ISO 27090 Practice Path
This path takes you through PlayCISO's AI and agent labs in the order the ISO/IEC 27090 threat themes build on each other: name the threats, then prompt injection, poisoning, model and supply-chain integrity, data extraction and unsafe output, and finally evasion, detection and evidence. Pass the 9 required labs and the path is complete. Your progress per lab shows below.
The path is free; each lab is marked Pro or Free (a free account includes 3 Pro tool runs). ISO/IEC 27090 is guidance, not a certifiable standard, and PlayCISO is not affiliated with ISO or IEC.
Progress is read from this browser only. A lab counts as passed after one attempt that meets its win condition. Next up: ISO 27090 Threat-Mapping Lab.
- Stage 1Beginner1 required
Name the AI threats
ISO/IEC 27090 starts from the idea that AI systems face threats ordinary controls were not built for: attacks on the model and its data, and harm that flows out of the model. Before testing anything, learn to recognise each threat class and the confidentiality, integrity or availability property it breaks.
After this stage: Given an AI feature, you can name the likely threat class and the kind of control that fits it.
- ISO 27090 Threat-Mapping LabRequiredProlab
Map realistic AI scenarios to a threat class, the CIA property it violates and the mitigation that fits.
Checking…
- ISO 27090 Readiness ChecklistProtool
Score where your programme stands across the guidance themes before you start the hands-on stages.
Not graded
- LLM Threat Model GeneratorProtool
Generate a first threat model for an LLM application against the OWASP LLM Top 10.
Not graded
- AI Security GlossaryProtool
Plain definitions of the terms the rest of the path uses.
Not graded
- Stage 2Beginner1 required
Prompt injection
Prompt injection is input manipulation: text the model reads, typed by a user or hidden in a web page, file, email or tool result, overrides what the system was told to do. With an agent that can act, an injection becomes an action. The fixes are mediation and least privilege, not a sterner system prompt.
After this stage: You can trace an injection to its source and say which boundary should have stopped it.
- Indirect Prompt-Injection LabRequiredProlab
Run the poison, hijack, patch loop on scenarios where untrusted content reaches an agent.
Checking…
- Agent Prompt-Injection Harness LabProlab
Trace the injection vector through tool output, RAG, files and subagents, and pick the harness control.
Checking…
- AI Prompt-Injection Incident LabProlab
A branching incident: a support agent leaks order data through an injected ticket. Ten scored decisions.
Not graded
- Prompt Injection TesterProtool
Generate a labelled probe suite to test your own LLM app, and scan your system prompt for weak patterns.
Not graded
- Stage 3Intermediate2 required
Data and context poisoning
Poisoning corrupts what the model learns from or reads: training data, a retrieval index, an agent's memory, or the instruction files a coding agent trusts. Unlike injection it persists, so one planted document can steer every later answer. Controls sit at the data layer: provenance, access filters and review of what gets written.
After this stage: You can find a poisoned source, scope who it affected and close the write path it came through.
- RAG Poisoning LabRequiredProlab
Planted documents, missing tenant filters and embedding poisoning: call whether a leak or poisoning occurred.
Checking…
- Poisoned Instruction File LabRequiredFreelab
Find the injected lines in CLAUDE.md, .mcp.json, hooks, memory and skills, and preserve evidence first.
Checking…
- Agent Memory Governance LabProlab
Decide what an agent may persist across tasks, by data class, so memory cannot be used to poison it.
Checking…
- RAG & Vector DB Hardening ChecklistProtool
Turn what the lab taught into a hardening checklist for your own retrieval stack.
Not graded
- Stage 4Intermediate1 required
Model and supply-chain integrity
A model, plugin, MCP server or package you did not build is code and weights you are trusting. Backdoored models, typosquatted plugins and MCP servers that change behaviour after approval (a rug pull) all compromise integrity before your own controls see a request. The answer is provenance: know what you run, verify it, and re-check it when it changes.
After this stage: You can vet a third-party AI component and explain what evidence of its origin you would require.
- Model Backdoor & Adversarial-ML LabRequiredProlab
Classify an attack on an ML model (evasion, poisoning, trojan trigger, extraction) and name the defence.
Checking…
- Agent Plugin Supply Chain LabProlab
Vet third-party plugins, skills, MCP servers and scripts, and name the supply-chain risk in each.
Checking…
- MCP Rug-Pull LabProlab
Review MCP servers from the attacker side: tool poisoning, rug pulls, tool shadowing, over-broad scopes.
Checking…
- Model Signing & Provenance LabProlab
Follow a model file to its signature and attestation, linked from the AI bill of materials.
Checking…
- AIBOM Gap Finder LabProlab
Find what an AI bill of materials leaves out before an incident makes you need it.
Checking…
- npm Supply Chain Attack LabProlab
A hijacked package with a postinstall script steals CI secrets: scope the builds and rotate in order.
Not graded
- Stage 5Advanced2 required
Data extraction and unsafe output
Confidentiality threats pull information back out of a model: memorised training data, personal data, membership inference and model inversion. Output threats run the other way: model text reaches a browser, database, shell or URL fetcher and is executed as if it were trusted. Both are fixed outside the model, with minimal output, query limits, output encoding and constrained tools.
After this stage: You can say what an AI feature could leak, and which downstream sink must treat its output as untrusted.
- Data Extraction & Leakage LabRequiredProlab
Classify a leak (memorisation, PII exposure, membership inference, inversion) and pick the control that stops it.
Checking…
- Insecure Output LabRequiredProlab
Trace model output into its sink (DOM, SQL, shell, fetch, path) and name the vulnerability class.
Checking…
- Agent Egress Containment LabProlab
Triage an AI executor's outbound requests: metadata endpoints, internal SSRF, dependency pulls.
Checking…
- Agent Tool-Scope LabProlab
Grant an agent the least privilege its task needs, with human gates for the risky actions.
Checking…
- Stage 6Advanced2 required
Evasion, detection and evidence
The last stage is assurance: noticing an attack that tries not to be seen, and still having the evidence when you do. An attacker driving an agent will evade monitoring, and AI logs expire fast. Governance in ISO/IEC 42001 and the guidance in 27090 both assume you can show what happened, so retention and investigation readiness are controls, not paperwork.
After this stage: You can spot an evasive attack chain in agent telemetry and preserve the evidence before it expires.
- Agent Defence-Evasion HuntRequiredFreelab
An audit and telemetry feed streams in: flag benign, suspicious or evasion, then link the attack chain.
Checking…
- Evidence Expiry RaceRequiredFreelab
An AI incident found days late: spend analyst hours to save evidence before retention destroys it.
Checking…
- AI Investigation Scoping LabFreelab
Scope AI incidents: the environment, the right evidence, the pivot order and the controls.
Checking…
- Agent Trace Triage LabProlab
Read agent OpenTelemetry span trees and call it: injection, tool abuse, exfiltration or benign.
Checking…
- Agent-IR Tabletop LabProlab
Sequence the response to a hijacked agent: contain and revoke before touching evidence.
Checking…
- AI Evidence Readiness CheckerFreetool
Map your plan and settings to evidence sources, retention windows and blind spots.
Not graded
TL;DRWhat this path is
5 points
- A free learning path that groups PlayCISO's AI and agent labs by the AI-security threat themes ISO/IEC 27090 addresses, in six stages from beginner to advanced.
- Stages: name the AI threats, prompt injection, data and context poisoning, model and supply-chain integrity, data extraction and unsafe output, then evasion, detection and evidence.
- 9 labs are required; each stage also lists optional labs and tools. Your progress per lab is read from the graded results this browser already keeps, and the path shows "Path complete" when every required lab is passed.
- The path page is free. Several labs on it are Pro: each is labelled Pro or Free, and a free account includes 3 Pro tool runs.
- ISO/IEC 27090 is guidance and cannot be certified against. Finishing the path is practice, not an audit or a certification. The page quotes no clause numbers from the standard.
Why this order
Each stage leans on the one before. You cannot judge a control until you can name the threat it answers, so stage 1 is threat recognition. Injection comes next because it is the attack most AI features meet first. Poisoning is injection that persists, and supply-chain integrity is poisoning that arrives before your own controls see anything. Stage 5 covers both directions of data flow: what can be pulled out of a model and what its output can do downstream. Stage 6 assumes something got through and asks whether you would see it and still have the evidence.
The themes follow the AI-specific threats ISO/IEC 27090 addresses and the public catalogues that describe them (the OWASP LLM and Machine Learning Top 10 and NIST AI 100-2). The path names themes, not clauses: the standard's text is sold by ISO and national standards bodies and is not reproduced here.
Frequently asked questions
What is the ISO 27090 practice path?
It is a free hub that puts PlayCISO's existing AI-security labs and tools in a learning order, grouped by the threat themes ISO/IEC 27090 addresses: recognising AI threats, prompt injection, data and context poisoning, model and supply-chain integrity, data extraction and unsafe output, and evasion, detection and evidence. Each stage explains its theme in plain words and lists the labs that practise it. 9 labs are required to complete the path.
Is the path free?
The path page and its progress tracking are free. The labs it links to are a mix: some are free and several are Pro. Every lab card is labelled Pro or Free, and a free account includes 3 Pro tool runs. Nothing on this page calls a Pro lab free.
How is my progress tracked?
Each graded lab already keeps your best grade and attempts in your browser. This page reads those records and marks a lab passed once one attempt has met its win condition. If you are signed in, graded attempts are also saved to your account, but this page currently shows only what this browser holds, so results from another device will not appear here yet. If your browser blocks site storage, the labs still work but progress cannot be shown.
Do I get a certificate when I finish?
When every required lab is passed the page shows "Path complete" and lets you open a shareable completion card. That card records your own practice; it is not an ISO certificate, because ISO/IEC 27090 is guidance and there is no certification against it, and it is not a verified PlayCISO certificate. Verifiable certificates are issued for the graded Projects tracks on a Pro plan.
How does this relate to ISO/IEC 42001 and 27001?
ISO/IEC 27001 and ISO/IEC 42001 are management-system standards you can certify against. ISO/IEC 27090 gives guidance on the AI-specific security threats both need to handle. The skills in this path are the ones you need to put that guidance into the controls you already run, and the AI Standards Crosswalk shows how the frameworks line up.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.