SANS SEC546Course Author & InstructorPillar: Securing AI
Securing Agentic AI
I am the author of SANS SEC546, a five-day, hands-on course for defenders who need to secure AI agents that plan, call tools, remember, and act on their own. The course is built around practical controls rather than theory: every section pairs the threat with labs that implement the defense.
Agents break many of the assumptions traditional application security relies on. They take instructions from untrusted content, hold long-lived memory, chain tools together, delegate to other agents, and increasingly act on desktops, browsers, and physical devices. Security teams are being asked to defend these systems before most of the playbooks exist.
SEC546 distills what I have learned securing AI and software supply chains into a defense-first curriculum. It follows an agent from its first prompt to its last action: boundaries and identity, runtime operations, the MCP tool layer, multi-agent and computer-use ecosystems, and finally agents that touch the physical world. I also teach SANS SEC545: GenAI and LLM Application Security, and SEC546 is designed as the natural next step for teams moving from LLM applications to autonomous agents.
What you will be able to do
Model agentic AI threats and attack surfaces
Enforce input, output, identity, and permission boundaries
Defend against prompt injection, context poisoning, and tool tampering
Harden agent memory and runtime operations
Secure MCP flows, tool execution, and desktop agents
Protect multi-agent and browser-based agent ecosystems
Apply cyber-physical safeguards in a capstone exercise
> ls sections/
The five days at a glance
Summaries below are my overview of each section. See SANS.org for the official syllabus, schedule, and registration.
Day 1
Foundations of Agentic AI Security
Builds the mental model for why autonomous agents change the threat landscape. Students threat-model agentic systems, put boundaries around what flows into and out of an agent, defend against prompt injection, and apply secure development patterns with scoped identities and the principle of least agency.
Topics
›Agentic AI risks and threat modeling
›Input and output boundary enforcement
›Prompt injection defense
›Secure agent development patterns
›Agent identity, permissions, and least agency
Labs
1.1Hardening with NeMo Guardrails
1.2Agent Goal Integrity Controls
1.3Build Secure Agent Chain
1.4Privilege Scoping & Identity Controls
Day 2
Agent Operations, Hardening, and MCP Defense
Moves from design to day-to-day operations. Covers protecting agent memory and context stores, spotting and safely shutting down rogue agents, building observability and governance into agent runtimes, and placing a policy-enforcing gateway in front of Model Context Protocol (MCP) traffic.
Topics
›Securing agent memory and context stores
›Detecting, containing, and isolating rogue agents
›Observability, governance, and continuous defense
›MCP gateway defense and policy
Labs
2.1Memory Integrity Controls
2.2Safe Agent Termination
2.3Runtime Governance and Policy Enforcement
2.4Deploying Defensive MCP Gateway
Day 3
Secure MCP, Desktop Agents and Runtime Defenses
Goes deeper into the tool layer. Students detect poisoned context and tampered tool responses, sandbox tool execution with egress controls, lock down coding and desktop agents running on developer machines, and track the provenance of agent dependencies, skills, and prompts with an AI bill of materials mindset.
Topics
›MCP data integrity and context security
›Agent tool execution sandboxing
›Securing desktop agents
›Agent supply chain and AIBOM defense
Labs
3.1Detecting Context Poisoning and Tool Response Tampering
3.2Tool Sandbox and Egress Controls
3.3Securing OpenCode Agents
3.4Dependency, Skill and Prompt Provenance
Day 4
Multi-Agent, Browser and Computer-Use Agent Security
Addresses systems where agents talk to other agents and act in browsers or on screens. Covers trust between agents over agent-to-agent (A2A) protocols, sandboxing computer-use actions, scoping delegated authorization through token exchange, and preventing data from leaking across agents and tasks.
Extends agent security into the physical world, where mistakes have real-world consequences. Covers safety controls and kill switches for robotic and IoT agents, confidential execution and attestation for agents, and emerging research areas, then ends with a live capture-the-flag defense capstone.
Topics
›Physical-world agent safety
›Emerging agentic security topics
›Agent defense capstone
Labs
5.1Robotic and IoT Kill-Switch Controls
5.2Confidential Agent Execution and Attestation
5.3Live Defense Operations CTF
Who should attend
›AI/ML security engineers building or defending agentic systems
›AI security specialists and AI incident responders