six matters more than people give it credit for. I wrote about exactly this in my CISA KEV pipeline article — and then, separately, in my own risk assessment of that same pipeline, I found prompt injection and validation gaps in something I built myself using the very techniques I am pointing you toward in this list. That second article exists because I went through steps one through five first. The frameworks tell you what to look for. You only find it by building something and then turning the same lens back on your own work.

The Honest Caveat

None of this makes you a machine learning engineer. You will not walk out of this list able to train a model or explain backpropagation, and that is fine — that is not the job most security professionals need.

What this closes is the applied gap: knowing what prompt injection looks like when you see it in a log, knowing why a model’s confidence score dropping a signal worth is investigating, knowing which OWASP category an incident report falls under so you can communicate it precisely instead of vaguely.

That is a smaller gap than the AI hype cycle wants you to believe. You already think like an adversary. You already know what “behaving in a way it shouldn’t” looks like. The vocabulary and the muscle memory for this specific target — that is what these five resources actually give you, and all of them are free or close to it.

Part of an ongoing series connecting AI security, AI governance, and security automation. Earlier pieces cover the EU AI Act, NIST AI RMF, and risk-assessing AI automation pipelines.