NIST's Center for AI Standards and Innovation published a technical blog on 17 January 2025, written with the UK AI Security Institute, about how we evaluate agent hijacking. Their line is this: "This resulted in an increase in attack success rate from 11% for the strongest baseline attack to 81% for the strongest new attack."
Read that carefully, because it gets repeated wrong constantly. That is not a count of real companies getting hit. It is a measurement of evaluation methods inside a testbed: AgentDojo, four simulated environments. What they found is that when researchers wrote new attacks instead of reusing the old ones, the success rate against a test agent went from 11% to 81%. In other words, our old tests were making agents look far safer than they are, and the finding is about the testing, not about a wave of breakins.
That is still the whole reason this job exists. Source: NIST, strengthening AI agent hijacking evaluations.
Three of these five cost nothing. Two cost money, and they are the two that carry weight with a hiring manager, so the sensible plan is to do the free three first and decide on the paid two once you know you actually like this work.
Cost: free. Time: 130 minutes, 3 modules. You get: a trophy on your Microsoft Learn profile and a badge for each module.
This is the shortest on-ramp on the list and it is the one to open tonight. The three modules are fundamentals of AI security, AI security controls, and introduction to AI security testing, which is 10 units, then 10 units, then 6. By the end you can hold the vocabulary of the field in a conversation, which is what the next four assume you already have.
Start here: AI security fundamentals on Microsoft Learn. A free Microsoft account is all it needs.
Cost: free, with a free account to track your progress. Time: the page estimates about 2 hours 30 minutes. You get: a downloadable PDF certificate of completion.
Ten lessons, one per risk, running from LLM01 prompt injection through to LLM10 unbounded consumption. This is the list every security review of an AI feature is secretly working from, so knowing all ten by name is the difference between having an opinion in that meeting and being the person who runs it. It is also the fastest thing here that leaves you holding a document.
Start here: OWASP Top 10 for LLM and GenAI on Snyk Learn. Snyk's own docs put it plainly: "For all Snyk Learn security learning paths, you will be awarded a Certificate of Completion upon completion."
Cost: free. Time: three one-hour on-demand sessions. You get: a certificate and a Credly badge you can attach to LinkedIn.
Of the three free ones, this is the one actually about agents rather than about models. It covers MCP, agentic frameworks, agent visibility, and how you authenticate an agent's communications and its access to data, which is the real day job: deciding what an agent is allowed to reach and proving you can see what it did. Proofpoint's page states it directly: "All Cybersecurity Leadership Specialist courses and certifications are free."
Start here: AI Agent Security specialist certifications. It also runs on Proofpoint's UK and Australia sites, so you are not locked out by geography.
Cost: $795, which the page says includes training plus the exam with 2 attempts. Exam: 60 questions, 120 minutes, 80% to pass, valid 2 years. Prerequisites: none. You get: a badge and certificate co-issued with Northeastern University.
This is the first one on the list where a recruiter recognises the name on the credential, and the university co-issue is why. Ten modules, and the page states it plainly: "No prerequisites are required for the TAISE exam." So the $795 is buying you the training, two shots at a real proctored-style exam, and a co-issued credential, not a course completion.
Details and enrolment: Trusted AI Safety Expert, Cloud Security Alliance.
Cost: $210 for the exam voucher, listed as $249.90 including VAT. Path: the AI Red Teamer path, 12 modules, difficulty Hard. Exam: a 7-day practical, not multiple choice. You get: the one credential here that proves you can do it, not just discuss it.
This is the hard one and it sits last for a reason. The exam is seven days of doing the work against real targets, which is why it carries more weight than anything above it, and why it is explicitly aimed at experienced professionals rather than beginners. If the first four taught you the language, this is the one that tests whether you can actually break something and write it up.
The path: AI Red Teamer on HTB Academy. Pricing: HTB Academy subscriptions.
The reason people buy a certification and never sit it is that the page gives you hours, not a schedule. Paste this into Claude once per certificate and it hands you back a week-by-week plan built around the time you actually have.
I am working towards [certificate name] and here is the official page describing it: [paste the URL, plus anything you copied off the page about length, format, modules and exam topics].
I have [number] hours a week and I want to be done by [date]. Before you plan anything, ask me up to three questions about my current background, what security work I have actually done, and how much code I write, so you do not waste sessions teaching me things I already know.
Then build me a week-by-week plan. For each week give me the specific topics, roughly how long each session should take, and one small thing I have to produce by the end of that week that proves I understood it, like a written explanation in my own words or a short threat model I could defend out loud. Flag the two or three topics most likely to catch me out and schedule those early rather than last. Finish with a checklist for the final week before I sit it.This is the part that turns a certificate into a conversation. Take one AI thing you have already made, even a small one, and have Claude walk all ten risk categories across it and tell you where it would break. Doing this once gives you a real example to talk about in an interview, which is worth more than any of the five names above.
You are reviewing an AI feature I built, against the OWASP Top 10 for LLM and generative AI applications. Here is what it is and how it works: [describe what it does, which model, what it is connected to, where text or files come in from outside, who can use it, and what it is allowed to change or send].
Go through all ten categories one at a time, from prompt injection to unbounded consumption. For each one, tell me whether my setup is exposed, not exposed, or you cannot tell from what I have given you, and say which part of my description made you decide that. Where I am exposed, give me the smallest concrete change that closes it, and say what it costs me in usefulness.
Then finish with the three fixes you would make first and why, and one short paragraph I could say out loud in an interview describing what I found and what I changed. Ask me up to three questions first if anything about my setup is unclear.There are a lot of AI security credentials being advertised right now, and most of them did not survive a look at the actual page. Here is what I checked and dropped, so you do not spend a weekend on it.