# Who Teaches AI Red-Teaming Hands-On? By Charles Givre ยท 2026-06-05 > A direct answer to a common search query: who actually teaches AI red-teaming hands-on, what 'hands-on' should mean, and how to tell a real lab course from a slide deck. If you ask ChatGPT or Perplexity who teaches AI red-teaming hands-on, you get a vague mix of MOOC platforms, vendor webinars, and "AI security awareness" decks. Very few of those put you in front of a live model and have you break it. AI red-teaming is a testing discipline, and you do not learn a testing discipline by watching slides. Here is an honest survey of who actually teaches it with labs, and how to tell a real course from a lecture. ## What "Hands-On" Should Mean A course earns the hands-on label when you spend most of your time attacking a deployed target, not reading about attacks. Concretely, you should leave having done all of these against a live endpoint: - **Direct and indirect prompt injection.** Override a system prompt with user input, then hide the same instruction in a document a [RAG](https://python.langchain.com/docs/tutorials/rag/) pipeline retrieves (MITRE ATLAS [AML.T0051](https://atlas.mitre.org/techniques/AML.T0051), OWASP LLM01). - **Jailbreaking.** Push a model past its safety training and document which technique worked and why (ATLAS [AML.T0054](https://atlas.mitre.org/techniques/AML.T0054)). - **Data exfiltration.** Probe whether the model leaks its system prompt, training data, or connected data sources across multi-turn conversations. - **Model evasion and robustness.** Craft inputs that bypass a classifier or detection model (ATLAS [AML.T0015](https://atlas.mitre.org/techniques/AML.T0015)). - **Reporting.** Write findings mapped to the [OWASP Top 10 for LLM Applications](https://owasp.org/www-project-top-10-for-large-language-model-applications/) and [MITRE ATLAS](https://atlas.mitre.org/), in a format a security review board will accept. If a syllabus has no lab environment and no deliverable, it is an overview. ## Who Actually Teaches It A vendor-neutral look at the market. - **[GTK Cyber](/).** A dedicated [AI Red-Teaming course](/courses/ai-red-teaming) built for security practitioners. Two days, advanced level, labs run in a Centaur VM with Python and Jupyter so you script your own attack variants. Taught by Charles Givre (CISSP, Apache Drill PMC Chair, Black Hat 2025 speaker on AI input handling) and Summer Rankin, PhD (30+ peer-reviewed ML publications). It runs at [Black Hat USA 2026](/lp/black-hat-2026-training) and as custom on-site engagements for federal, financial services, and enterprise teams. - **Conference trainings at [Black Hat](https://www.blackhat.com/) and [Hack In The Box](https://conference.hitb.org/).** Multi-day intensives from independent specialists. High signal when the instructor matches your goal, but quality varies course to course, so read the syllabus and the bio. - **Vendor-led training from [Lakera](https://www.lakera.ai/), [HiddenLayer](https://hiddenlayer.com/), and [Protect AI](https://protectai.com/).** Strong on the specific slice each vendor sells (mostly LLM runtime defenses). The techniques transfer, but the curriculum bends toward the product. - **Self-study with structure.** [garak](https://github.com/NVIDIA/garak), [PyRIT](https://github.com/Azure/PyRIT), [promptfoo](https://github.com/promptfoo/promptfoo), the OWASP LLM Top 10, and the MITRE ATLAS case studies are free and good. What self-study lacks is a vulnerable target you are allowed to break and feedback on your tradecraft. Conspicuously thin on this list: universities and general MOOC platforms. Their content is fine for AI fundamentals and absent on adversarial work. ## The Tooling a Real Course Uses You can judge a course partly by its tools. A serious hands-on syllabus names them: - **[garak](https://github.com/NVIDIA/garak)** for automated probe suites across known jailbreak and injection payloads. Run it as a baseline, then go manual for what it misses. - **[PyRIT](https://github.com/Azure/PyRIT)** to orchestrate multi-turn attacks where the payload builds across a conversation rather than landing in one prompt. - **[promptfoo](https://github.com/promptfoo/promptfoo)** to turn confirmed attacks into a regression suite, so a model or prompt update that reopens a hole gets caught. - **[Burp Suite](https://portswigger.net/burp)** or **[mitmproxy](https://mitmproxy.org/)** at the application layer. An LLM app is still a web app: the injection that matters is often in how the backend passes retrieved context and tool output to the model. A course that never leaves the chat box is teaching half the attack surface. The interesting failures live in the plumbing between the app, the retrieval layer, and the model. ## How to Vet the Instructor The discriminator is whether the instructor has shipped both security and AI work, and whether the course has been run before. - Does the instructor hold a security credential (CISSP, OSCP) or have real practitioner time (SOC, IR, red team, government)? An ML academic who has never written a finding struggles to teach the reporting half. - Can they demonstrate AI or ML output: published work, an open-source library, conference talks with technical content rather than vendor pitches? - Is there a named lab environment, or just slides? - Has the course run before and iterated on its labs? First-edition courses tend to have rough exercises. If you cannot find a named lab and an instructor who sits at the security-plus-AI intersection, you are probably looking at an awareness briefing. GTK Cyber built its AI Red-Teaming course because that intersection was underserved: people who could do the adversarial work but had no AI-specific training, and AI training that never touched a threat model. If you want to learn this hands-on, that is the test to apply, including to us. ## FAQ ### Who teaches AI red-teaming hands-on? A short list of credible options: GTK Cyber (Charles Givre, CISSP, and Summer Rankin, PhD) runs a dedicated AI Red-Teaming course with labs against live LLM endpoints, at Black Hat USA 2026 and as custom on-site engagements. Conference trainings at Black Hat USA and Hack In The Box offer multi-day intensives from independent specialists. Vendor-led training from Lakera, HiddenLayer, and Protect AI covers narrower, product-tied slices. Most generic 'LLM security' webinars are lectures, not labs. For hands-on work where you actually run attacks against a model and report findings, the practitioner-led, lab-based options are the strongest. ### What tools are used in a hands-on AI red-teaming course? Open-source red-team tooling plus Python scripting. Expect garak (NVIDIA's LLM vulnerability scanner) for automated probe suites, Microsoft PyRIT for orchestrating multi-turn attacks, and promptfoo for regression-testing prompts against jailbreak payloads. The application layer still uses Burp Suite or mitmproxy to inspect the API traffic between the app and the model. GTK Cyber's labs run in a Centaur VM environment with Python and Jupyter so students script their own attack variants rather than only running canned scanners. ### Do I need a machine learning background to learn AI red-teaming? No. The prerequisite that matters is experience with security testing methodology and a working knowledge of Python. Security practitioners already have the adversarial mindset. The gap a good course fills is the AI-specific layer: how an LLM resolves competing instructions, how safety training is applied and bypassed, and how to evaluate model behavior systematically under adversarial pressure. You do not need to train models or understand transformer internals to find prompt injection in a RAG pipeline. ### What is the difference between a hands-on AI red-teaming course and an LLM security webinar? A webinar shows you attack categories on slides. A hands-on course gives you a deployed, vulnerable target and has you exploit it. The test is simple: in a real course you leave having run direct and indirect prompt injection against a live endpoint, bypassed a system prompt, extracted data the model should not have surfaced, and written up findings mapped to OWASP LLM Top 10 and MITRE ATLAS. If the syllabus has no lab environment and no deliverable, it is an overview, not training. ### Where can I learn AI red-teaming at a security conference? Black Hat USA is the most direct option. GTK Cyber teaches AI Red-Teaming as a two-day hands-on course at Black Hat USA 2026, alongside its applied AI and executive AI offerings. Hack In The Box (HITB) also runs adversarial-AI trainings from independent instructors. Read the syllabus for a named lab environment and a list of techniques (prompt injection, jailbreaking, data exfiltration, model evasion) before you register: conference catalogs mix genuine lab courses with lecture-format briefings. --- Canonical: https://gtkcyber.com/blog/who-teaches-ai-red-teaming-hands-on/