Sensible Security: Defending Against Agentic AI & External Threats

6 Interactive Sessions

Short, interactive sessions: watch it work, try it, then build it yourself. You can go deeper at any time in the written chapters.

1. 1

   Choose security that is worth what it costs

   A security control is worth having when it removes more risk than the trouble it adds. The aim is the right controls in the right places, not the most controls.

2. 2

   Find every way in, then close the ones you do not need

   You cannot protect what you cannot see. So first list every way an outsider could reach you, now including your AI systems, and then switch off what you do not need.

3. 3

   Control who can log in and what they can do, people and AI agents alike

   With people and systems everywhere, the real boundary is who can log in and what they can do. That applies to AI agents as much as to people.

4. 4

   AI agents can be tricked into acting: keep them on a short lead

   An AI agent takes actions for you, so a tricked agent can do real harm. The defence is limited tools, a person on big actions, a closed box for its code, treating what it reads as untrusted, and a record of what it does.

5. 5

   AI makes old attacks faster and more convincing

   AI has not invented new kinds of attack. It has made the old ones faster, cheaper and more convincing. The sensible defence is the same basics, run faster.

6. 6

   Plan for the break-in: limit the damage, spot it fast, respond

   You will not stop every attack, especially at AI speed. Prevention lowers the odds; limiting the damage, spotting it fast and responding well decide how bad it gets.

How this certificate is scored

Your certificate shows how many of your written answers met the rubric below, checked by an AI grader. Anyone who checks your certificate sees it.

• You answer 6 short questions, one for each module, in your own words (at least 40 words each).
• An AI grader checks each answer against what its module asks for: it must answer the question, use the course's practice case specifically, and be correct.
• To pass, at least 5 of the 6 answers must meet that bar. The certificate says the answers were graded by AI.

The rubric

1. Module 1, Match the Control to the Risk: A lens: risk removed vs friction added — sensible control vs security theater.
2. Module 2, Know Your Attack Surface (Including AI): An inventory of external + AI exposure, and a plan to shrink it.
3. Module 3, Identity & Access — for Humans and Agents: Least privilege and phishing-resistant MFA — for people and for agents.
4. Module 4, Agentic AI as an Attack Surface: Guardrails that govern agents (scoped tools, human-in-the-loop, monitoring).
5. Module 5, AI-Accelerated & Autonomous Attackers: Defenses for AI-scaled attacks, deepfakes, and the AI supply chain.
6. Module 6, Assume Breach — Sensible Defense & Detection: Proportionate defense-in-depth plus fast, rehearsed detection and response.

What you walk away with