Reading about prompt injection doesn't make you good at finding it. Our scenarios put you in front of real, breakable systems and grade you on whether the exploit — and the fix — actually works.
Exploit a live target — override a support bot, poison a RAG index, hijack an agent loop — and capture proof.
Implement a real mitigation: sanitize input, anchor instructions, filter output, or add retrieval guardrails.
Confirm the fix actually holds under the original attack and its variants — not just that it looks right.
The Attack → Defend → Verify loop runs on every scenario.
Every OWASP topic is a guided path — not a PDF. For each scenario you get:
Each topic runs two tracks: offensive (learn to exploit the flaw) and defensive (learn to hold the fix). Progress saves as you go, and every module maps back to the OWASP LLM Top 10 — so a finished path reads as coverage, not attendance.
Be honest: a page of security prose gets skimmed once and closed. And passive reading doesn't transfer anyway — the moment you're in front of a live target and have to find the surface yourself, none of it is in your hands. So the concept isn't something you read. It's a few minutes of video and a run of short checkpoints, and every one of them makes you do something.
You commit a prediction before the answer unlocks. You recall the technique from memory instead of re-reading it. You choose which fix actually holds among controls that all look reasonable, and you finish a half-built exploit by supplying the one line that matters. Topics are interleaved so you can't coast on context, and a short warm-up brings the last session back when you return.
Commit a guess first — a wrong answer you owned sticks far better than one you were simply shown.
Pull the technique back from memory. The attempt is the point; nothing here is scored.
Pick the control that holds among naive fixes an attacker would edit straight around.
A payload is built except for the one decisive fragment. You supply it, then see why it matters.
Attack families are shuffled together, so you learn to tell them apart instead of memorizing an order.
Come back later and a short warm-up recovers the last session before you go deeper.
Scenarios run against real applications — a real storefront, an internal knowledge base, a developer forum — not toy prompts.
You're a customer, an employee, a forum member. The vulnerability lives where it would in production: in the seam between untrusted input and privileged instructions. You have to find the surface yourself.
When you think you've succeeded, you submit evidence. The grader doesn't read prose — it re-runs the exploit.
That means instant, trustworthy feedback — and a completion record your team lead can actually rely on.
Skills are organized around the OWASP LLM Top 10 (2026), the field's shared language for AI risk. Each scenario is tagged to one or more categories, so your progress reads as coverage — not points — and gaps are obvious.
Coverage doesn't stop at OWASP. Every scenario is cross-referenced to the control frameworks your security program and auditors already use, so training coverage doubles as evidence. We describe this as alignment and mapping — not certification.
Each scenario tagged to one or more categories; coverage is reportable per person and per team.
Scenarios map to the Govern, Map, Measure, and Manage functions of the AI Risk Management Framework.
Offensive techniques reference real ATLAS adversary tactics against ML/AI systems.
Training maps to AI management-system control areas for your ISMS evidence.
Start with a direct prompt injection against ShopBot — it takes about 35 minutes.