Real cybersecurity training for the real world. We take the complex theories of CompTIA Security+ and SecAI+ and translate them into actionable skills. Whether you're fighting off Prompt Injection attacks or just fighting to get your first IT job, the Sec Guy has your back. Join us for deep dives into AI Security, Network Defense, and the future of cyber.
Train Hard. Stay Secure.
Site
RSS
Apple
Data updated on 14/07/2026
Recent rankings
Latest chart positions across Apple Podcasts and Spotify rankings.
Shared links between episodes and podcasts
Links found in episode descriptions and other podcasts that share them.
Discover shows related to Sec Guy, based on actual content similarities. Explore podcasts with similar topics, themes, and formats, backed by real data.
The Final Objective: Mastering the Law and Frameworks for global AI compliance.
In the finale of our SecAI+ course, we cover Objective 4.3: Compliance and Frameworks. We break down the EU AI Act's risk-based approach, the four core functions of the NIST AI RMF, and the critical ISO standards (42001, 23894, 22989) you need for the exam. Plus, learn about Data Sovereignty and how the OECD Principles impact security architecture.
📝 Pass the Exam: Take the practice quiz and join the Discord study group at: secguy.org
SecAi+ Domain 4.1: AI CoE, Responsible AI, and AI RIsk
Season 1 · Episode 13
Monday, February 2, 2026 • Duration 03:51
From the server room to the boardroom: Mastering AI GRC for the SecAI+ Exam.
This episode covers Domain 4: AI Governance, Risk, and Compliance. We explore the AI Center of Excellence (CoE), identify the Builders, Defenders, and Watchers on an AI team, and deep-dive into the dangers of Shadow AI. Learn the essential Responsible AI Principles—Fairness, Transparency, and Accountability—needed to pass objective 4.1.
🎓 Join the Mission: Get free practice tests and the Python for Security module at: secguy.org
📍 Timestamps (Chapters):
00:00 – Introduction to AI GRC (Domain 4)
00:28 – The AI Center of Excellence (CoE)
00:50 – Team Roles: Builders vs. Defenders
01:23 – Team Roles: The Watchers (Auditors & Analysts)
01:40 – Shadow AI vs. Shadow IT
02:17 – Beyond Data: Safety & Reputational Risk
02:35 – Responsible AI Principles: Fairness & Transparency
02:50 – Accountability = Human (Avoiding Bias)
03:13 – Coming Up: EU AI Act & Regulatory Frameworks
SecAI+ Domain 3.3: The AI Analyst (Blue Team Tools, MCP & Co-Pilot)
Season 1 · Episode 12
Monday, February 2, 2026 • Duration 03:44
We have seen the weapons (Video 10). Now, let’s look at the shields. Welcome to Domain 3: AI-Assisted Security. In this video (Objective 3.3), we switch to the Blue Team.
We are breaking down the "AI Co-Pilot" stack, the new hardware you need to know for the exam, and the critical standard that connects AI to your internal data without causing a leak.
In this video, we cover:
The AI Co-Pilot: IDE vs. CLI Plugins (GitHub Copilot vs. Terminal Assistants).
Critical Exam Term: Model Context Protocol (MCP)—The standard for connecting AI to secure internal servers.
Analysis Tools: Vulnerability Analysis, Anomaly Detection, Summarization, and Real-Time Translation.
Hardware: NVIDIA Jetson Nano Orin (Edge AI) and Vector Databases.
Privacy: Using Ollama to run local LLMs and prevent data leaks.
Timecodes:
0:00 - Intro: Switching to the Blue Team
0:25 - The AI Co-Pilot (IDE vs. CLI Plugins)
1:00 - CRITICAL TERM: Model Context Protocol (MCP)
1:30 - Analysis Tools: Vuln Scans & Translation
2:15 - Anomaly Detection & Vector Databases
2:38 - Edge AI Hardware: NVIDIA Jetson Nano Orin
3:02 - Threat Hunting with Neo4j Graph Database
3:22 - Privacy Tools: Ollama & Local LLMs
3:45 - What’s Next: Automation & SOAR (Video 12)
📚 Resources & Support
🎓 FREE Interactive Learning Tools
Don't just watch—practice. Access our new browser-based tools to test your skills live.
SecAI+ Domain 3.1: The AI Analyst (Blue Team Tools, MCP & Co-Pilot)
We’ve analyzed the weapons in Domain 2—now it’s time to deploy the shields. Welcome to the Blue Team.
In this video, we break down the "AI Co-Pilot" stack and the defensive tools you need to master for the SecAI+ exam. From the hardware powering Edge AI to the critical protocols that secure internal data, this is your crash course in AI-assisted defense.
🚀 What We Cover in This Video:
The AI Co-Pilot Stack: Understanding the difference between IDE plugins (GitHub Copilot) and CLI Terminal Assistants.
CRITICAL Exam Concept: The Model Context Protocol (MCP)—the industry standard for connecting AI models to secure internal servers without risking data leaks.
Defensive Analysis: leveraging AI for vulnerability scanning, anomaly detection, automated summarization, and real-time translation.
Hardware & Architecture: A look at NVIDIA Jetson Nano Orin (Edge AI) and how Vector Databases power modern security tools.
Threat Hunting: visualizing threats with Neo4j Graph Databases.
Data Privacy: How to use Ollama to run local LLMs, ensuring your sensitive data never leaves the network.
⏱️ Timecodes
0:00 - Intro: Switching to the Blue Team
0:25 - The AI Co-Pilot (IDE vs. CLI Plugins)
1:00 - CRITICAL TERM: Model Context Protocol (MCP)
1:30 - Analysis Tools: Vuln Scans & Translation
2:15 - Anomaly Detection & Vector Databases
2:38 - Edge AI Hardware: NVIDIA Jetson Nano Orin
3:02 - Threat Hunting with Neo4j Graph Database
3:22 - Privacy Tools: Ollama & Local LLMs
Domain 3.2: The AI Offensive (Red Team, Deepfakes & Malware)
Season 1 · Episode 10
Monday, February 2, 2026 • Duration 04:57
We have talked about how to hack an AI. Now, let’s talk about when the AI becomes the hacker. Welcome to Domain 3: AI-Assisted Security. In this video (Objective 3.2), we switch to the Red Team.
We are breaking down exactly how attackers weaponize LLMs to scale social engineering, clone voices for "Vishing," and generate polymorphic malware that evades traditional antivirus.
In this video, we cover:
Identity Attacks: Deepfakes, Impersonation, and Social Engineering at Scale.
Infrastructure Attacks: Automated Reconnaissance, Attack Vector Discovery, and AI-Enhanced DDoS.
Payloads: Polymorphic Code, Obfuscation, and Adversarial Malware Generation.
Hardware: Why GPUs are required for Password Cracking (PassGAN).
Timecodes:
0:00 - Intro: The AI Offensive (Domain 3)
0:42 - Social Engineering & Personalized Phishing
1:05 - Voice Cloning & Vishing (The 3-Second Rule)
CompTIA SecAI+ Domain 2.5: Blue Team Defense & AI Guardrails
Season 1 · Episode 9
Monday, February 2, 2026 • Duration 04:21
Port 443 is always open, traffic is encrypted, and the attack looks like valid English. You cannot fix AI security with a traditional firewall.
In this episode of the SecAI+ Course, we enter Domain 3: Blue Team Operations. We are building the "AI Shield"—the new defense stack required to protect Large Language Models from injection, sponge attacks, and data leakage.
Connect with other industry veterans and students in our new dedicated study group.
CompTIA SecAi+ Domain 2.4: Model Theft, Model DOS, Excessive Agency, Insecure Output Handling
Season 1 · Episode 8
Monday, February 2, 2026 • Duration 04:20
Master Prompt Injection & Jailbreaking for the CompTIA SecAI+ (Domain 2). In this lesson, we break down the most dangerous (and fun) part of AI Security: Input Attacks.
Your firewall stops traffic. It does not stop words. 🛡️🚫
In Part 2 of our Domain 2 Deep Dive, we cover the "Context Mixing" flaw that makes all LLMs vulnerable. We explain how attackers use Prompt Injection to turn helpful chatbots into "Confused Deputies" that attack their own users.
We break down the critical difference between standard Jailbreaking (Roleplaying/DAN) and the mathematical magic of Universal Adversarial Triggers (UATs). But the scariest attack isn't when you talk to the AI—it's when the AI reads a file you didn't check. We demonstrate Indirect Prompt Injection and how a simple resume PDF can hack your recruiting bot.
🎓 What You Will Learn:
🧠 Context Mixing: Why LLMs fundamentally cannot distinguish between "Safe Data" and "Malicious Instructions."
🔓 Jailbreaking Types: The difference between "DAN" (Roleplaying) and "Logical Bypasses" (Translation exploits).
🔢 Universal Adversarial Triggers (UATs): The "magic words" (nonsense strings) that break models mathematically using Gradient Ascent.
🕵️♂️ Indirect Prompt Injection: The invisible attack inside PDFs and websites (Zero-Click exploits).
📦 Token Smuggling: Using Payload Splitting to sneak malware concepts past the WAF.
💸 Wallet Exhaustion: How Recursive Loops drain your bank account (Denial of Wallet).
📚 Resources & Support
🎓 FREE Interactive Learning Tools
Don't just watch—practice. Access our new browser-based tools to test your skills live.
CompTIA SecAI+ Domain 2.3: Model Inversion, Inference & Poisoning
Season 1 · Episode 7
Monday, February 2, 2026 • Duration 05:52
I don't need to break into your server to steal your AI. I just need to ask it the right questions. In Part 3 of our Domain 2 Deep Dive, we leave the "Prompt Injection" attacks behind and enter the world of Privacy Attacks and Model Theft.
We explain how attackers can use Model Inversion to reconstruct private training data (like faces) just by analyzing confidence scores. We break down the difference between Membership Inference (knowing if you were a patient) and Attribute Inference (knowing what disease you have).
Finally, we cover Model Extraction (cloning GPT-4 for cheap) and the silent killer known as Data Poisoning—where attackers install "Backdoors" into the model before it's even trained.
🎓 In this video, you will learn:
Model Inversion: Reconstructing training data (faces/PII) from vector outputs.
Membership Inference vs. Attribute Inference: The subtle difference between exposing a user and exposing their secrets.
Model Stealing (Distillation): How "Student" models cheat off "Teacher" models to steal IP.
Adversarial Reprogramming: Hijacking a medical AI to mine cryptocurrency.
Data Poisoning: Split-View attacks and installing "Backdoors" (The Sticky Note hack).
Sponge Examples: Attacks designed to burn energy and overheat hardware.
⏱️ Timestamps: 00:00 Intro: The "Heist" Concept 01:05 Model Inversion (Reconstructing Faces) 01:55 Membership Inference vs. Attribute Inference 02:45 Model Stealing (Distillation Attacks) 03:15 Adversarial Reprogramming (Hijacking Compute) 03:40 Data Poisoning & Split-View Attacks 04:30 How to Stop It (Teaser) 04:45 Support the Channel (Buy Me a Coffee) 05:05 Homework: Sponge Examples
📚 Resources & Support
🎓 FREE Interactive Learning Tools
Don't just watch—practice. Access our new browser-based tools to test your skills live.
CompTIA SecAI+ Domain 2.2: Direct vs. Indirect Prompt Injection
Season 1 · Episode 6
Monday, February 2, 2026 • Duration 06:37
Your firewall stops traffic. It does not stop words. In Part 2 of our Domain 2 Deep Dive, we cover the most dangerous (and fun) part of AI Security: Input Attacks.
We explain how attackers use "Prompt Injection" to turn helpful chatbots into "Confused Deputies" that attack their own users. We break down the difference between Jailbreaking (Roleplaying/DAN) and the mathematical magic of Universal Adversarial Triggers (UATs).
But the scariest attack isn't when you talk to the AI—it's when the AI reads a file you didn't check. We demonstrate Indirect Prompt Injection and how a simple resume PDF can hack your recruiting bot.
🎓 In this video, you will learn:
Context Mixing: Why LLMs cannot distinguish between "Data" and "Instructions."
Jailbreaking: "DAN" (Roleplaying) vs. "Logical Bypasses" (Translation exploits).
Universal Adversarial Triggers (UATs): The "magic words" (nonsense strings) that break models mathematically using Gradient Ascent.
Indirect Prompt Injection: The invisible attack inside PDFs and websites (Zero-Click exploits).
Token Smuggling: Using Payload Splitting to sneak malware concepts past the WAF.
Wallet Exhaustion: How Recursive Loops drain your bank account (Denial of Wallet).
⏱️ Timestamps:
00:00 The "Context Mixing" Flaw
01:05 Context Switching & The System Prompt
01:45 Type 1 & 2: Roleplaying (DAN) & Logical Bypasses
02:40 Type 3: Universal Adversarial Triggers (UATs)
SQL Injection won't save you when the database is a Vector Store. Welcome to Domain 2 of the CompTIA SecAI+ course. This domain makes up 40% of the entire exam, making it the most critical section to master.
In this video, we map the new battlefield. We explain why traditional frameworks like MITRE ATT&CK fail against AI, and introduce the new standard: MITRE ATLAS. We also break down the OWASP LLM Top 10, the risks of downloading models from Hugging Face, and how to apply STRIDE threat modeling to Neural Networks.
🎓 In this video, you will learn:
MITRE ATLAS vs. ATT&CK: The difference between "Initial Access" and "ML Model Access."
OWASP LLM Top 10: An intro to Prompt Injection, Insecure Output Handling, and Data Poisoning.
New Risk Frameworks: The MIT AI Risk Repository and the CVE AI Working Group.
Supply Chain Security: Why "Pickle" files (.pkl) are dangerous and how Hugging Face is the new attack surface.
AI Threat Modeling: Mapping STRIDE to AI concepts (e.g., Tampering = Training Data Poisoning).
⏱️ Timestamps: 00:00 Intro: Why Web Security Fails in AI 01:00 MITRE ATLAS vs. MITRE ATT&CK (Exam Critical) 02:00 The MIT AI Risk Repository & CVEs 02:30 The OWASP LLM Top 10 03:20 Supply Chain Risk: Hugging Face & Pickle Files 04:05 Threat Modeling: STRIDE for AI 04:40 Homework Assignment
📚 Resources & Support
🎓 FREE Interactive Learning Tools
Don't just watch—practice. Access our new browser-based tools to test your skills live.
