Applied AI Security
and Assurance
A curriculum for people who will be responsible for AI systems when they fail, not just when they demo.
What this is
This is a complete doctoral-level curriculum in applied AI security and assurance, authored by Cameron Hopkin. It is published here as a body of knowledge and a reference, not as a program you can enroll in. Waypoint Compliance Advisory does not grant degrees. The structure, sequencing, and credit scope are included because they are the shape of the argument: they show what a serious treatment of this field actually requires.
It is built with AI security and assurance as the spine rather than a bolt-on. Standard machine learning content is present but demoted to foundation. The intent is to describe what it takes to produce someone who can secure, red-team, evaluate, govern, and assure AI systems at a research level, and defend original applied work in that area.
Who it is written for
Mid-to-senior practitioners: security engineers, machine learning engineers, governance and assurance leads, and technical managers who already ship or govern systems and want to do defensible work on making them trustworthy. It assumes prior programming and a security or machine learning foundation. Because the orientation is applied, a live problem from your own work is an asset rather than a distraction.
What a graduate of this curriculum can do
Someone who works through this material end to end can:
- Model the threat surface of an AI system end to end and design controls for it.
- Build and run adversarial evaluations and red-team programs as security controls, not afterthoughts.
- Engineer AI pipelines with provenance, integrity, and supply-chain guarantees.
- Construct and defend an assurance case that a given system is safe and secure enough for its use.
- Situate technical work inside real governance and risk frameworks, including the NIST AI Risk Management Framework and relevant DoD and federal guidance.
- Produce original, publishable applied research others can adopt.
The verified gap this addresses
The case for building this is not a hunch. It is what the landscape looks like when you check it.
AI security exists in higher education, but as a bolt-on rather than a spine. Independent analysis of accredited cybersecurity doctorates treats AI and machine learning security as one of several specialized seminars that vary by program and faculty expertise, alongside forensics and cryptography [1]. It is a topic inside a degree, not the degree.
Where AI security is taught in depth, it stops at the master's level, and even there it is explicitly shallow on research skills. Nova Southeastern's M.S. in Artificial Intelligence Cybersecurity carries NSA validation [2], and comparable concentrations exist elsewhere. But a 2026 review of these programs states plainly that the AI coursework provides practical literacy, enough to evaluate vendor tools and understand adversarial risk, without the depth required for model development or red-team AI research roles [3]. That missing depth is exactly what doctoral-level work is for.
The demand signal is real. Reviews of the field describe rising 2026 demand from mid-career professionals for exactly these research-adjacent roles: adversarial machine learning researcher, AI red team analyst, and machine learning security architect [1][3].
The security spine
Everything before Core 4 exists to make Cores 4 through 7 possible. Someone who works through this curriculum is not primarily a model builder. They are the person an organization puts in the room when an AI system has to be trusted with something that matters.
The seven cores
The hands-on companion
Before the curriculum there is a free, self-directed lab. The AI Security Lab is a 36-week open-source path covering foundations, offensive LLM work, classical adversarial machine learning, and building out a home lab. It is MIT licensed and takes pull requests.
The lab is where you get reps. This curriculum is the same subject matter at research level, where the deliverable stops being a completed exercise and becomes a threat model that survives review, an evaluation methodology others can adopt, and an assurance case you can defend.
Scope and structure
The credit scope is included because it shows what a serious treatment of this field requires. Cores 4 through 7 are the security spine.
| Code | Course | Credits |
|---|---|---|
| Core 1 | Mathematical and Statistical Foundations for AI | 4 |
| Core 2 | Modern Deep Learning and Representation | 4 |
| Core 3 | Language Models, Retrieval, and Agents | 4 |
| Core 4 | Adversarial Machine Learning and Model Robustness | 4 |
| Core 5 | LLM and Agent Security: Red Teaming and Evaluation | 4 |
| Core 6 | Secure AI Engineering: MLOps, LLMOps, and Supply Chain | 4 |
| Core 7 | AI Governance, Assurance, and Risk | 4 |
| Praxis 1 | Research Methods and Praxis Proposal | 4 |
| Praxis 2 | Praxis Research and Defense | 24 |
| Total | 52 | |
Sequencing. Cores 1 to 3 form a foundation block taken first, in order. Cores 4 to 7 are the security spine. Cores 4 and 5 are sequential, because robustness comes before agent red teaming, while 6 and 7 can run in parallel for someone who already has the foundation. The praxis proposal runs alongside the later cores so it grows out of the work rather than starting cold. The praxis research follows.
Praxis sequence
Praxis 1: Research Methods and Praxis Proposal
Research methods for an applied engineering doctorate, aimed at turning a live problem into a defensible research contribution. Covers research methods and design, problem formulation and literature positioning, framing an original contribution, and proposal development and defense. The output is a defended praxis proposal, ideally grown from a signature lab in Core 4, 5, 6, or 7.
Praxis 2: Praxis Research and Defense
Original applied research producing a defensible, adoptable contribution. The expected shape is a security or assurance method, tool, or evaluation methodology that others in the field can use, with the rigor to defend it. The output is a completed praxis and successful defense.
References
- [1] Cybersecurity Guide. "PhD in Cybersecurity: Programs, Requirements, and Career Outcomes."
https://cybersecurityguide.org/programs/phd-in-cybersecurity/ - [2] Nova Southeastern University, College of Computing, AI, and Cybersecurity. "Doctoral Degrees."
https://computing.nova.edu/degrees/doctoral/index.html - [3] Cybersecurity Guide. "AI Cybersecurity Master's Degree Programs: 2026 Guide and Comparison."
https://cybersecurityguide.org/programs/ai-cybersecurity-masters-degree/ - [4] Second Talent. "PyTorch vs TensorFlow: Usage, Popularity and Performance in 2026."
https://www.secondtalent.com/resources/pytorch-vs-tensorflow-usage-popularity-and-performance/ - [5] LazyProgrammer. "PyTorch vs. TensorFlow: Full Overview 2025 Guide."
https://lazyprogrammer.me/pytorch-vs-tensorflow/ - [6] Palo Alto Networks. "Securing AI's Front Lines" (MITRE ATLAS, NIST AI RMF Govern, Map, Measure, Manage).
https://www.paloaltonetworks.com/resources/whitepapers/securing-ai-s-front-lines - [7] OWASP GenAI Security Project. "OWASP Top 10 for LLM Applications 2025."
https://owasp.org/www-project-top-10-for-large-language-model-applications/ - [8] Articsledge. "OWASP Top 10 for LLM Applications (Complete Guide)" (publication date, v2.0).
https://www.articsledge.com/post/owasp-top-10-for-llm-applications - [9] Vectra AI. "What Is GenAI Security? Risks, Threats and Best Practices" (OWASP Agentic 2026, ISO/IEC 42001, EU AI Act).
https://www.vectra.ai/topics/genai-security
Sources current as of August 2026. Framework references (OWASP, MITRE ATLAS, NIST AI RMF, ISO/IEC 42001, EU AI Act) should be read against their latest published editions.