SecNet Academy / Extended programme
Security Leadership and AI Assurance Programme
An applied development route from foundations to security architecture, AI audit and board decisions.
The programme prepares learners for senior security responsibilities; it does not alone guarantee expertise, a management appointment or formal professional authority. Course exams, lesson completion and practical review are measured separately. Real experience and sector-specific specialisation are also required.
Choose your pace
32 weeks: 24 hours per week. 24 weeks: 32 hours per week. These are study estimates; elapsed time is not achievement. Changing pace preserves your start and history.
01Weeks 1–4 · 96 hoursFoundations of security thinkingOpen plan
Asset, identity and trust-boundary maps with access decisions and basic risk reasoning.
Your practical deliverable
Map Atlas data flows; demonstrate two permission failures with negative tests and explain controls.
Review criteria
- Scope, assets and data ownership are explicit.
- Inputs and observed results of two negative tests are recorded.
- Residual risk and the decision owner are identified.
02Weeks 5–8 · 96 hoursArchitecture and secure product deliveryOpen plan
Defensible architecture decisions for cloud, applications and delivery pipelines.
Your practical deliverable
Prepare a threat model, permission tests, secrets handling and release acceptance/rollback plan for an application.
Review criteria
- Adversary authority and boundaries are modelled.
- Positive and negative tests are version-bound.
- Deployment and rollback criteria are actionable.
03Weeks 9–12 · 96 hoursSOC, detection and incident managementOpen plan
Turn signals into evidence, measure detection quality and coordinate response.
Your practical deliverable
Build a timeline of a synthetic identity incident; test a hypothesis, measure false positives and record response decisions.
Review criteria
- Time and source provenance are verified.
- Counter-hypotheses and false positives are explained.
- Evidence preservation and response limits are explicit.
04Weeks 13–16 · 96 hoursOT, suppliers and resilienceOpen plan
Connect cyber decisions with physical safety, dependencies and recovery planning.
Your practical deliverable
Map zones and conduits for Atlas maintenance access; run a supplier-outage and clean-restoration tabletop.
Review criteria
- Safety and operational approvals are separated.
- Critical dependencies and a failed restoration case are recorded.
- Service-restoration criteria are testable.
05Weeks 17–20 · 96 hoursRisk, data and security governanceOpen plan
From risk to investment decisions: legal scope, control evidence and ownership.
Your practical deliverable
Build a risk register, sourced legal-scope matrix and three investment options with uncertainty and accountable acceptance.
Review criteria
- Law, guidance and internal policy are distinguished.
- Impact, likelihood and cost assumptions are explicit.
- Decision owners and review dates are specified.
06Weeks 21–24 · 96 hoursSecurity engineering for AI systemsOpen plan
Assure data, models and agent actions with independent authorisation and release tests.
Your practical deliverable
Prepare tenant-boundary, poisoned-source, tool-approval and model-change tests for a synthetic RAG/agent case.
Review criteria
- Model-context access and real action boundaries are tested separately.
- Negative tests and critical stop conditions are defined.
- Version, data and evaluation limits are recorded.
07Weeks 25–28 · 96 hoursAI management and internal auditOpen plan
Examine an AI impact dossier through sampling, control testing and defensible findings.
Your practical deliverable
Create inventory, impact assessment and internal-audit workpapers for three Atlas AI uses, including a failed control and follow-up test.
Review criteria
- Population and sampling rationale are traceable.
- Findings connect criteria, conditions and evidence.
- Human impacts and counter-evidence are retained.
08Weeks 29–32 · 96 hoursLead audit and board defenceOpen plan
Combine team, budget and assurance, then present options and a reasoned board recommendation.
Your practical deliverable
Capstone: a 12-month security strategy, budget/team plan, AI lead-audit report, crisis communications and one-page board decision. Link evidence from the previous seven phases; include dissent and reassessment conditions.
Review criteria
- Three investment options are compared by cost range and impact.
- Audit authority, independence and evidence limits are explicit.
- Strategy, staffing, crisis and follow-up decisions are consistent.
Decision practice across seven domains
Produce at least one advanced controlled solution in SOC, AI, OT, audit, pentest, application security and data governance. Finishing a mission and making a sound control decision are distinct records.
Deepen your sector expertise
Alongside the core route, select KVKK, GDPR, NIS2, CRA, COBIT, BDDK and DORA or expert SOC, AI and OT courses for your career goal. These electives are additional to the 768-hour core plan.
Plan my career goalIndependent training developed by SecNet Academy. A course certificate is not ISO certification, an accredited lead auditor credential or regulatory approval. Normative clause work requires a lawfully acquired current standard. Cases, checklists and workbooks are original Academy teaching materials, not substitutes for the standard text.