Course · Training · Workshop
Agentic Attack & Defense
Two days hands-on: attack with agents, defend with agents, then let both sides fight it out in a shared lab scenario.
Attackers use generative artificial intelligence (GenAI) and agents based on large language models (LLMs) for recon, vulnerability analysis and phishing. Defenders use the same technology for triage, detection and incident response. If you only know one side, you misjudge the other. In this course you work on both sides. As the red team you connect security tools to an agent through the Model Context Protocol (MCP) and test attack paths against conventional systems as well as against LLM applications and agents. As the blue team you build agents that enrich alerts, write and test detections and work through an incident. The course ends with both sides facing each other in a shared lab scenario: an attack agent works through an authorized attack path while a defense agent has to detect and contain it. We then review what the attack left behind, what the defense saw and where humans had to step in. Scope, rules of engagement, human approvals and an audit trail apply to every exercise.
What participants say
The course was highly educational. I discovered many tools and found the integration of these tools with AI into a developer environment extremely fascinating. I learned a lot about cutting-edge topics, which is especially impressive given the rapid evolution of the AI landscape. The knowledge I gained has already helped me improve and accelerate my own processes, significantly enhancing my daily workflow.
Cloud Platform Solution Architect, Helvetia Versicherungen Schweiz
* Voices from this or related courses.
These customers booked courses in the same topic cluster.More customers →
Content
This training is for engineers who want to experience agentic attacks and agentic defense in the same lab. You alternate between both sides and see directly which traces your attacks leave and which detections catch them.
The course consists of the following topics and can be adapted to the audience. For in-house courses we agree on focus areas such as web applications, Active Directory, cloud or your SIEM and EDR stack.
Objectives, test boundaries and lab
- Define objectives, scope and rules of engagement for both sides
- Plan approvals, data handling, stopping conditions and audit trail
- Describe attacks and defenses with MITRE ATT&CK and MITRE ATLAS
The agentic security stack
- Agent planning, tool use, context and memory
- Connect security tools, SIEM and ticketing via MCP; restrict permissions and target systems
- Cloud and local models: handling findings, logs and confidential data
- Hands-On: set up an agent harness with logging and human approvals on the labmachine
Attack: testing conventional systems with agents
- Recon, attack surfaces and attack-path hypotheses
- Verify vulnerabilities in web applications, identities and cloud services
- Identify hallucinations and false positives through independent checks
- Hands-On: reproduce and document an authorized attack path with synthetic data
Attack: LLM applications and agents as targets
- Direct and indirect prompt injection through documents, logs and tool responses
- Data leakage, excessive permissions and missing boundaries between users
- Hands-On: attack a lab agent with synthetic data
Defense: triage and detection with agents
- Enrich alerts with asset, identity and threat intel context
- Write, test and map Sigma rules against ATT&CK with LLM assistance
- Back every agent statement with evidence
- Hands-On: build a triage agent and validate detections for your own attacks
Defense: incident response and hardening
- Timeline reconstruction, scoping and response actions with approval levels
- Protect your own defense agent against prompt injection via log data
- Least privilege, sandboxing and kill switch; map countermeasures with MITRE D3FEND
- Hands-On: harden the attacked lab agent and retest
Final scenario: agents against each other
- An attack agent works through an authorized attack path, a defense agent detects, triages and contains
- Humans approve critical steps on both sides
- Joint review: attack steps, telemetry, detection gaps, time to detect
- Hands-On: close the gaps and rerun the scenario as a retest
At the end of the two days you have built an agentic attack stack and a defense stack, tested them against each other and know which tasks you can delegate to agents and which results you need to verify yourself.
The actual course content may differ from the above depending on the trainer, delivery, duration and the composition of participants.
Request this course in-house
Request a public date
No suitable public date? Register without obligation — once there is enough interest we schedule a new public date and let you know first.
More about Agentic Attack & Defense
Agents change both sides of security at the same time. Attackers delegate recon and vulnerability discovery to agents, defenders delegate enrichment, correlation and detection engineering. Whether the defense keeps up only shows when both sides work in the same scenario: which traces does an agentic attack leave, which detections fire, and where does an agent rely on input an attacker can manipulate?
Further resources:
Related courses
- Agentic Red Teaming: two days on the offensive side only, including social engineering and a findings report.
- Agentic Blue Teaming: two days on defense only, including threat hunting and detection as code.
- Defense in the Age of Agentic Attacks: priorities, organization and crisis readiness for leadership.