04 Build Your AI Security Lab

AI Security becomes much easier to understand when you can build, test, observe and investigate systems yourself.

In this lesson, you will prepare a reusable AI Security Lab that will support the practical activities throughout the AI Security Engineer Learning Path.

Your lab does not need to be expensive or complicated.

The goal is to create a controlled environment where you can safely practice:

AI application security
LLM security testing
API security
RAG security
AI agent security
Cloud security
Identity and access testing
Container security
Logging and investigation
Threat modeling
AI security automation
Security documentation

By the end of this lesson, you should have a practical workstation structure ready for future labs.

Learning Objectives

By completing this lesson, you should be able to:

Understand the purpose of an AI Security Lab.
Prepare a secure workstation for AI security learning.
Install the core tools required for future labs.
Create a reusable project structure.
Prepare Python and Git environments.
Understand where Docker fits into AI security.
Prepare tools for API testing.
Understand options for running local AI models.
Prepare for future cloud-based AI labs.
Create a documentation and evidence structure.
Follow safe and ethical testing boundaries.
Validate that your lab environment is ready.

Why Build a Dedicated Lab?

Security professionals should avoid experimenting directly in production environments.

A lab gives you a controlled environment where mistakes become learning opportunities rather than incidents.

You can:

Build
  ↓
Break
  ↓
Observe
  ↓
Investigate
  ↓
Fix
  ↓
Repeat

This cycle is extremely valuable.

For example, later you may intentionally create an insecure AI application to understand:

Why prompt injection works
How insecure API permissions create risk
How sensitive data can leak
How excessive AI agent permissions become dangerous
How logs can reveal suspicious behavior

You can then implement security controls and observe the difference.

Your AI Security Lab Architecture

Your initial environment can be simple.

Your Workstation
      │
      ├── Visual Studio Code
      │
      ├── Git
      │
      ├── Python
      │
      ├── Docker
      │
      ├── API Testing Tools
      │
      ├── Browser
      │
      ├── Local AI Tools
      │
      └── Security Utilities
              │
              ▼
       AI Security Labs
              │
              ├── LLM Applications
              ├── APIs
              ├── RAG
              ├── AI Agents
              ├── Containers
              ├── Cloud Services
              └── Security Logs

You will expand this environment gradually.

Do not install every security tool you have heard about.

Start with the tools required for learning.

Mission Information

Mission: Build Your AI Security Lab

Difficulty: Beginner

Estimated Time: 45–90 minutes

Primary Goal: Prepare a safe and reusable environment for AI Security Engineer labs.

Environment: Windows, macOS or Linux

Cost: Most components can be built using free tools.

Recommended Workstation

You can complete many labs using a normal modern computer.

A practical starting point is:

Component	Recommended
CPU	Modern multi-core processor
RAM	8 GB minimum, 16 GB recommended
Storage	At least 20–40 GB free
Operating System	Windows, Linux or macOS
Internet	Required for cloud/API labs
Browser	Modern browser
Virtualization	Recommended

For running larger AI models locally, additional RAM or GPU resources may help.

However:

You do not need an expensive GPU to begin learning AI Security.

Many security concepts can be practiced with lightweight local models, APIs, containers and intentionally vulnerable applications.

Step 1 — Create Your Lab Directory

Create one central directory for your AI Security work.

Windows

Open PowerShell:

mkdir C:\AI-Security-Lab
cd C:\AI-Security-Lab

Linux or macOS

mkdir -p ~/AI-Security-Lab
cd ~/AI-Security-Lab

Create the initial structure:

AI-Security-Lab/
│
├── 01-Projects/
├── 02-Labs/
├── 03-Tools/
├── 04-Scripts/
├── 05-Logs/
├── 06-Evidence/
├── 07-Threat-Models/
├── 08-Runbooks/
└── 09-Notes/

This structure can evolve as your learning progresses.

Why This Structure Matters

Professional security work generates more than commands.

You may eventually create:

Screenshots
Security findings
API responses
Architecture diagrams
Logs
Threat models
Python scripts
Investigation notes
Runbook outputs
Remediation reports

Organizing evidence from the beginning develops good professional habits.

Step 2 — Install Visual Studio Code

Visual Studio Code can serve as your primary workspace for:

Python
JSON
YAML
Markdown
Docker files
API payloads
Configuration files
Git repositories
Security notes

After installation, consider extensions for:

Python
Docker
YAML
Markdown
Git

Avoid installing unnecessary extensions.

Each extension increases complexity and potentially expands your local software attack surface.

Step 3 — Install Git

Git will be useful throughout the learning path.

You can use it to:

Download lab repositories
Track configuration changes
Maintain scripts
Build your portfolio
Document projects
Compare versions

Validate installation:

git --version

You should see a version number.

Configure Git Identity

If this is your personal learning environment:

git config --global user.name "Your Name"
git config --global user.email "your-email@example.com"

Check the configuration:

git config --global --list

Never store passwords, API keys or access tokens directly inside Git repositories.

Step 4 — Install Python

Python is one of the most useful languages across both AI and cybersecurity.

You will use Python for activities such as:

Calling AI APIs
Working with JSON
Automating security tasks
Parsing logs
Building small AI applications
Testing security scenarios
Processing data

Validate Python:

python --version

or:

python3 --version

You should see a supported Python version.

Step 5 — Understand Python Virtual Environments

Avoid installing every Python package globally.

Use virtual environments for individual projects.

Create one:

python -m venv .venv

Windows PowerShell

.\.venv\Scripts\Activate.ps1

Linux or macOS

source .venv/bin/activate

When activated, your terminal should indicate that .venv is being used.

Upgrade pip:

python -m pip install --upgrade pip

Why Virtual Environments Matter

Different AI projects may require different package versions.

Without isolation:

Project A
   │
   └── Package Version 1

Project B
   │
   └── Package Version 2

may conflict.

Virtual environments isolate dependencies.

This is not only a development practice.

It is also useful for reproducibility and security.

Step 6 — Create a Simple Python Validation Script

Inside:

04-Scripts/

create:

environment_check.py

Add:

import platform
import sys

print("AI Security Lab Environment")
print("---------------------------")
print(f"Operating System: {platform.system()}")
print(f"Python Version: {sys.version}")
print("Environment validation completed.")

Run:

python environment_check.py

Expected result:

AI Security Lab Environment
---------------------------
Operating System: ...
Python Version: ...
Environment validation completed.

Your Python environment is working.

Step 7 — Install Docker

Docker will become useful for running isolated lab applications.

You may later use containers for:

Vulnerable AI applications
LLM security labs
APIs
Databases
Vector databases
Logging platforms
Supporting services

Validate installation:

docker --version

Then:

docker run hello-world

If the test completes successfully, Docker is ready.

Why Docker Matters for AI Security

Imagine a lab needs:

AI Application
     +
API
     +
Vector Database
     +
Supporting Service

Installing each manually can become difficult.

Docker allows the environment to be defined as containers.

For example:

Docker Host
   │
   ├── AI Application Container
   ├── API Container
   ├── Database Container
   └── Logging Container

After completing a lab, you can remove the environment and rebuild it later.

This improves:

Repeatability
Isolation
Cleanup
Troubleshooting

Step 8 — Install an API Testing Tool

Modern AI systems depend heavily on APIs.

You should become comfortable inspecting requests and responses.

Common options include:

Postman
Bruno
Insomnia
curl

You do not need all of them.

Choose one graphical client and learn curl as well.

Validate curl

Run:

curl --version

You should see version information.

Why API Skills Matter

A typical AI application may communicate like:

Application
     │
     │ HTTPS
     ▼
AI API
     │
     ▼
Model

Security issues may exist in:

Authentication
Authorization
Headers
Tokens
Input validation
Output handling
Rate limits
API permissions
Error handling

Understanding API traffic is therefore an essential AI Security Engineer skill.

Step 9 — Understand JSON

Most AI APIs exchange data using JSON.

A request may resemble:

{
  "model": "example-model",
  "messages": [
    {
      "role": "user",
      "content": "Explain least privilege."
    }
  ]
}

A response might resemble:

{
  "result": "Least privilege means..."
}

You should become comfortable:

Reading JSON
Editing JSON
Identifying nested objects
Understanding arrays
Recognizing input and output fields

This will make later API security labs much easier.

Step 10 — Prepare a Browser for Security Testing

Your browser is also an important testing tool.

Become familiar with browser developer tools.

Typically open them using:

F12

or:

Ctrl + Shift + I

Important areas include:

Network

Observe:

API requests
HTTP methods
Response codes
Headers
Request bodies
Responses

Application / Storage

Observe:

Cookies
Local storage
Session storage

Console

Observe:

Client-side errors
JavaScript output
Debug information

Do not modify or test systems without authorization.

Step 11 — Prepare an API Request Workspace

Create:

01-Projects/API-Testing/

Inside it, you can later store:

requests/
responses/
notes/
examples/

Never save live credentials or API keys inside files intended for source control.

Step 12 — Learn Environment Variables

AI applications frequently require API credentials.

Instead of hardcoding:

api_key = "my-secret-key"

applications should use safer mechanisms such as environment variables or managed secret stores.

Example concept:

Application
     │
     ▼
Environment Variable
     │
     ▼
API Credential

In future labs, you will learn how credentials are securely handled.

Step 13 — Create a `.gitignore`

In the root of your lab repository, create:

.gitignore

Example:

.venv/
.env
.env.*
__pycache__/
*.log
secrets/
credentials/
*.pem
*.key

This helps reduce the risk of accidentally committing sensitive files.

However:

.gitignore is not a security control by itself.

Always review your files before committing.

Step 14 — Understand `.env` Files

Many applications use .env files.

Example:

AI_API_KEY=example
DATABASE_PASSWORD=example

Treat these files as sensitive.

They should generally not be committed to a public repository.

Your repository can instead contain:

.env.example

Example:

AI_API_KEY=
DATABASE_PASSWORD=

This documents required configuration without exposing credentials.

Step 15 — Prepare for Local AI Models

You may later want to run models locally.

Local models can be useful for:

Learning
Testing prompts
Building experimental applications
Security research
Offline testing
Understanding model interactions

Possible local AI environments may include tools that allow you to download and run compatible models on your workstation.

The specific platform is less important than understanding the architecture.

User
 │
 ▼
Local Application
 │
 ▼
Local Model Runtime
 │
 ▼
LLM

Running locally can reduce dependency on external APIs for some labs.

However, local models still require security considerations such as:

Model provenance
Dependency security
Resource usage
Data handling
Model files
Application security

Step 16 — Understand Cloud AI Labs

Some later AI security exercises may require cloud platforms.

An enterprise architecture may use:

Cloud Account
    │
    ├── Identity
    ├── Storage
    ├── Networking
    ├── AI Service
    ├── Database
    ├── Logging
    └── Security Monitoring

You do not need to configure all cloud platforms now.

When required, individual labs will explain the necessary setup.

Cloud Cost Warning

Cloud environments may generate charges.

Before creating resources:

Read the entire lab.
Understand which services are required.
Check current pricing.
Use free or low-cost options where possible.
Delete resources after completing the exercise.

Never leave lab infrastructure running unnecessarily.

Step 17 — Prepare a Cloud Lab Folder

Create:

02-Labs/Cloud/

Later you can organize cloud exercises such as:

Cloud/
├── IAM/
├── AI-Services/
├── Logging/
├── Containers/
└── Incident-Response/

Step 18 — Prepare Security Testing Utilities

As you progress, you may encounter tools for:

HTTP inspection
API testing
Code analysis
Dependency analysis
Container analysis
LLM testing
Logging
Cloud assessment

Do not install everything immediately.

A good engineering rule is:

Install a tool when you understand why you need it.

For every tool, ask:

What problem does it solve?

What permissions does it require?

Where did it come from?

Is the source trusted?

What data can it access?

How do I remove it?

This is especially important for security tools downloaded from public repositories.

Step 19 — Create Your Evidence Structure

Inside:

06-Evidence/

create folders such as:

06-Evidence/
├── Screenshots/
├── Logs/
├── Findings/
├── Reports/
└── Validation/

For every lab, try to capture enough evidence to demonstrate what occurred.

Evidence Example

Suppose you identify an overly permissive AI service account.

Your evidence might include:

Finding:
AI service account has excessive permissions.

Evidence:
Screenshot of assigned role.

Validation:
Demonstration that the account can access an unrelated resource.

Risk:
Compromise of the application could expose additional resources.

Recommendation:
Apply least privilege.

This transforms a technical observation into a professional security finding.

Step 20 — Create Your Threat Modeling Folder

Create:

07-Threat-Models/

You may later store:

Architecture diagrams
Data flow diagrams
Asset inventories
Trust boundaries
Threat lists
Attack paths
Security controls

A threat model might eventually include:

User
 │
 │ Untrusted Input
 ▼
AI Application
 │
 │ API Call
 ▼
LLM
 │
 ├── Vector Database
 ├── Enterprise Data
 └── Agent Tools

Then you begin asking:

Where are the trust boundaries?

Where can input be manipulated?

Where can sensitive data leak?

What permissions exist?

Step 21 — Prepare Your Runbook Folder

Create:

08-Runbooks/

Later, this may contain runbooks such as:

LLM-Security-Investigation.md

AI-Incident-Response.md

RAG-Security-Assessment.md

AI-Agent-Security-Review.md

These help develop operational thinking.

Step 22 — Build Your Lab Notes Template

Inside:

09-Notes/

create:

Lab-Template.md

Use:

# Lab Name

## Mission

## Objective

## Environment

## Architecture

## Tools Used

## Steps Performed

## Observations

## Security Findings

## Evidence

## Remediation

## Validation

## What I Learned

## Questions for Further Investigation

Copy this template for future labs.

Step 23 — Prepare a Findings Template

Create:

Finding-Template.md

Use:

# Security Finding

## Finding Title

## Severity

## Affected Asset

## Description

## Evidence

## Security Impact

## Attack Scenario

## Recommendation

## Validation

## References

This introduces professional reporting habits early.

Step 24 — Create a README

Inside your main lab folder, create:

README.md

Example:

# AI Security Lab

Personal learning environment for AI Security Engineering.

## Areas

- AI Security
- LLM Security
- RAG Security
- AI Agent Security
- Cloud Security
- Threat Modeling
- AI Red Teaming
- Security Operations

## Purpose

This repository contains hands-on learning exercises,
security notes, threat models and projects created while
developing AI Security Engineering skills.

Do not add personal credentials or sensitive data.

Step 25 — Understand the Safe Testing Boundary

This is one of the most important parts of the lab.

Security testing should be performed only against:

Systems you own
Your own lab applications
Intentionally vulnerable training environments
Systems where you have explicit authorization
Approved security testing environments

Do not assume that a publicly accessible system is authorized for security testing.

Public access does not equal permission.

Your Testing Boundary

Think of your environment as:

AUTHORIZED
────────────────────────────
Your Lab
Your Containers
Your Test APIs
Your Cloud Sandbox
Approved Training Targets
Systems With Written Permission
────────────────────────────

NOT AUTHORIZED
────────────────────────────
Random Websites
Public AI Services
Other People's APIs
Company Systems Without Approval
External Cloud Accounts
Unknown Internet Targets
────────────────────────────

Always stay inside the authorized boundary.

Step 26 — Protect Your Credentials

AI labs may eventually use:

API keys
Cloud credentials
Tokens
SSH keys
Service accounts

Treat all of them as secrets.

Never:

Paste credentials into screenshots
Commit them to Git
Share them in public repositories
Store them in documentation
Post them in forums
Reuse production credentials

Prefer dedicated lab credentials with minimal permissions.

Step 27 — Separate Lab and Production Accounts

Where possible:

Production Account
       ≠
Learning Lab Account

A separate sandbox reduces the impact of mistakes.

For example:

Personal Learning Cloud Account
        │
        ├── Lab IAM Users
        ├── Lab Resources
        ├── Lab Logs
        └── Temporary Experiments

Do not use an employer’s production environment for personal training.

Step 28 — Apply Least Privilege to Your Lab

Even a lab should reinforce good security practices.

Instead of granting:

Administrator Access

everywhere, try to understand what permissions are actually required.

This helps you learn IAM while improving your lab security.

Step 29 — Keep Your Environment Updated

Security tools and AI frameworks change rapidly.

Periodically review:

Operating system updates
Python packages
Docker
Browser
IDE
Security tools
AI libraries

But do not blindly update the night before an important lab.

Updates can introduce compatibility changes.

Understand what changed.

Step 30 — Create a Lab Snapshot Strategy

Before major experiments, preserve important files.

You may use:

Git commits
Virtual machine snapshots
Container images
Configuration backups
Cloud Infrastructure as Code

A useful pattern is:

Known Good Environment
        ↓
Save State
        ↓
Perform Experiment
        ↓
Break Something
        ↓
Investigate
        ↓
Restore If Required

This makes experimentation safer.

Step 31 — Validate Your Lab

Use this checklist.

Workstation

Operating system ready
Sufficient storage available
Browser installed

Development Environment

Visual Studio Code installed
Git installed
Python installed
Python virtual environment tested

Container Environment

Docker installed
Docker test container runs successfully

API Environment

curl available
API testing client available
Basic JSON understood

Security Environment

Lab directories created
Evidence folders created
Threat modeling folder created
Runbook folder created
Notes template created
Findings template created

Security Hygiene

.gitignore created
Secrets excluded from Git
Lab credentials separated where possible
Testing boundaries understood

If these are complete, your core environment is ready.

Recommended Lab Structure

Your final structure may resemble:

AI-Security-Lab/
│
├── README.md
├── .gitignore
│
├── 01-Projects/
│
│   └── API-Testing/
│
├── 02-Labs/
│   └── Cloud/
│
├── 03-Tools/
│
├── 04-Scripts/
│   └── environment_check.py
│
├── 05-Logs/
│
├── 06-Evidence/
│   ├── Screenshots/
│   ├── Logs/
│   ├── Findings/
│   ├── Reports/
│   └── Validation/
│
├── 07-Threat-Models/
│
├── 08-Runbooks/
│
└── 09-Notes/
    ├── Lab-Template.md
    └── Finding-Template.md

You do not need to fill every directory immediately.

The structure is there so the lab can grow with you.

How This Lab Will Evolve

At the beginning:

Workstation
+
Python
+
Git
+
Docker

Later:

AI Applications
+
LLM APIs
+
RAG
+
Vector Databases

Then:

AI Agents
+
Cloud Infrastructure
+
Security Monitoring
+
Threat Modeling

Eventually:

Enterprise AI Security Environment

The lab grows as your skills grow.

Security Engineer Habit

Every time you add a new component to your environment, ask:

What is this?

Why do I need it?

What data does it access?

What privileges does it require?

What attack surface does it create?

How is it updated?

How would I detect misuse?

How would I remove it?

That simple habit is already AI Security Engineering thinking.

What You Should Have Learned

You should now understand that your AI Security Lab is more than a collection of tools.

It is an environment for practicing the complete security lifecycle:

Build
   ↓
Understand
   ↓
Threat Model
   ↓
Secure
   ↓
Test
   ↓
Observe
   ↓
Investigate
   ↓
Remediate
   ↓
Document

This environment will become the foundation for your labs and enterprise projects throughout the learning path.

Lab Readiness Check

Before moving forward, make sure you can answer:

Where will I store my labs?

Where will I store evidence?

How will I isolate Python dependencies?

How will I run containerized applications?

How will I test APIs?

How will I protect API keys?

How will I document findings?

What systems am I authorized to test?

If you can answer these questions, your lab has a solid foundation.

What’s Next?

➡️ 05 — Responsible and Ethical AI Security Testing

Before beginning technical AI security modules, one final foundation is required:

authorization and responsible security testing.

In the next lesson, you will learn:

Why authorization matters
How security testing scope works
Rules of engagement
Responsible AI red teaming
Safe testing boundaries
Data handling requirements
Testing third-party AI systems
Vulnerability disclosure
Evidence handling
Professional security ethics

This will establish the boundaries within which all future AI security labs and assessments should operate.

➡️ Next: 05 — Responsible and Ethical AI Security Testing

04 Build Your AI Security Lab

Learning Objectives

Why Build a Dedicated Lab?

Your AI Security Lab Architecture

Mission Information

Recommended Workstation

Step 1 — Create Your Lab Directory

Windows

Linux or macOS

Why This Structure Matters

Step 2 — Install Visual Studio Code

Step 3 — Install Git

Configure Git Identity

Step 4 — Install Python

Step 5 — Understand Python Virtual Environments

Windows PowerShell

Linux or macOS

Why Virtual Environments Matter

Step 6 — Create a Simple Python Validation Script

Step 7 — Install Docker

Why Docker Matters for AI Security

Step 8 — Install an API Testing Tool

Validate curl

Why API Skills Matter

Step 9 — Understand JSON

Step 10 — Prepare a Browser for Security Testing

Network

Application / Storage

Console

Step 11 — Prepare an API Request Workspace

Step 12 — Learn Environment Variables

Step 13 — Create a .gitignore

Step 14 — Understand .env Files

Step 15 — Prepare for Local AI Models

Step 16 — Understand Cloud AI Labs

Cloud Cost Warning

Step 17 — Prepare a Cloud Lab Folder

Step 18 — Prepare Security Testing Utilities

Step 19 — Create Your Evidence Structure

Evidence Example

Step 20 — Create Your Threat Modeling Folder

Step 21 — Prepare Your Runbook Folder

Step 22 — Build Your Lab Notes Template

Step 23 — Prepare a Findings Template

Step 24 — Create a README

Step 25 — Understand the Safe Testing Boundary

Your Testing Boundary

Step 26 — Protect Your Credentials

Step 27 — Separate Lab and Production Accounts

Step 28 — Apply Least Privilege to Your Lab

Step 29 — Keep Your Environment Updated

Step 30 — Create a Lab Snapshot Strategy

Step 31 — Validate Your Lab

Workstation

Development Environment

Container Environment

API Environment

Security Environment

Security Hygiene

Recommended Lab Structure

How This Lab Will Evolve

Security Engineer Habit

What You Should Have Learned

Lab Readiness Check

What’s Next?

Step 13 — Create a `.gitignore`

Step 14 — Understand `.env` Files