TheCyberThrone AI Security Series: Your Complete Reading Guide

Why This Series Exists

Artificial intelligence moved from experiment to enterprise infrastructure faster than any technology in the last two decades. Security frameworks, regulatory guidance, and practitioner knowledge did not keep pace.

This series was built to close that gap.

Not as a vendor whitepaper. Not as an academic survey. As a practitioner-first, CISSP-grounded, real-incident-anchored body of work that covers every major AI security domain — from the first crafted prompt to the poisoned model underneath it all.

Fourteen pieces. Five content arcs. One complete picture.

Here is how to use it.

Read by Your Role

If you are a CISO or Risk Executive
Start here — in this order:

1. Topic 1 — Prompt Engineering + Agentic AI (what the threat landscape looks like)
2. Topic 9 — Shadow AI Risk (what is happening inside your organization right now)
3. Topic 10 — NIST AI RMF Applied (the governance framework that contains everything)
4. Topic 11 — AISPM (the visibility layer you currently lack)
5. Topic 8 — AI Incident Response (what happens when the above fails)

If you are a Security Architect
Start here:

1. Topic 2 — RAG Poisoning (the knowledge base as attack surface)
2. Topic 4 — Indirect Prompt Injection (the structural vulnerability in every AI pipeline)
3. Topic 7 — LLM Firewalls & Guardrails (what you deploy to defend it)
4. Topic 14 — AI Supply Chain Security (securing the foundation everything else stands on)
5. Topic 11 — AISPM (continuous posture management for everything you built)

If you are a SOC Analyst or Threat Hunter
Start here:

1. Topic 3 — Jailbreaking & Guardrail Bypass (how attackers manipulate your AI tools)
2. Topic 4 — Indirect Prompt Injection (the attack your current tooling cannot see)
3. Topic 5 — Prompt Leaking (reconnaissance that precedes every other attack)
4. Topic 6 — AI Red Teaming — MITRE ATLAS (how to find these vulnerabilities yourself)
5. Topic 13 — Prompt Engineering for CTI (how to use AI to hunt faster)

If you are a CTI Practitioner
Start here:

1. Topic 13 — Prompt Engineering for CTI (your immediate force multiplier)
2. Topic 2 — RAG Poisoning (how your intelligence pipeline can be corrupted)
3. Topic 4 — Indirect Prompt Injection (how threat actors target AI-assisted analysis)
4. Topic 6 — AI Red Teaming — MITRE ATLAS (the framework behind the threat taxonomy)
5. Topic 12 — AI-Assisted Social Engineering (what adversaries are doing with the same tools)

If you are a Developer or ML Engineer
Start here:

1. Topic 14 — AI Supply Chain Security (the model you downloaded last Friday)
2. Topic 5 — Prompt Leaking (what your system prompt is telling attackers)
3. Topic 3 — Jailbreaking & Guardrail Bypass (what users are doing to your guardrails)
4. Topic 4 — Indirect Prompt Injection (the structural flaw in every AI pipeline)
5. Topic 7 — LLM Firewalls & Guardrails (what you can build to defend it)

The Complete Series — All 14 Topics

Arc 1 — The Attack Surface

What the threats are and how they work

Topic 1 — Prompt Engineering + Agentic AI: The Convergence
The foundational piece. Where prompt engineering meets agentic AI — and why the combination creates the most consequential new attack surface in enterprise security.
Key insight: The prompt is the new exploit. The agent is the new execution environment.

Topic 2 — RAG Poisoning: The Open Book That Can Be Rewritten
Five carefully crafted documents. 90% manipulation success rate. A poisoned knowledge base silently corrupts every AI decision downstream — with zero alerts fired.
Key insight: The attack targets the trust relationship between the model and its knowledge source.

Topic 3 — Jailbreaking & Guardrail Bypass: The Guardrail Was Always a Suggestion
The guardrail is one layer. System prompt design, access controls, output validation, and behavioral monitoring are the remaining layers — and most enterprise deployments have invested in only the first.
Key insight: The guardrail is not the finish line. It is the first line.

Topic 4 — Indirect Prompt Injection: The Attack You Never Saw Coming
CVE-2025-32711 — CVSS 9.3. CVE-2025-53773 — CVSS 9.6. CVE-2025-59944 — CVSS 9.8. Three incidents, one root cause: the agent trusted content it should not have.
Key insight: The real security perimeter is not the model. It is everything around it.

Topic 5 — Prompt Leaking: The Script Behind the Stage
The system prompt is not a vault. It is a behavioral instruction set the model can be induced to reflect — through direct questioning, encoding tricks, or automated extraction frameworks.
Key insight: Design AI systems so that when the system prompt is exposed, the show can still go on.

Arc 2 — The Defender Playbook

How to find, stop, and respond to these threats

Topic 6 — AI Red Teaming: MITRE ATLAS Applied
MITRE ATLAS is to AI security what ATT&CK is to traditional threat intelligence. The framework that structures adversarial testing — and the tooling that makes it executable without building everything from scratch.
Key insight: Red team your AI before the attacker does. The framework exists. The tooling exists. The only thing missing is the program.

Topic 7 — LLM Firewalls & Guardrails
Microsoft Prompt Shields. Lakera Guard. NVIDIA NeMo Guardrails. AWS Bedrock Guardrails. Meta LlamaGuard. What each tool covers, what each misses, and why no single tool is sufficient.
Key insight: Defense in depth at the semantic layer requires multiple independent controls — not a single guardrail product.

Topic 8 — AI Incident Response
When the defenses fail. The AI-specific IR playbook — detection triggers, containment for AI systems, evidence preservation, eradication, recovery, and post-incident governance.
Key insight: The SOC objective for AI incidents is detection before authorization — not detection after loss.

Arc 3 — The Internal Threat

The risks that need no external attacker

Topic 9 — Shadow AI Risk: The Breach That Needed No Hacker
98% of organizations have unsanctioned AI usage. 63% have no AI governance policy. The most common entry point for data leakage in 2026 is an employee doing their job with a tool their security team has never reviewed.
Key insight: Banning does not work. When approved tools are provided, unauthorized use drops 89%.

Arc 4 — The Governance Framework

How to manage all of this systematically

Topic 10 — NIST AI RMF Applied: The Governance Capstone
Govern. Map. Measure. Manage. The four-function framework that wraps around every technical control in this series — giving security leaders a structured, repeatable, auditable program for AI risk management.
Key insight: AI risk management is an ongoing journey, not a destination.

Topic 11 — AISPM: You Cannot Secure What You Cannot See
CSPM saved the cloud. AISPM has to save AI. The continuous discovery, risk scoring, behavioral monitoring, and agentic governance layer that makes everything else in this series visible.
Key insight: 16,200 confirmed AI security incidents in 2025. 6% of organizations have an advanced AI security strategy. AISPM closes that gap.

Arc 5 — The Human and Foundation Layers

The threats at the edges of the technical stack

Topic 12 — AI-Assisted Social Engineering: When the Voice on the Call Is Not Human
$25.6 million wired. Every face on the video call was fake. The production cost of social engineering has collapsed. Voice cloning. Real-time deepfake video. Spear phishing at machine scale.
Key insight: When the voice on the call is not human, the only defense is a process that never needed it to be.

Topic 13 — Prompt Engineering for CTI: The Intelligence Analyst’s Force Multiplier
The analyst who masters prompt engineering is not just more productive — they are operating in a different threat response category. A complete practitioner prompt library covering extraction, analysis, mapping, and dissemination.
Key insight: The analyst with the best prompt library wins.

Topic 14 — AI Supply Chain Security: Trending Does Not Mean Trustworthy
244,000 downloads. One infostealer. The #1 trending model on Hugging Face was malware. The same attacker playbook behind Mini Shai-Hulud and the Bitwarden CLI hijack — now targeting AI model repositories.
Key insight: Verify before you trust. Sandbox before you deploy. Scan before you load.

The One Table That Maps It All

A Final Word from the Practitioner Behind the Series

When this series began, the question behind every piece was the same one that stopped me from scrolling past the AWS UAE incident headline — the question every practitioner with a CISSP mindset asks when something significant happens:

Not what happened. But why it was always going to happen — and what should have been in place before it did.

AI security in 2026 is not a future problem. It is a current operational reality that most security programs are treating as a future problem. The gap between what practitioners need to know and what is available in practitioner language — that gap is what TheCyberThrone exists to close.

This series is my attempt at closing it. Fourteen pieces. One practitioner’s unfiltered analysis. Offered in the hope that it makes even one architect reconsider their threat model, or one CISO add one more scenario to their BIA.

If it did — it was worth every piece.

All fourteen are at thecyberthrone.in.