Security

ISC2 has been pushing a set of short, self-paced AI courses, and in May 2026 I bought six of them for $512. They are certificates of completion, not certifications – no proctored exam, no capstone, just watch the modules and answer the questions. The content is introductory across the board, the kind of survey you could assemble yourself from a weekend of reading. What you are paying for is the ISC2 name on a transcript and a structured reason to actually sit down and think about where AI is taking the field. As a signal that a security professional is paying attention, that is worth something. As technical education, it is thin. I reviewed each course on its own; this is the overview and the buying guide.

AI Security: Managing Overconfidence is one of six short AI courses I bought from ISC2 in May 2026, and it should have been the standout. The topic – automation bias and over-trust in AI output – is the one practitioners actually fall into, and the underlying principle is sound. What dragged it down to three stars was the opening case study: an Activision cybersecurity incident the course implies was caused by AI. The actual incident, in December 2022, was an SMS phishing attack against an HR employee – not an AI failure – which is what I remembered from the public coverage and what the public record still says. The course never explains whether its version is a fictionalized rendering or rests on details not in the public record, and a good portion of the rest of the material builds on that same case.

AI for Cybersecurity is one of six short AI courses I bought from ISC2 in May 2026, and at $96 it is the bundle’s best treatment of the threat model. The first third walks the AI development lifecycle in detail, with analogies to traditional software engineering methodologies – because fundamentally an AI project is still a software engineering project, with the same methodologies applied differently. The second half is the attacks-and-mitigations section, and it is the single most useful piece of content across the entire bundle: many attacks I had not seen before, others I had picked up only in pieces from following the field and now had explained properly, with pointers to live external resources that get updated as new attack surfaces emerge. Like the rest of the bundle, it predates the agentic wave and shows it. Even so, this is the one to take if you want a working threat model for AI systems.

Aligning with Global AI Regulations is one of six short AI courses I bought from ISC2 in May 2026, and at $64 it is the bundle’s wide-angle regulatory survey. Where The Evolving Cybersecurity Workforce touches the legal landscape lightly, this one walks across it: a stack of ISO standards (the 27000 information-security series including 27701 on privacy, 20000 on IT service management, and 42001 on AI management, alongside others in the ISO/AI family), NIST’s Cybersecurity Framework and AI Risk Management Framework, FedRAMP, the ENISA directives for AI cybersecurity, and the EU AI Act. Covering that many documents in a short course means none get treated exhaustively – which is the right trade for a survey, and the course is upfront about it.

Planning for Secure by Design AI is one of six short AI courses I bought from ISC2 in May 2026, and at $64 it is the bundle’s pass through the AI development lifecycle from the security side. It starts with traditional cybersecurity controls applied to AI use, moves through the legal and regulatory environment, spends real time on the data risks and dataset-protection problems that make AI a different shape of security target than a traditional system, and closes briefly on ethics and on AI applied to traditional cybersecurity work. Nothing in it is particularly surprising, and nothing in it is outright wrong.

Foundations of AI is one of six short AI courses I bought from ISC2 in May 2026, and at $128 it is the most expensive of the bundle. It is also the most dated – and that is not the criticism it sounds like. This is a history course. It walks the lineage of AI and its core branches, most of which have been around far longer than the current hype suggests: expert systems, fuzzy logic, computer vision, robotics, machine learning, natural language processing. As a backgrounder on each of those, it is genuinely good. As a survey of where the excitement is right now, it is a step behind.

The Evolving Cybersecurity Workforce is one of six short AI courses I bought from ISC2 in May 2026, and despite the title it is mostly about AI risk and governance, not careers. Running underneath it is a steady note of reassurance that AI is not going to take your security job. The content is non-technical: how to set AI policy, what the risks of AI tools are, how a company should respond, and which privacy regulations bear on AI use. None of it was new to me – I have worked with both AI and privacy regulation in a compliance role – but as a survey of the legal and governance terrain, it holds up.

A few weeks ago I wrote that defense in depth for AI agents means layers, not walls: screen untrusted content before the model acts on it, sanitize what comes back out, and never trust the data flowing through. Clean theory. Then I went back and read the code in Herald that was supposed to implement those layers.

Several of them didn’t hold.

Herald is my feed reader. It pulls RSS and Atom from across the internet, runs each article through a local security model before anything else touches it, scores the survivors for relevance, and announces the interesting ones. Every feed item is untrusted content aimed at a model. That’s the whole premise of the defense-in-depth piece, and it’s exactly the threat I built Herald to study. What follows is the v0.2.0 hardening pass – the bugs the theory missed, and a couple of ideas that worked.

On March 24, 2026, the LiteLLM PyPI package was compromised. Versions 1.82.7 and 1.82.8, published by an account labeled TeamPCP, contained malicious code. I had LiteLLM running in my homelab as a routing layer between local AI clients and several model backends. This post is the postmortem: what I was running, what the exposure actually was, why I removed LiteLLM rather than just upgrading, and what the incident clarified about supply chain risk in homelab AI infrastructure.

The security conversation around AI agents has mostly focused on two things: keeping agents from hurting the host system, and keeping malicious tools out of the supply chain. These are real problems. Cisco documented how OpenClaw leaks credentials and executes arbitrary shell commands. Projects like NanoClaw respond by running agents in containers where bash commands can’t reach the host. Zencoder’s MCP survival guide catalogs supply chain attacks against MCP servers and recommends pinning git tags and auditing source.