Hacky Certified LLM Security Specialist
HCLS · Level 2Introduction
Secure chatbots, copilots and LLM apps. Three levels, each self-paced, each with its own exam and certificate.
Buy now- Author: Gaurav Sharma
- Level: Level 2 · Practitioner
- Study time: 40 hours
- Certification: Hacky Certified LLM Security Specialist
Curriculum
6 modules · 20 hours of guided learning · self-paced, with hands-on labs
Job-oriented, scenario-led progression in hacky certified llm security specialist. Exercises are conducted only in authorized training environments. The level builds on previous levels while adding distinct techniques, deeper evidence requirements and more complex capstones.
Prerequisites: Basic IT literacy and willingness to use Linux/Windows command lines.
Tool stack: Ollama, Promptfoo, Garak, PyRIT, LangChain, LlamaIndex, Guardrails AI, Docker, OWASP testing guides
5h guided instruction + 11h guided/independent practical labs + 4h reading, review and assessment. These are total learning hours, not 20 hours of live lectures.
Module 01LLM architecture, tokens and application boundaries4 h
Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.
Practical. Complete a guided lab with baseline and expected evidence.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 02OWASP GenAI LLM Top 10 20264 h
Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.
Practical. Complete a guided lab with baseline and expected evidence.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 03LLM application threat modeling3 h
Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.
Practical. Complete a guided lab with baseline and expected evidence.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 04Prompt injection and instruction hierarchy3 h
Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.
Practical. Complete a guided lab with baseline and expected evidence.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 05Sensitive information disclosure testing3 h
Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.
Practical. Complete a guided lab with baseline and expected evidence.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 06Output handling and downstream application risks3 h
Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.
Practical. Complete a guided lab with baseline and expected evidence.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Guided scenario: demonstrate correct methodology, collect evidence and submit a short structured report.
20% knowledge checks, 60% hands-on practical, 20% evidence-based reporting Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints.
Final exam
A 2-hour online exam with a 70% pass mark. Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints. Attempts are free until you pass. The exam opens 7 days after purchase.
Curriculum
9 modules · 40 hours of guided learning · self-paced, with hands-on labs
Job-oriented, scenario-led progression in hacky certified llm security specialist. Exercises are conducted only in authorized training environments. The level builds on previous levels while adding distinct techniques, deeper evidence requirements and more complex capstones.
Prerequisites: Completion of Level 1 or demonstrably equivalent practical skills.
Tool stack: Ollama, Promptfoo, Garak, PyRIT, LangChain, LlamaIndex, Guardrails AI, Docker, OWASP testing guides
10h guided instruction + 22h guided/independent practical labs + 8h reading, review and assessment. These are total learning hours, not 40 hours of live lectures.
Module 01Prompt injection and instruction hierarchy5 h
Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.
Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 02Sensitive information disclosure testing5 h
Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.
Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 03Output handling and downstream application risks5 h
Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.
Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 04RAG ingestion and retrieval trust boundaries5 h
Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.
Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 05Vector stores and document poisoning4 h
Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.
Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 06Agentic workflows and tool-call authorization4 h
Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.
Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 07Excessive agency and human approvals4 h
Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.
Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 08LLM supply chain and model provenance4 h
Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.
Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 09System prompt and secret protection4 h
Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.
Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Multi-system case: independently correlate artifacts, prioritize findings and propose tested remediation.
20% knowledge checks, 60% hands-on practical, 20% evidence-based reporting Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints.
Final exam
A 24-hour practical exam in a hosted lab, then 24 hours to submit your report. Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints. Attempts are free until you pass. The exam opens 7 days after purchase.
Curriculum
9 modules · 60 hours of guided learning · self-paced, with hands-on labs
Job-oriented, scenario-led progression in hacky certified llm security specialist. Exercises are conducted only in authorized training environments. The level builds on previous levels while adding distinct techniques, deeper evidence requirements and more complex capstones.
Prerequisites: Completion of Level 2 or equivalent professional experience; comfortable with independent investigations.
Tool stack: Ollama, Promptfoo, Garak, PyRIT, LangChain, LlamaIndex, Guardrails AI, Docker, OWASP testing guides
15h guided instruction + 33h guided/independent practical labs + 12h reading, review and assessment. These are total learning hours, not 60 hours of live lectures.
Module 01Vector stores and document poisoning7 h
Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.
Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 02Agentic workflows and tool-call authorization7 h
Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.
Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 03Excessive agency and human approvals7 h
Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.
Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 04LLM supply chain and model provenance7 h
Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.
Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 05System prompt and secret protection7 h
Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.
Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 06Automated adversarial evaluation7 h
Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.
Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 07Guardrails, filters and layered mitigations6 h
Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.
Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 08Logging, monitoring and regression testing6 h
Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.
Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 09LLM red-team capstone6 h
Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.
Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Professional engagement: plan, execute and defend a complex scenario with peer review and executive/technical reporting. HACKY SECURITY | CERTIFICATION CURRICULUM | 2026 3
20% knowledge checks, 60% hands-on practical, 20% evidence-based reporting Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints.
Final exam
A 48-hour scenario exam, assessed on your written report. Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints. Attempts are free until you pass. The exam opens 7 days after purchase.
What you receive
Course author
Gaurav Sharma
Founder & CISO, Hacky SecurityOffensive and Defensive Security Expert
Gaurav founded Hacky Security and leads its SOC, curriculum and AI security work. He has trained more than 40,000 professionals and has taught AI security at IIT Madras.