CYBERSECURITY TRAINING ACADEMY
BlueTeamACADEMY
Start 30-day demo

SECURE SDLC · PRACTICAL DEVSECOPS

Secure Software Development with AI/SI/LLMs

Build secure SaaS products with AI assistance throughout the SDLC: threat modelling, API security, application audit trails, deployment hardening, DevSecOps and verified release evidence.

  • OpenAI
  • Claude
  • OWASP SAMM & ASVS
  • DevSecOps
  • Code security reviews
  • On-prem LLMs
Available now10 chapters2.8 h40 lessonsEnglish
Explore the course topics ↓

After this course, learners will…

What learners can do

  • Translate security requirements into threat models, acceptance tests and accountable work across the software lifecycle.
  • Constrain coding agents, inspect generated changes and repair access-control, injection, dependency and secret-handling weaknesses.
  • Build and verify a paid SaaS with secure sign-in, customer isolation, subscriptions and controlled AI features.
  • Test API security, implement useful application logging and audit trails, and verify hardening on the chosen deployment target.

Benefits for your company

  • Engineering teams can connect AI-assisted delivery to explicit security requirements and evidence of verification.
  • Reviewers can challenge unsafe changes and misleading test results before approving a release.
  • Development and operations gain a shared record of component risks, release decisions, rollback limits and ongoing ownership.
  • Teams practise reproducible security repairs and a feature-development capstone before applying the workflow to customer products.

INSIDE THE COURSE

Explore the course, chapter by chapter.

10 chapters · 40 lessons2.8 hExercises take additional time.

Build your skills in sequence, practise with the supplied cases and verify your decisions. Explore the chapters and lesson objectives below.

Explore the outline. Open a section to see the lessons and topics inside.

Chapter 01

Foundations of secure development with AI agents

0.5 h

Learn the threats, design principles, agent-task structure, working boundaries and verification habits before starting the SaaS project.

1.1

Before the project

01

Understand the risks of building software with AI agents

6 slides

Distinguish agent risks from product risks and connect plausible code to the evidence needed to trust it.

Topics you will explore

  • A working feature is the beginning of the review
  • There are two different systems to secure
  • Turn a vague risk into a concrete failure
  • How a convincing demonstration becomes an insecure release
  • Assign decisions before delegating work
  • Use a repeatable development loop

Includes practical AI use, verification and information risks.

Link to this lesson
02

Design security before generating code

6 slides

Describe assets, trust boundaries, access rules and failure behavior before requesting an implementation.

Topics you will explore

  • Start with the service and its data
  • Identity, permission and ownership are separate
  • Draw the places where trust changes
  • Threat modelling turns architecture into priorities
  • Make security requirements observable
  • Design for failure and operation before implementation

Includes practical AI use, verification and information risks.

Link to this lesson
03

Write clear, bounded instructions for coding agents

6 slides

Convert design decisions into a focused context pack, implementation request and independently reviewable change.

Topics you will explore

  • Give the agent a useful context pack
  • Turn “build this” into an implementation contract
  • Include the behavior people commonly forget
  • Plan first, then work in reviewable slices
  • Verify packages, APIs and security claims
  • Carry decisions across sessions without carrying false certainty

Includes practical AI use, verification and information risks.

Link to this lesson
04

Protect the agent, its tools and the development environment

6 slides

Apply enforceable permissions and data boundaries to untrusted content, tools and model connections.

Topics you will explore

  • Repository content can try to steer the agent
  • Permissions must exist outside the prompt
  • Skills and tool servers are software dependencies
  • AI in the product needs its own boundaries
  • Local and on-prem models still need a security design
  • Limit damage and make changes recoverable

Includes practical AI use, verification and information risks.

Link to this lesson
05

Verify security before release and prepare for the project

6 slides

Judge generated changes using independent checks, operational evidence and explicit acceptance criteria.

Topics you will explore

  • Review the boundaries developers commonly miss
  • Test the prohibited behavior independently
  • Use several kinds of evidence and understand their limits
  • The deployment target is part of the product
  • Build logs and audit trails that support real investigation
  • Bring the foundations into the SaaS project

Includes practical AI use, verification and information risks.

Link to this lesson
Chapter 02

Own the SDLC and define security requirements

0.4 h

Start with risk, responsibility and testable promises using OWASP guidance.

2.1

Risk profile and accountable ownership

06

Own security across the software lifecycle

16 slides · 2 practical activities · Knowledge checks

Create a risk profile, assign security decisions and define evidence required at each delivery stage.

Topics you will explore

  • A useful summary can still cross the wrong boundary
  • Turn the feature request into a customer promise
  • Give each security decision an owner
  • Carry the same promise through the lifecycle
  • Classify the data before sending it anywhere
  • Put the access decision before the disclosure
  • Approve a destination, not just a provider name
  • Keep customer commitments under human control
  • Bring evidence to the release decision
  • Plan what happens when the feature fails
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
2.2

Access promises and ASVS traceability

07

Define who can read and change a ticket

7 slides · 2 practical activities · Knowledge checks

Turn a feature request into explicit allowed and denied behaviour before generating code.

Topics you will explore

  • Signing in does not grant access to every company
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
08

Turn ASVS requirements into acceptance tests

7 slides · 2 practical activities · Knowledge checks

Select versioned security requirements and trace each one to an owner, observable outcome and verification.

Topics you will explore

  • A requirement describes behaviour you can prove or disprove
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
Chapter 03

Design before generating code

0.2 h

Threat-model the data flows and prepare a bounded implementation request.

3.1

Threat modelling and architecture decisions

09

Threat-model the feature and review the architecture

7 slides · 2 practical activities · Knowledge checks

Use the prepared data flow to identify abuse paths, choose controls and record a design decision.

Topics you will explore

  • Follow data and authority across each boundary
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
3.2

Bounded generation and review

10

Ask for bounded changes and inspect the diff

7 slides · 2 practical activities · Knowledge checks

Direct an LLM with a narrow task, protected checks and evidence-based acceptance.

Topics you will explore

  • Ask for a small repair you can inspect
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
Chapter 04

Control the coding agent

0.1 h

Protect the development environment from overreach and untrusted steering.

4.1

Runtime permissions

11

Bound the coding agent’s environment

7 slides · 2 practical activities · Knowledge checks

Separate agent instructions from enforced file, credential, command and network restrictions.

Topics you will explore

  • Check what the coding agent can actually access
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
4.2

Repository and issue injection

12

Treat repository instructions as untrusted inputs

7 slides · 2 practical activities · Knowledge checks

Recognize malicious steering in issues, code comments, rules files and tool output.

Topics you will explore

  • Separate a bug report from instructions to the agent
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
Chapter 05

Implement secure application and AI boundaries

0.8 h

Repair access, queries and output, review packages, protect secrets and constrain model tools.

5.1

Identity and session lifecycle

13

Implement identity, membership and revocation

7 slides · 2 practical activities · Knowledge checks

Verify an API token and enforce current workspace membership independently of sign-in, including invitation replay and removal.

Topics you will explore

  • Authentication ends where application authorization begins
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
14

Test browser safety and the complete session lifecycle

7 slides · 2 practical activities · Knowledge checks

Verify output encoding, redirect constraints, CSRF protection, session rotation, expiry and logout, while distinguishing application and identity-provider sessions.

Topics you will explore

  • A browser state change is not a server security decision
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
5.2

Authorization, browser output and private files

15

Repair tenant isolation and object authorization

7 slides · 2 practical activities · Knowledge checks

Implement fail-closed tenant, role and ownership checks while preserving legitimate use.

Topics you will explore

  • Check the stored company and ticket owner before allowing access
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
16

Keep data separate from queries and markup

7 slides · 2 practical activities · Knowledge checks

Repair unsafe query construction and output handling without breaking ordinary input.

Topics you will explore

  • Keep search terms and comments as data
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
17

Keep uploads private from receipt to download

7 slides · 2 practical activities · Knowledge checks

Design and test upload validation, quarantine, byte-bound scan results and authorization on every download.

Topics you will explore

  • An upload is a lifecycle, not a filename check
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
5.3

Dependencies and secrets

18

Review suggested dependencies before installation

7 slides · 2 practical activities · Knowledge checks

Reject unsupported package claims and evaluate the actual dependency change.

Topics you will explore

  • Do not install a package because the model recommends it
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
19

Keep secrets out of prompts, logs and artifacts

7 slides · 2 practical activities · Knowledge checks

Minimize diagnostic data while preserving useful audit context and a response path.

Topics you will explore

  • Decide which diagnostic fields are allowed to leave the application
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
5.4

Model retrieval, tool authority and change evaluation

20

Build safe LLM features and tool boundaries

7 slides · 2 practical activities · Knowledge checks

Enforce retrieval and action authorization outside the model before and after generation.

Topics you will explore

  • Authorize data retrieval and tool actions outside the model
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
21

Evaluate and release model changes with evidence

7 slides · 2 practical activities · Knowledge checks

Compare model candidates against fixed cases, separate deterministic controls from model quality, and document staged rollout and rollback.

Topics you will explore

  • A model update changes behavior, not just a configuration string
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
5.5

Subscriptions and entitlement consistency

22

Build subscriptions as a verified state machine

7 slides · 2 practical activities · Knowledge checks

Implement annual company Checkout, idempotent webhook processing and entitlement reconciliation without trusting redirects or event order.

Topics you will explore

  • The payment provider owns payment facts; your service owns access policy
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
5.6

API security contracts and abuse tests

23

Design and test the API security contract

7 slides · 2 practical activities · Knowledge checks

Implement and verify function, object and property authorization, input/output contracts and resource limits on real application handlers.

Topics you will explore

  • Every endpoint has several independent boundaries
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
5.7

Application logging and audit-trail implementation

24

Build application logging and trustworthy audit trails

7 slides · 2 practical activities · Knowledge checks

Design an application event contract, implement an audited business transaction and test attribution, isolation, secret exclusion and logging failures.

Topics you will explore

  • Design events from the questions your app must answer
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
Chapter 06

Make DevSecOps checks enforceable

0.2 h

Isolate PR work, test real HTTP behaviour and challenge incomplete evidence.

6.1

Safe test data and release contents

25

Create safe test data and keep it out of releases

7 slides · 2 practical activities · Knowledge checks

Generate useful synthetic fixtures, enforce a narrow dataset contract, review provenance and verify release-package contents.

Topics you will explore

  • Representative behavior does not require real customer records
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
6.2

Pipeline trust and required gates

26

Build a DevSecOps pipeline that fails safely

7 slides · 2 practical activities · Knowledge checks

Separate untrusted PR testing from credentialed delivery and enforce required checks.

Topics you will explore

  • The pipeline is a privileged application too
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
6.3

SAST, SCA, DAST and independent verification

27

Compare static, dependency and running-application scans

7 slides · 2 practical activities · Knowledge checks

Reproduce HTTP security failures, repair the authorization boundary and assess scanner coverage honestly.

Topics you will explore

  • A real denied request is stronger evidence than a reassuring report
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
28

Challenge the fix with independent checks

7 slides · 2 practical activities · Knowledge checks

Use negative cases, a controlled regression and a review record to detect false confidence.

Topics you will explore

  • Prove that the checks notice a known defect
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
Chapter 07

Secure the supply chain and runtime

0.3 h

Match component records to bytes and review deployment/IaC policy.

7.1

SBOM and vulnerability decisions

29

Manage components, SBOMs and vulnerability decisions

7 slides · 2 practical activities · Knowledge checks

Match component inventory to bytes, repair an affected component and retain retest evidence.

Topics you will explore

  • An inventory is useful when it points to the artifact you actually ship
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
7.2

Configuration and secret delivery

30

Secure deployment configuration and secret delivery

7 slides · 2 practical activities · Knowledge checks

Review runtime/IaC decisions and turn unsafe defaults into verifiable policy checks.

Topics you will explore

  • Secure code can still ship in an unsafe environment
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
7.3

Hosting choices and deployment security

31

Choose hosting and verify deployment security

7 slides · 2 practical activities · Knowledge checks

Compare managed platforms and self-hosted infrastructure, preserve the application’s security boundaries when porting it, and verify the chosen staging deployment.

Topics you will explore

  • Hosting is part of the authorization and failure model
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
7.4

Agent-assisted Linux, Windows and container hardening

32

Audit and harden Linux, Windows and container targets

7 slides · 2 practical activities · Knowledge checks

Use a scoped agent to review deployment configuration, plan compatible hardening and verify effective controls with recovery evidence.

Topics you will explore

  • Proposed configuration is not effective runtime security
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
Chapter 08

Auditing code for vulnerabilities with LLMs

0.1 h

Scope, map, investigate, reproduce, repair and report using Codex, Claude Code or an approved on-prem assistant.

8.1

Scope, coverage and model workflows

33

Scope and run a code audit with an LLM

7 slides · 2 practical activities · Knowledge checks

Build a bounded audit using Codex, Claude Code or an approved on-prem assistant, with traceable findings and explicit coverage gaps.

Topics you will explore

  • Choose an audit workflow; require the same evidence from every model
  • Prepare your assistant request
  • Run the audit and verification workflow
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
8.2

Finding verification, repair and closure

34

Verify findings, repair vulnerabilities and prove the fix

7 slides · 2 practical activities · Knowledge checks

Separate supported defects from overstated claims, reproduce failures, inspect a minimal patch and close findings against the exact repaired source.

Topics you will explore

  • Turn an AI claim into reproducible evidence and a bounded closure decision
  • Prepare your assistant request
  • Run the audit and verification workflow
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
Chapter 09

Verify, approve and promote a release

0.2 h

Bind evidence to an artifact and practise both blocked and compatible rollback.

9.1

Artifact integrity, provenance and approval

35

Build and verify the exact release artifact

7 slides · 2 practical activities · Knowledge checks

Generate artifact-bound evidence, verify a local signature and detect source or artifact tampering.

Topics you will explore

  • Approval follows immutable bytes, not a branch name
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
36

Release only the artifact you reviewed

7 slides · 2 practical activities · Knowledge checks

Bind approval to an exact artifact and retain rollback, monitoring and CI trust boundaries.

Topics you will explore

  • Approve the exact version that passed review
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
9.2

Deployment and schema-safe recovery

37

Promote safely and rehearse a failed rollback

7 slides · 2 practical activities · Knowledge checks

Bind a release decision to an artifact and test compatibility before selecting rollback or forward recovery.

Topics you will explore

  • A previous image is not a complete recovery plan
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
9.3

Paid launch and operational acceptance

38

Launch a paid SaaS with evidence, recovery and operational ownership

7 slides · 2 practical activities · Knowledge checks

Make a defensible go/no-go decision for the exact release after staging acceptance, restore rehearsal and payment/identity failure checks.

Topics you will explore

  • A release is an operational commitment, not a successful upload
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
Chapter 10

Respond, operate and retire responsibly

0.1 h

Close the loop from a security regression to maintenance, metrics and decommissioning.

10.1

Regression-response capstone

39

Capstone: respond to a security regression

7 slides · 2 practical activities · Knowledge checks

Use AI assistance to investigate a faulty change, contain exposure and verify a safe repair.

Topics you will explore

  • Contain the faulty behavior and verify the repaired version
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson
10.2

Operational ownership and continuous improvement

40

Implement export, retirement and the final project handoff

7 slides · 2 practical activities · Knowledge checks

Create an operational handover, interpret security metrics and close the lifecycle with decommissioning.

Topics you will explore

  • The release starts a maintenance obligation
  • Prepare your assistant request
  • Complete the practical steps
  • Inspect the result and explain the evidence
  • The situation changes

Includes practical AI use, verification and information risks.

Link to this lesson

HOW YOU WILL WORK

From a security requirement to an operated service.

Begin with five foundation topics: AI coding risks, secure design, clear agent tasks, controlled tool access and independent verification. Then follow the fictional SharedDesk application through the practical chapters: lifecycle ownership, requirements, design, implementation, DevSecOps, verification, supply chain, release and operations. Use coding assistants while independently checking their proposals and results.

Connect OWASP guidance to engineering decisions

Turn risks into testable ASVS-based requirements, review a supplied data-flow diagram, record threat and architecture decisions, and carry evidence into implementation and operations.

Make the pipeline reject unsafe changes

Repair real JavaScript and HTTP access failures. Separate PR testing from deployment authority, distinguish SAST, SCA and DAST, verify component bytes and rehearse required CI checks.

Verify the release and its recovery path

Audit with Codex, Claude Code or an approved on-prem model; independently reproduce and close findings, create an SBOM, challenge signed artifact evidence, review exact-digest promotion and test both incompatible and compatible rollback scenarios.

Build useful evidence into the application

Design security events and implement an audited business transaction. Verify API boundaries and assess the effective deployment target, with clear failure and recovery tests.

English course: 40 lessons, 284 narrated slides, interactive diagrams, nine chapter exams and a downloadable SharedDesk AI SaaS project. Includes eleven repair labs, feature-development exercises, private file handling, browser and session security, safe test data, model-change evaluation, application logging and auditing, API security and agent-assisted Linux, Windows and container hardening. Core local exercises need no paid AI. Live hosting, identity, payment and model integrations use your approved accounts; those subscriptions are not included.

AI

Practical AI use, with human judgement.

This course includes role-specific ways to use approved AI assistance, relevant AI threats and failure cases, and checks for evidence, data handling and human approval. Optional prompts use fictional information; an AI account is not required.

AI examples are practical learning activities. They do not add statutory training requirements or replace your organisation’s policies, qualified advice or accountable decisions.