IIT Delhi - Certificate Programme in Cybersecurity & AI

Global and India threat landscape: APTs, ransomware, supply chain attacks, UPI fraud, digital arrest scams

MITRE ATT&CK framework deep-dive, cyber kill chain, threat intelligence fundamentals

Threat modeling (STRIDE): assets, trust boundaries, abuse cases, mitigation mapping

Identity attacks and defences: OAuth/OIDC flows, JWT misuse, session fixation, refresh token theft, SSO/SAML basics

Vulnerability management, CVSS 4.0, and security operations fundamentals

Security data engineering: feature extraction from logs, handling extreme class imbalance

Machine learning for threat detection: malware classification, phishing detection, fraud detection

Security-grade evaluation: calibration, thresholding, cost-of-error analysis, failure modes

MLOps starter: experiment tracking, model registry basics, reproducibility discipline

Detection-as-code fundamentals: Sigma rule syntax, detection logic patterns mapped to ATT&CK

Detection testing: unit tests for rules, coverage analysis, and false positive analysis

SIEM architecture with Elastic Stack: focused log ingestion and correlation

Incident cockpit design: severity scoring, alert correlation, response recommendations

SOAR basics: playbook design principles and human-in-the-loop workflows

Optional self-paced: UEBA behavioural baselines; IR/forensics foundations

Agentic AI pipeline foundations: LangChain and LangGraph architecture, tool-calling patterns, MCP basics, agent memory, and decision chaining

Adversarial ML fundamentals: evasion, poisoning, and extraction attacks through MITRE ATLAS

OWASP LLM Top 10 (2025): Prompt Injection, Excessive Agency, Vector and Embedding Weaknesses

LLM security and secure RAG: prompt injection (direct and indirect), jailbreaking, data leakage, retrieval poisoning, and data exfiltration via retrieved documents

AI-specific incident response: model rollback, data poisoning forensics, and model integrity verification

LLM red teaming toolstack: PyRIT for automated red teaming, Garak for OWASP LLM Top 10 vulnerability scanning, and PromptBench for prompt robustness evaluation

Multimodal jailbreaks: Multi-Modal Linkage, perceptual transformation exploits, and Visual Scenario Hypnosis in vision-language models

Tool-calling exploitation: function call injection, tool chain exploitation, and parameter poisoning in agentic AI

MCP prompt injection: server-to-server trust override in Model Context Protocol environments

Memory poisoning: trigger-free single-shot poisoning via benign-looking content in long-context LLM agents

Model hub supply chain attacks: namespace hijacking, safetensors conversion exploitation, and detection tooling

Implement a DevSecOps + MLSecOps pipeline with policy-as-code enforcement (OPA), runtime detection (Falco), model signing (Sigstore), and AI-BOM generation (Apply)

Produce auditor-ready DPDP Rules 2025 compliance artifacts: breach notification workflow, Consent Manager integration, Data Fiduciary obligations checklist (Create)

Map an organisation's security controls to the SEBI CSCRF 2024 structured audit format, including RE classification tier assignment (Apply)

Document board-level IT risk accountability obligations under RBI Master Directions 2024 with a CERT-In notification playbook (Create)

AI governance frameworks: NIST AI RMF (Govern, Map, Measure, Manage) with artifact templates; ISO/IEC 42001 AI Management System controls and certification pathway; EU AI Act risk tier taxonomy mapped to NIST AI RMF categories

EU AI Act phased enforcement: Feb 2025 prohibitions active; Aug 2025 GPAI obligations; Aug 2026 high-risk AI (Annexes III/IV); India-facing implications for MNCs

Privacy engineering: privacy-by-design principles (ISO 29101) applied to AI systems; DPDP Rules 2025 mapping to privacy engineering controls

FAIR risk quantification: translating threat scenarios into financial loss distributions using Monte Carlo simulation; presenting output as a board narrative; risk appetite framing

AI ethics in security contexts: bias and fairness in threat detection models; dual-use dilemmas; explainability for forensics and regulatory auditability

Emerging threats and post-quantum readiness: AI-powered attacks, deepfake social engineering, synthetic media fraud detection in BFSI; NIST PQC standards (FIPS 203, 204, 205), hybrid systems, and migration planning