AI security roadmap: zero to red teamer

TL;DR: You can learn AI security without a machine learning degree. Web and API testing skills carry over. What is new is that text a model reads can act like code. This roadmap has five steps, foundations, prompt injection, agents, red teaming and defence. Practise each on free labs and you can be testing real AI systems within a month.

AI security stopped being a research niche this year. Gartner named AI security platforms one of its top strategic technology trends for 2026 and expects more than half of enterprises to run one by 2028, up from under 10% in 2025. Between August 2024 and August 2026 at least twelve AI security startups were bought by larger companies, five of them in six weeks, and Forrester has counted more than $2 billion spent on them in 18 months (SiliconANGLE).

Every one of those buyers, and every company deploying AI agents, now needs people who can test AI systems. Most security teams have not trained any. This is the roadmap we would give someone starting today: what to learn, in what order, where to practise it, and what a first month looks like.

Do you need a machine learning background?

No. Most real AI security work happens at the application and agent layers, where the useful skills are ones security people already have: web and API testing, authentication and authorisation, threat modelling and clear reporting. Our guide to AI red teaming lists them in detail.

Three ideas are new, and the five steps below are built around them:

1. Instructions and data share one channel. A model reads its developer's instructions, the user's message and a retrieved web page as one stream of text, and nothing marks which parts may give orders.
2. Behaviour is probabilistic. The same attack can work four times in ten. Testing means repeating and measuring, not running a payload once.
3. The model is a confused deputy. It acts with its user's permissions on behalf of whoever wrote the text it happens to be reading.

Step 1: How an LLM application is put together

You cannot attack what you cannot picture. Learn the parts nearly every AI application shares: the system prompt (the developer's standing instructions), the context window (everything the model sees on one turn), retrieval (documents pulled into that context, often called RAG), tools (functions the model can ask the app to run), memory (notes saved and fed back later) and output handling (how a reply is displayed, which matters because replies can carry links, images and code).

The fastest way to learn them is to spend a weekend building a small chatbot with one tool and one document store. Every attack later in this guide will make more sense once you have wired the pieces together yourself.

Step 2: Prompt injection

Prompt injection is an attack in which text a model reads overrides the instructions its developer gave it. It has topped every edition of OWASP's Top 10 for LLM Applications, and it comes in two kinds.

Direct injection is the attacker typing into the chat. Indirect injection is the attacker planting instructions in something the model will read later: a web page, an email, a form, a log entry, a file. The victim's own assistant then follows them with the victim's permissions, and the victim never sees the instruction.

Indirect is the one that causes incidents, and it cannot be patched away: a model has no second channel that keeps instructions apart from data, so the UK NCSC warns it may never be totally mitigated. When you are ready for the real cases, our prompt injection in 2026 guide walks through this year's attacks stage by stage.

Step 3: Why agents raise the stakes

A chatbot that falls for an injection says something it shouldn't. An agent that falls for one does something it shouldn't. Simon Willison's lethal trifecta is the quick test: an agent that has private data, reads untrusted content and has a way to send data out can be turned into a data thief by anyone who can put text in front of it. Each connector you add looks harmless alone; together they build the attack.

Two layers most people miss: agent skills, plain-English instruction files that agents load and obey, and agent memory, where a planted instruction can outlive the session and spread.

Step 4: How red teams test it

A red teamer does not ask "can I make it say something rude?" The question is "what is the worst thing someone who controls any text this system reads can make it do?" The method: map every input, decide what failure looks like before writing payloads, plant an instruction in each input, chain it to a tool and an exit, and prove it with a canary (a unique string you plant and watch for) measured over many runs. Report findings against the OWASP lists, and retest after every model upgrade.

Open-source tools cover the repetitive parts: NVIDIA's garak, Microsoft's PyRIT and promptfoo. Our own AgentBreaker and Mirage are built for the same job. Tools find candidates; people find the chains that matter.

Step 5: The defences that hold

If no filter can make injection impossible, defence becomes a design problem. Give each agent only the data and tools its task needs. Put a person in the loop for sending, paying, deleting and installing. Treat anything the model reads as data, never as a grant of new permissions. Close the exits: no arbitrary images or links from model output, allow-listed outbound traffic, every tool call logged. Use filters as one layer, and retest whenever the model, a tool or a data source changes.

Best AI red teaming courses and training platforms

Most of the best practice ground is free, and the paid options now end in real certificates. We make two of the resources below, so weigh our view of those accordingly.

Free practice, where everyone should start

Courses and certifications, once you want proof

How to choose: if you want a credential an employer recognises today, Hack The Box and OffSec carry the most weight in hiring, and both exams are long practical engagements rather than quizzes. If you want the most labs for the least money, FreakLabs and Practical DevSecOps are built around browser labs you can finish in evenings. If your employer pays, SANS is the classroom option. Whatever you pick, do the free row first: the paid courses assume you have already broken a chatbot or two.

Your first month

• Week 1: first injections. Build the small chatbot from step 1, finish Gandalf, and read OWASP's LLM01 entry.
• Week 2: indirect injection. Work through PortSwigger's Web LLM labs, then SentinelGoat's document and image challenges and the two free FreakLabs labs.
• Week 3: agents. Give your chatbot an email tool, plant an instruction in a document it reads, and get it to send something it shouldn't. Then read the 2026 attack chain and spot the stage you just reproduced.
• Week 4: method. Point garak or promptfoo at your bot, try a few Crucible challenges, and write a one-page report with a canary-backed finding and a fix.

Start this week. The first two FreakLabs labs and two course levels are free, with no card and no expiry. Start free at kagex.ai/products/freaklab and work up to the certificate at your own pace.

After that first month, pick one of the certificates above to turn practice into something you can show an employer, and use competitions like Gray Swan Arena to see how your skills compare.

Conclusion

AI security is learnable, and the order matters more than the hours. Understand how an LLM application is built, then learn prompt injection properly, because almost every attack on these systems is a version of it. Learn why agents turn a bad answer into a bad action, how red teams prove it with canaries and success rates, and how design limits the damage when a filter misses. Practise each step on the free labs, pick one certificate when you want proof, and keep retesting, because the models and tools under you will keep changing.

Start this week with the small chatbot from step one. By the end of the month you will have broken it in three different ways, and you will understand AI security better than most of the people deploying it.