Course Objective & Scope
Because workflow platforms hold credentials to CRM, ERP, email and databases, they quickly become high-value security targets. Add an LLM that reads untrusted emails or PDFs and has tool-calling permissions, and indirect prompt injection can lead to data exfiltration or unauthorised actions. This course teaches how to architect AI-enabled automations securely.
Guided by the OWASP Top 10 for LLM Applications and enterprise security standards, participants threat-model workflows and implement least-privilege service accounts, input/output guardrails, dev/prod separation and citizen-developer governance.
Who Should Attend?
- Enterprise architects, application/cloud security specialists and automation platform administrators
- IT teams governing n8n, Power Platform, Copilot Studio and custom agent infrastructure
- Risk, compliance, internal audit and privacy (KVKK/GDPR) leads
- Senior builders automating regulated or mission-critical workflows
Key Takeaways
- Threat-model automation and LLM flows across untrusted inputs, credentials and downstream actions
- Enforce least-privilege service accounts, scoped tokens and central secret vaults
- Defend against indirect prompt injection arriving via emails, documents and web pages
- Constrain LLM tool calling with strict schema validation, allowlists and approval gates
- Establish environment isolation, DLP policies and review gates to prevent shadow automation
Curriculum
Threat Modelling Automation and LLM Workflows
- Mapping the OWASP Top 10 for LLM Applications onto workflow architectures
- Breaking the 'lethal trifecta' of untrusted input, privileged tools and external exfiltration paths
Identity, Least Privilege and Credential Hygiene
- Replacing personal admin tokens with narrowly scoped service principals
- External secret vaults, webhook IP/HMAC verification and key rotation
Indirect Prompt Injection and Safe Tool Calling
- Separating untrusted data from system instructions when processing emails and documents
- Allowlisting tool parameters, deterministic policy checks and mandatory human approval for write/delete actions
Data Loss Prevention (DLP), Network Isolation and Privacy
- PII scrubbing, zero-data-retention endpoints and regional hosting for KVKK/GDPR compliance
- VPC/self-hosted deployment patterns and connector DLP policies
Governance, Dev/Prod Isolation and Security Sign-Off
- Separating development, staging and production environments with change review gates
- Maintaining a central automation inventory and a pre-production security checklist
Other Courses in This Category
-
Automate repetitive business tasks using triggers, conditions, data transformations and actions, building your first end-to-end workflow safely with examples in n8n, Power Automate and Make/Zapier.
- Live Course
- 5 modules
-
Map AS-IS processes, eliminate bottlenecks, standardise exception rules, design TO-BE workflows and build a prioritised automation backlog with ROI and feasibility scoring before automating.
- Live Course
- 5 modules
-
Combine deterministic workflow automation with LLM steps for classification, extraction and summarisation to process unstructured emails, PDFs and free text reliably.
- Live Course
- 5 modules
-
Design multi-step, context-aware enterprise workflows using LLM APIs, prompt chaining, routers, evaluator-optimizer loops and tool calling patterns.
- Live Course
- 5 modules
-
Extract structured data from invoices, contracts, delivery notes and scanned PDFs using OCR and vision-language models, validate it against business rules and push it into ERP or finance systems.
- Live Course
- 5 modules
-
Triage shared inboxes, support tickets and contact forms with LLMs by intent, category, urgency and sentiment, extract key fields, route to the right team and generate draft replies.
- Live Course
- 5 modules
Get in touch
