Robbe Van Roey you did crash our exam🤬. But hey ho, well done🕺💪🙌✅️ Read the full review👇
I am now a Certified AI/ML Penetration Tester 🎉 Here's my review of The SecOps Group's C-AI/MLPen exam 👇 👨💻 An AI penetration tester exam? 👨💻 For the past 12 months, I've been delving deeply into the world of hacking everything AI-related. I've gathered over 20 CVEs in various AI libraries and frameworks and scored some sweet bounties. So when I heard that there was an exam about AI security penetration testing, it peeked my interest and so I gave it a shot. 🤔 Do we need an AI/ML penetration tester exam? 🤔 The first question I asked myself is whether or not the industry needs such an exam. I've seen a couple of AI agents in my recent penetration tests and they're always interesting targets, I've also seen more and more companies requesting these types of penetration tests, and thus there's a market there. 🧬 Is it life-like 🧬 My main AI/ML penetration testing experience has been with frameworks and less with implementations and models. I've found there that the main vulnerabilities are the issues we all know about today: Local File Inclusions / Zip Bombs / File Overwrites / RCE. However, this exam focuses down on the prompt injection part of AI/ML security, which is perfectly fine. It's better to scope down to the new and interesting things than to have yet another web application hacking certificate. ⚖ How does it compare to other certificates? ⚖ I don't actually know of any other AI/ML penetration testing certifications, so I'll talk about the C-AI/MLPen certificate in general. In terms of difficulty, I felt like the exam was a bit too easy, it could've been a bit harder. Like with all SecOps certificates, there's no training available. They merely offer the exam. They do however provide you with a load of links to other platforms that can help you prepare for the exam. I'm a huge fan of this because it means that SecOps isn't deciding what's important to know and what isn't. They're merely testing your skills. This means that you don't get cookie-cut penetration tester that have all followed the exact same path. We always need creativity in this space! 😎 I crashed the exam 😎 Fun fact: I actually managed to crash the entire exam environment to the point where I had to retake the exam the next day. This shows how unpredictable LLMs are, they're very hard to keep under control and it was quite cool to be able to force this unexpected outcome! 📈 Conclusion: Should you take this exam? 📈 No. You probably should take the exam right now. I don't think there are going to be many jobs requiring this certificate right now. However, maybe that's just a bad prediction of the future. If you're an employer looking for offensive AI/ML researchers, then maybe this could be a fun way to scope out new recruits though!