# SecNet Academy — Security Leadership and AI Assurance Programme An applied development route from foundations to security architecture, AI audit and board decisions. 32 weeks / 768 hours / 24 hours/week The programme prepares learners for senior security responsibilities; it does not alone guarantee expertise, a management appointment or formal professional authority. Course exams, lesson completion and practical review are measured separately. Real experience and sector-specific specialisation are also required. Each phase requires all lessons, at least 80% in every final and an independently reviewed practical dossier. Programme completion also requires advanced controlled mission solutions across seven domains. ## Foundations of security thinking Weeks 1–4 / 96 hours Asset, identity and trust-boundary maps with access decisions and basic risk reasoning. - Information Security Fundamentals: https://academy.secnet.work/courses/information-security - Network Security Fundamentals: https://academy.secnet.work/courses/network-security - Identity and Access Management Fundamentals: https://academy.secnet.work/courses/identity-access - Cryptography and PKI Fundamentals: https://academy.secnet.work/courses/cryptography-pki - Security Awareness and Human Factors Fundamentals: https://academy.secnet.work/courses/security-awareness ### Practical work Map Atlas data flows; demonstrate two permission failures with negative tests and explain controls. - [ ] Scope, assets and data ownership are explicit. - [ ] Inputs and observed results of two negative tests are recorded. - [ ] Residual risk and the decision owner are identified. ### Workpaper Scope and assumptions: Observations, inputs and test outcomes: Decision and rejected alternative: Evidence ID, version and date: Limitations and retest: Independent review note: ## Architecture and secure product delivery Weeks 5–8 / 96 hours Defensible architecture decisions for cloud, applications and delivery pipelines. - Cloud Security Fundamentals: https://academy.secnet.work/courses/cloud-security - Application and API Security Fundamentals: https://academy.secnet.work/courses/application-security - DevSecOps Fundamentals: https://academy.secnet.work/courses/devsecops - Security Architecture Fundamentals: https://academy.secnet.work/courses/security-architecture ### Practical work Prepare a threat model, permission tests, secrets handling and release acceptance/rollback plan for an application. - [ ] Adversary authority and boundaries are modelled. - [ ] Positive and negative tests are version-bound. - [ ] Deployment and rollback criteria are actionable. ### Workpaper Scope and assumptions: Observations, inputs and test outcomes: Decision and rejected alternative: Evidence ID, version and date: Limitations and retest: Independent review note: ## SOC, detection and incident management Weeks 9–12 / 96 hours Turn signals into evidence, measure detection quality and coordinate response. - Cybersecurity / SOC Analyst Fundamentals: https://academy.secnet.work/courses/soc-analyst - Incident Response Fundamentals: https://academy.secnet.work/courses/incident-response - Digital Forensics Fundamentals: https://academy.secnet.work/courses/forensics - SOC Detection Engineering: https://academy.secnet.work/courses/soc-detection-engineering - Expert Threat Hunting and Incident Analysis: https://academy.secnet.work/courses/soc-threat-hunting-expert ### Practical work Build a timeline of a synthetic identity incident; test a hypothesis, measure false positives and record response decisions. - [ ] Time and source provenance are verified. - [ ] Counter-hypotheses and false positives are explained. - [ ] Evidence preservation and response limits are explicit. ### Workpaper Scope and assumptions: Observations, inputs and test outcomes: Decision and rejected alternative: Evidence ID, version and date: Limitations and retest: Independent review note: ## OT, suppliers and resilience Weeks 13–16 / 96 hours Connect cyber decisions with physical safety, dependencies and recovery planning. - OT / ICS Security Fundamentals: https://academy.secnet.work/courses/ot-ics-security - OT Segmentation and Secure Maintenance: https://academy.secnet.work/courses/ot-segmentation-engineering - Business Continuity and Recovery Fundamentals: https://academy.secnet.work/courses/continuity-recovery - Third-Party and Supply Chain Risk: https://academy.secnet.work/courses/third-party-supply-chain - Expert OT Resilience and Incident Command: https://academy.secnet.work/courses/ot-resilience-expert ### Practical work Map zones and conduits for Atlas maintenance access; run a supplier-outage and clean-restoration tabletop. - [ ] Safety and operational approvals are separated. - [ ] Critical dependencies and a failed restoration case are recorded. - [ ] Service-restoration criteria are testable. ### Workpaper Scope and assumptions: Observations, inputs and test outcomes: Decision and rejected alternative: Evidence ID, version and date: Limitations and retest: Independent review note: ## Risk, data and security governance Weeks 17–20 / 96 hours From risk to investment decisions: legal scope, control evidence and ownership. - Governance, Risk and Compliance Fundamentals: https://academy.secnet.work/courses/grc - Enterprise Security Risk Fundamentals: https://academy.secnet.work/courses/enterprise-risk - Data Protection and Privacy Fundamentals: https://academy.secnet.work/courses/data-privacy - ISO/IEC 27001:2022 ISMS Implementation and Audit: https://academy.secnet.work/courses/iso27001-isms-audit - Security Programme with NIST CSF 2.0: https://academy.secnet.work/courses/nist-csf-program - Security Audit and Evidence Management: https://academy.secnet.work/courses/security-audit-evidence - Practical Control Testing and Audit Analytics: https://academy.secnet.work/courses/audit-control-testing - Security Leadership & Governance: https://academy.secnet.work/courses/security-leadership ### Practical work Build a risk register, sourced legal-scope matrix and three investment options with uncertainty and accountable acceptance. - [ ] Law, guidance and internal policy are distinguished. - [ ] Impact, likelihood and cost assumptions are explicit. - [ ] Decision owners and review dates are specified. ### Workpaper Scope and assumptions: Observations, inputs and test outcomes: Decision and rejected alternative: Evidence ID, version and date: Limitations and retest: Independent review note: ## Security engineering for AI systems Weeks 21–24 / 96 hours Assure data, models and agent actions with independent authorisation and release tests. - AI / LLM Security Fundamentals: https://academy.secnet.work/courses/ai-llm-security - RAG Security and AI Application Controls: https://academy.secnet.work/courses/ai-rag-security-engineering - ISO/IEC 27090:2026 AI Security Engineering: https://academy.secnet.work/courses/ai-security-27090 - LLM and Agentic AI Security Engineering: https://academy.secnet.work/courses/agentic-ai-security - Expert AI Agent Assurance and Security Evaluation: https://academy.secnet.work/courses/ai-agent-assurance-expert ### Practical work Prepare tenant-boundary, poisoned-source, tool-approval and model-change tests for a synthetic RAG/agent case. - [ ] Model-context access and real action boundaries are tested separately. - [ ] Negative tests and critical stop conditions are defined. - [ ] Version, data and evaluation limits are recorded. ### Workpaper Scope and assumptions: Observations, inputs and test outcomes: Decision and rejected alternative: Evidence ID, version and date: Limitations and retest: Independent review note: ## AI management and internal audit Weeks 25–28 / 96 hours Examine an AI impact dossier through sampling, control testing and defensible findings. - ISO/IEC 42001 AI Management System Implementation: https://academy.secnet.work/courses/ai-management-system-42001 - ISO/IEC 42005 and 23894 AI Risk and Impact Assessment: https://academy.secnet.work/courses/ai-risk-impact-42005 - ISO/IEC 42001 AI Internal Auditor Training: https://academy.secnet.work/courses/ai-aims-internal-auditor - Expert AI Regulatory and Continuous Assurance: https://academy.secnet.work/courses/ai-regulatory-assurance-expert ### Practical work Create inventory, impact assessment and internal-audit workpapers for three Atlas AI uses, including a failed control and follow-up test. - [ ] Population and sampling rationale are traceable. - [ ] Findings connect criteria, conditions and evidence. - [ ] Human impacts and counter-evidence are retained. ### Workpaper Scope and assumptions: Observations, inputs and test outcomes: Decision and rejected alternative: Evidence ID, version and date: Limitations and retest: Independent review note: ## Lead audit and board defence Weeks 29–32 / 96 hours Combine team, budget and assurance, then present options and a reasoned board recommendation. - ISO/IEC 42001 AI Lead Auditor Training: https://academy.secnet.work/courses/ai-aims-lead-auditor - Expert Security Assurance and Executive Decisions: https://academy.secnet.work/courses/security-assurance-expert - Professional Skills for Security Practitioners: https://academy.secnet.work/courses/security-soft-skills ### Practical work Capstone: a 12-month security strategy, budget/team plan, AI lead-audit report, crisis communications and one-page board decision. Link evidence from the previous seven phases; include dissent and reassessment conditions. - [ ] Three investment options are compared by cost range and impact. - [ ] Audit authority, independence and evidence limits are explicit. - [ ] Strategy, staffing, crisis and follow-up decisions are consistent. ### Workpaper Scope and assumptions: Observations, inputs and test outcomes: Decision and rejected alternative: Evidence ID, version and date: Limitations and retest: Independent review note: ## Suggested weekly allocation Allocate 40% to reading/visuals, 35% to practical work and dossiers, 15% to recall/quizzes and 10% to finals and decision defence. Increase capstone practice in the final four weeks. ## Source editions - ISO/IEC 42001:2023 — AI management system requirements (published): https://www.iso.org/standard/42001 (2026-10-19) - ISO/IEC 42005:2025 — AI system impact assessment guidance (published): https://www.iso.org/standard/42005 (2026-10-19) - ISO/IEC 23894:2023 — AI risk management guidance (published): https://www.iso.org/standard/77304.html (2026-10-19) - ISO/IEC 42006:2025 — requirements for AIMS audit and certification bodies (published): https://www.iso.org/standard/42006 (2026-10-19) - ISO/IEC 27090:2026 — AI security threats guidance (published 14 October 2026): https://www.iso.org/standard/27090 (2026-10-19) - ISO 19011:2026 — management systems auditing guidance (published): https://www.iso.org/standard/19011 (2026-10-19) - NIST AI RMF 1.0 (2023); revision underway, not a new final edition: https://www.nist.gov/itl/ai-risk-management-framework (2026-10-19) - NIST AI 600-1 (2024) — Generative AI Profile: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf (2026-10-19) - European Commission — AI Act framework and current implementation timeline: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai (2026-10-19) Independent training developed by SecNet Academy. A course certificate is not ISO certification, an accredited lead auditor credential or regulatory approval. Normative clause work requires a lawfully acquired current standard. Cases, checklists and workbooks are original Academy teaching materials, not substitutes for the standard text.