Securing the systems that don’t run on rules anymore.
This page is the index for the series — every planned category and article, with a line on what it covers. Links go live as each piece publishes; everything else is marked (coming soon). Bookmark this page — it will keep growing.
It’s a field-guide library on GenAI and agentic AI security — how these systems work, how they fail, and how to defend them — written for security architects, ML engineers, and anyone building AI products that need to survive contact with the real world, with examples, possible diagrams, and code snippets.
ToC for GenAI Series (50+ articles)
- Start Here — GenAI Foundations
- Agentic AI — Build It, Then Secure It
- AI Inference & Production Operations
- Responsible AI & Explainability
- AI Voice Agents
- Data, Model & Infrastructure Security
- Industry Playbooks & the Threat Landscape
- Building the AI Security Career & Function
1. Start Here — GenAI Foundations
The vocabulary and mental models everything else in the series assumes — read these first if terms like “transformer,” “RAG,” or “agentic loop” aren’t yet second nature.
- Predictive AI vs. Generative AI: A Security Field Guide (coming soon)
Two AI paradigms, two threat models — why a stop-sign sticker attack and a chatbot inventing a refund policy are different failures that demand different defenses.
The full vocabulary spine from transformer to agentic engineering, in the order the industry actually built it — so the rest of the series reads cleanly.
- LLM: Zero to Hero (coming soon)
What a large language model actually is, how it works mechanically, and what you can build with one — before the attention-mechanism math.
- LLM, SLM, BERT — or Something Else? (coming soon)
A decision-first guide to picking the smallest model that clears your quality bar, and what a bigger one costs you in money and attack surface.
- RAG vs CAG: Retrieval- vs. Cache-Augmented Generation (coming soon)
When to fetch knowledge at query time versus preload and freeze it into context — and what each choice costs in latency, spend, and attack surface.
The technique catalogue every later article assumes — zero-shot, few-shot, chain-of-thought, self-consistency, tree-of-thought, and ReAct — with worked examples, code, and the security failure mode each one opens up.
Every risk from LLM01 Prompt Injection to LLM10 Unbounded Consumption, walked through with real-world incidents, sandbox-runnable attack payloads, annotated data-flow diagrams, and working code for each mitigation — step by step, not just a checklist.
- The GenAI Security Handbook (coming soon)
A 19-chapter, zero-to-hero primer for interns and junior engineers — from “what is a token?” to the full OWASP LLM and Agentic attack playbook.
02 · Agentic AI — Build It, Then Secure It
Agents are where GenAI’s blast radius stops being theoretical. This is the deepest thread in the series: how agents are built, and every layer of how they’re attacked and hardened.
- Agentic AI, Part 1 — From Zero to Agentic (coming soon)
What an agentic system actually is, the perceive–reason–act loop, the agentic stack, and building your first tool-using agent in 30 minutes.
- Agentic AI, Part 2 — Attack Surface to Hardened System (coming soon)
The OWASP Agentic Top 10, real incidents like EchoLeak, and the defense-in-depth architecture — Intent Gate, Zero Trust, sandboxing — that hardens an agent end to end.
Each agentic-specific risk — memory poisoning, tool misuse, cascading hallucination, rogue-agent action — dissected with attack-chain diagrams, reproducible PoC code, and the concrete control that closes it, one risk at a time.
Why “confused deputy” is the signature agentic failure, and the identity fabric — delegation, workload identity, on-behalf-of tokens — that closes it.
- The Agentic Harness (coming soon)
The infrastructure layer that turns a stateless model into a running agent: its seven internal layers, the control loop, and how to secure it.
- The AI Agent Protocol Stack — MCP, A2A, UTCP & the Rest (coming soon)
How agents talk to tools, to each other, and to the world — the protocol landscape explained as layers, not competitors, with a decision tree for which to adopt.
The human-memory analogy for episodic, semantic, and procedural agent memory — what each is for, the tools that implement it, and how memory gets poisoned.
- AI Agent Identity & IAM (coming soon)
Why traditional IAM’s “one principal, one session” model breaks the moment an agent acts as itself, as a user, and as another agent — and what fixes it.
- Prompt, Context & Intent Engineering (coming soon)
The three eras of engineering what a model sees and what you mean — and exactly where the security boundary lives in each one.
- Loop Engineering: Designing the Agentic Control Loop (coming soon)
The perceive–plan–act–reflect loop as its own design discipline — termination conditions, runaway-loop failure modes, and the guardrails that keep an agent from looping itself into a bill or a breach.
Why “vibes-based” testing doesn’t scale — golden datasets, LLM-as-judge scoring (and how to attack a judge), and the guardrail stack that turns evals into a production gate.
A working map of the framework layer — orchestration vs. retrieval vs. observability — and the security posture of each, from prompt-injection-via-trace to leaking secrets into an observability backend.
The full guardrail taxonomy — input, output, and the frequently-missed tool-call rails — how the detectors work under the hood, and why a guardrail is a probabilistic filter, not a security boundary.
Why the skill layer sits between the model and MCP tooling and is the least-protected of the three — packaged instructions plus executable code running with the host agent’s full privileges, and the supply-chain controls that close the gap.
Malicious skill packaging, instruction-code smuggling, privilege inheritance from the host agent, and the rest of the skills-specific risk list — each walked through with a working (defanged) malicious skill, an architecture diagram of the blast radius, and the vetting/sandboxing code that stops it.
- Agentic Ransomware — When the Agent Is the Payload (coming soon)
Two distinct threats hiding under one label — the agent as attack tool, and the compromised enterprise agent as the ransomware vector — anchored in the JADEPUFFER case and closed by least-privilege scoping and immutable backups.
- AI Agent Incident Response & Kill-Switch Design (coming soon)
Why a compromised agent is an active participant issuing tool calls at machine speed, not a fixed foothold — and the pre-wired kill-switches and containment hooks that stop it before a human can react.
03 · AI Inference & Production Operations — From Mechanics to the Control Plane
Every AI product is billions of inference calls, not one training run — and once it’s live, running it safely is its own discipline. This section covers both: how inference actually works, and the gateway, pipeline, cost, logging, and observability layers that keep it under control in production.
- Part 1 — The Mechanics of Inference (coming soon)
Everything between “send message” and “receive token” — tokenization, the transformer forward pass, the KV cache, and decoding strategies, with annotated PyTorch.
- Part 2 — Making Inference Fast (coming soon)
Why inference is expensive, and the optimization stack — FlashAttention, quantization, speculative decoding, continuous batching — that makes it affordable.
- Part 3 — Production Inference Systems (coming soon)
The full serving stack: vLLM, TGI, cloud APIs, edge deployment, cost optimization, and the inference-time security controls that sit alongside all of it.
Why the reverse proxy that centralizes identity, token-denominated cost, and routing is also a crown-jewel target the moment you consolidate all model traffic behind it.
The CI/CD skeleton for shipping models, prompts, and agent configs — where the eval gate replaces the unit-test gate, and the pipeline itself becomes the attack surface.
- Cost & Token-Abuse Monitoring for AI Systems (coming soon)
Denial-of-wallet as the AI-era DoS — inverted attacker economics, and why a cost spike is often the earliest signal that an agent has been hijacked.
- AI Logging & Monitoring — What to Capture, How to Store It Safely, and What to Alert On (coming soon)
Why full prompt/response logs are a new sensitive datastore, not a bigger app log — and how to reconcile forensic reconstruction with GDPR/DPDP erasure.
- AI Observability — The Security Angle (coming soon)
Tracing, eval telemetry, and drift/behavioral detection as the discipline that catches the quiet attacks — the ones invisible to any single log line.
04 · Responsible AI & Explainability
Security stops the intentional attacks. This pair of series answers the harder question underneath: what does “good” even mean, and how do you prove a model’s decisions are safe and explainable?
Why fairness is a values decision, not a metric, and how the NIST AI RMF turns scattered principles into a working governance spine.
- Responsible AI, Part 2 — AI Safety (coming soon)
Why safety and security are interdependent but distinct by threat source — and how evals, guardrails, and a written safety case make that distinction operational.
- Explainable AI, Part 1 — The Black Box Problem (coming soon)
Why accuracy is an engineering claim but explainability is a trust claim — and the regulatory landscape that increasingly demands you can prove the difference.
- Explainable AI, Part 2 — The XAI Toolkit (coming soon)
A practitioner’s tour of SHAP, LIME, counterfactuals, and intrinsically interpretable models, with runnable code and a decision matrix for which tool fits.
Why classical XAI breaks for LLMs, what mechanistic interpretability offers instead, and how explanation becomes an auditable governance artifact.
05 · AI Voice Agents
Voice is agentic AI with a new attack surface bolted on the front — spoofing, deepfakes, and adversarial audio — and a new set of latency and data-residency constraints.
- Part 1 — From Zero to Voice (coming soon)
What an AI voice agent is, the technology stack from VAD to TTS, and industry-by-industry use cases from banking to healthcare.
- Part 2 — Under the Hood (coming soon)
Production-grade architecture, LLM selection and benchmarking for voice, and where audio, transcripts, and PII actually get stored.
- Part 3 — Attack Surface to Hardened System (coming soon)
Voice spoofing and deepfake fraud, adversarial audio on ASR, and the defensive engineering — anti-spoofing, PII masking, tool-permission models — that stops them.
06 · Data, Model & Infrastructure Security
Below the application layer: the model weights, the training data, the vector store — where an attack leaves no CVE and often no trace on a normal eval.
- Privacy-Preserving Machine Learning (coming soon)
Why a model can leak training data through ordinary, authorized queries — and the privacy-enhancing technologies (differential privacy, federated learning, SMPC) that actually help.
- Vector Databases: Fundamentals, Architecture & Security (coming soon)
How ANN indexes work under the hood, why an embedding is not a hash, and the five threats — poisoning, inversion, broken tenancy — that actually bite RAG systems.
- AI Supply Chain Security (coming soon)
Why the model you load is the hard half of your supply chain — poisoned weights, malicious pickles, typosquatted hubs — and the signing and MLBOM controls that gate a safe deploy.
How a base model becomes a product — supervised fine-tuning, parameter-efficient adaptation (LoRA/QLoRA), preference alignment (RLHF/DPO), and the MoE architectures behind today’s frontier models — explained mechanically, with code.
- Fine-Tuning & RLHF Security (coming soon)
Why reshaping a model’s weights reshapes its threat model — and why a few hundred poisoned samples can implant a backdoor invisible to your standard evals.
The whole picture at once and the feedback loop that keeps it current — plus how the emerging “AI Defense” product category maps onto the six-layer model.
What Secure SDLC is for software, AIPDLC is for AI products — nine phases, a named owner and artifact at each gate, and why Decommissioning is the gate everyone skips.
07 · Industry Playbooks & the Threat Landscape
The horizontal attack catalogue, reframed for the vertical you actually ship in — and a single map of where every AI security control really lives.
The front-door orientation read — the five assumptions AI breaks, and which deep-dive to open next for each of the seven questions leaders actually ask.
- The AI Security Frameworks Field Guide — OWASP, MITRE ATLAS, NIST, ISO 42001, CSA MAESTRO, Google SAIF, Databricks DASF (coming soon)
Why there is no single AI security framework, and how the seven that matter interlock by altitude and job rather than compete.
- AI Security Guardrails by Vertical (coming soon)
Why the same LLM stack carries a different risk profile in fintech, ecommerce, healthcare, and data-heavy SaaS — and which guardrails to prioritize in each.
- The AI Security Landscape — Hardware to Human (coming soon)
A CISO’s six-layer map of the AI attack and control surface, from GPU silicon up to deepfakes and disclosure — with the control that belongs at each layer.
Why frontier-scale models carry emergent, hard-to-eval risks that ordinary AppSec review doesn’t catch — dangerous-capability evals, model-weight exfiltration, and the governance controls (RSPs, capability thresholds, staged deployment) that leading labs and regulators are converging on, illustrated with real disclosure timelines.
08 · Building the AI Security Career & Function
For anyone hiring for, staffing, or pivoting into this field — the org-level and career-level guides that sit alongside the technical series.
- The AI Security Architect Curriculum (coming soon)
A hands-on, portfolio-based syllabus to earn the AI Security Architect title — topics, labs, and artifacts, not just a reading list.
- Staffing an AI-Security Function (coming soon)
Why team size should scale with AI risk surface, not headcount — a resourcing model stress-tested against eight real companies.
- Upskilling a Security Team for AI (coming soon)
A program design — not a reading list — for closing the two-sided AI/security skills gap across a whole team, on a real budget.
- The Forward Deployed Engineer: A Field Guide (coming soon)
The engineer who ships inside the customer’s world — where the role came from, and how AI made it suddenly indispensable.
By Sanjeev Jaiswal · linkedin.com/in/jassics · GenAI Security Series
Also published on medium
