AI Security Verification (OWASP AISVS) Fundamentals Training
A one-day fundamentals programme on OWASP AISVS. Learn how to check whether an AI-enabled application has appropriate, testable security controls. Participants work through practical examples and a guided case before drafting actions for their own organisation.
Who should attend: Developers, application owners, security, testing and technical risk staff. No prior framework knowledge is required.
HRD Corp claim support available
Programme Agenda
9:00 AM to 10:00 AM
Verification Rather Than Assumption
Introduce AISVS as a catalogue of testable security requirements for AI-enabled systems. Distinguish a threat list, a control requirement and evidence that a requirement is met.
10:00 AM to 10:15 AM
Break
10:15 AM to 11:30 AM
Scope and Trust Boundaries
Draw a simple AI application's users, model, data sources, tools and external services. Identify boundaries, sensitive assets and security assumptions before selecting verification requirements.
11:30 AM to 12:30 PM
From Requirements to Checks
Choose representative requirements relevant to the application. Turn each into a plain-language test objective, prerequisites, expected result and evidence record rather than marking a checkbox without testing.
12:30 PM to 1:30 PM
Lunch
1:30 PM to 2:45 PM
Data, Model and Integration Safeguards
Explore access, untrusted input, output handling, secrets and dependency controls through a fictional assistant. Consider how application design changes the checks needed.
2:45 PM to 3:00 PM
Break
3:00 PM to 4:00 PM
Results, Limitations and Remediation
Record findings, scope limits and retest needs. Distinguish design review, configuration evidence and observed behaviour, and explain why passing a few examples does not prove complete security.
4:00 PM to 5:00 PM
Practical Exercise: A Verification Plan
Select five checks for a fictional document assistant, define expected evidence and review illustrative results. Prioritise remediation and explain what remains unverified.
Key Outcomes
- Distinguish testable requirements from risk categories
- Scope an AI verification review
- Draft checks with expected evidence
- Report findings and test limitations
Training Mode Physical / Online / Hybrid
HRD Corp Subject to programme eligibility and HRD Corp approval
Level Fundamentals / Beginner. No prior framework knowledge required.
Duration 1 Day | 9:00 AM to 5:00 PM (6.5 learning hours, excluding breaks)
Venue In-house at the client's premises, or delivered via the client's preferred platform (Microsoft Teams, Zoom, or equivalent)
Assessment Group case exercise and a 10-question knowledge check
Certificate Orbix Certificate of Completion upon full attendance; not a professional certification
Malaysia Relevance
High relevance for Malaysian AI developers, IT teams and security reviewers seeking evidence beyond a supplier's security statement. The course uses the current community AISVS catalogue and distinguishes requirements from a Top 10 risk list.
Practical Takeaways
An AI security verification plan and evidence-and-findings worksheet.
Download a sample practice worksheet (TXT). This fictional exercise is a preview of the learning approach. About Orbix; contact us to confirm the facilitator and relevant experience for your delivery.
Course Completion and Next Steps
Participants receive an Orbix Certificate of Completion upon full attendance. This introductory course does not confer professional certification or establish an organisation's compliance. Further implementation and assessment depend on the organisation's scope and obligations.
Frequently Asked Questions
Related Fundamentals Training
AI Agent Security (OWASP Agentic Top 10) Fundamentals Generative AI Security (OWASP LLM Top 10) Fundamentals AI Agent Runtime Security (OWASP Agent Control Standard) Fundamentals AI Security Controls (CSA AICM) Fundamentals View all fundamentals programmes
Reference material: OWASP: Artificial Intelligence Security Verification Standard.