In this episode, we dive deep into one of the most pressing financial and security threats facing organizations in 2026:

Featured Resource: If you are responsible for securing AI infrastructure, this episode highlights the technical controls covered in the Certified AI Security Professional (CAISP) course, which includes hands-on labs for defending against the OWASP Top 10 LLM vulnerabilities and mastering the MITRE ATLAS framework.

LLM Jacking. While many security discussions focus on prompt injection or model poisoning, LLM jacking is a different beast entirely—it is a direct infrastructure compromise where attackers hijack your cloud credentials to consume your expensive AI resources.

A single hijacked Large Language Model can cost an organization over $46,000 a day in fraudulent charges. We break down why this has moved from a theoretical risk to a daily reality for security architects and AI developers.

In this episode, we cover:

• Defining the Threat: Understand why LLM jacking is an infrastructure failure, distinct from model manipulation like prompt injection.

• The 3-Stage Anatomy of an Attack: We trace the attacker’s journey from the Initial Compromise (often through leaked API keys or unpatched software) to Discovery and Weaponization, where stolen access is sold or used to generate malicious content.

• The "Smoking Gun": Learn the technical indicators of compromise (IoCs), such as specific ValidationException errors in AWS Bedrock or unusual geographic spikes in API traffic.

• Real-World Case Study: We examine a fintech startup’s nightmare scenario—how a single static AWS key committed to GitHub led to a 700% cost overrun in just two weeks.

• Defense & Incident Response: From architecting Zero Trust AI pipelines to a 15-minute containment playbook, we provide actionable strategies to protect your environment.

• The Future of AI Security: Why the rising cost of model inference and the move toward proprietary, fine-tuned models make AI infrastructure a high-value target for 2026 and beyond.

Tune in to learn how to ensure security is a foundational part of your AI strategy, rather than a costly afterthought.

https://www.linkedin.com/company/practical-devsecops/
https://www.youtube.com/@PracticalDevSecOps
https://twitter.com/pdevsecops

In this episode, we explore the remarkable career transformation of Hiroshi Tanaka, a security veteran with 15 years of experience in offensive security, penetration testing, and red team operations.

Despite his extensive background in a Fortune 500 company, Hiroshi realised that his ability to "break things" was no longer sufficient as his organisation transitioned towards DevOps and cloud-native development.

He shares his candid journey of overcoming the fear of becoming "irrelevant" and the challenge of preventing vulnerabilities during development rather than just finding them in production. We dive deep into the solution that changed his career trajectory: the Certified DevSecOps Professional (CDP) programme.

Key Discussion Points:

• The 60-Day Pivot: How Hiroshi transitioned from offensive security to a secure SDLC mindset through 100+ hands-on labs covering CI/CD integration, SCA, SAST, and DAST.

• Infrastructure-as-Code (IaC): Mastering the security of automated pipelines using tools like Jenkins, GitLab CI, Ansible, and Terraform.

• Tangible Results: Within 30 days of his certification, Hiroshi automated security scanning that caught 23 high-severity vulnerabilities before they reached production—issues that previously would not have been caught for months.

• The Professional ROI: The business impact of reducing deployment delays from two weeks to two days and how this pivot led to a promotion to AppSec Lead with a 40% salary increase.

Hiroshi explains how gaining technical credibility allowed him to speak the "same language" as DevOps teams, shifting his role from a quarterly auditor to a key player embedded in sprint planning.

Looking Forward: We also touch upon emerging trends for 2026, including the necessity of securing AI supply chains and data pipelines through certifications like the Certified AI Security Professional (CAISP).

Whether you are looking to master Kubernetes security, API security, or Threat Modeling, this episode serves as a comprehensive guide for any security professional or developer looking to upgrade their career and join the top 1% of cybersecurity engineers.

https://www.linkedin.com/company/practical-devsecops/
https://www.youtube.com/@PracticalDevSecOps
https://twitter.com/pdevsecops

AI Security Certification and Training:

https://www.practical-devsecops.com/certified-ai-security-professional/

To address these challenges, the Certified AI Security Professional (CAISP) certification provides the skills needed to secure the AI supply chain and infrastructure. The course covers:

The emergence of Agentic AI represents a fundamental paradigm shift in cybersecurity. Unlike traditional, static software, agentic systems are defined by their autonomy, planning capabilities, and ability to use tools to execute multi-step goals. This shift means defenders are no longer just securing code, but rather dynamic, goal-driven entities that can be turned against their creators.

The Taxonomy of Threats

The attack surface for these agents is vast, with several critical vectors identified in the sources:

• Prompt Injection and Jailbreaking: This is the primary method for hijacking an agent. Attackers use direct injection (malicious commands fed directly) or indirect injection (poisoning data the agent processes, such as a webpage or document) to override core instructions.

• Autonomous Exploitation: A compromised agent can effectively become an autonomous hacker. It can independently scan for "one-day vulnerabilities" or execute website exploits without further human intervention.

• Multi-Agent Mayhem: When agents collaborate using protocols like MCP (Machine Communication Protocol), risks multiply. Attackers can exploit these protocols for impersonation or to coordinate multiple agents into a "digital crime syndicate" to bypass security controls.

• Unchecked Autonomy: The speed of AI operation means a minor error can escalate into a major incident before a human can intervene, making minimal oversight a critical vulnerability

https://www.linkedin.com/company/practical-devsecops/
https://www.youtube.com/@PracticalDevSecOps
https://twitter.com/pdevsecops