Global

AI security for everyone: Shadow AI, prompt injection and manipulated outputs

A ready-made course you customise for your organisation, with a live session deck and two surveys. You only add the 8 details that are specific to your organisation.

See the live deckSee the full outline
Try the coursePreview the survey
Length
30 min
Lessons
6 lessons
Frequency
Annually with the security awareness cycle
Last reviewed
21 Oct 2026
Hidden instructions in PDFs and emails
What would you do?

You ask an assistant to summarise a supplier PDF and it starts asking for your login

Try it: this is one of 17 interactive activities in the course.

What's included

Three pieces that work together

Copy once, get everything. Learners prepare on their own, you answer questions live, and the surveys tell you what stuck.

Self-paced course

Short lessons with real workplace scenarios, not walls of text.

  • 6 lessons, about 30 minutes
  • Scenario, process, timeline, tabs and quizzes

Live session deck

An AhaSlides presentation to run after the course, in person or online.

  • 10 slides
  • Poll, quiz, word cloud slides
  • A closing slide for your contacts

Two surveys

Find out what landed, and whether people use it on the job.

  • Post-course feedback, about 2 minutes
  • 30-day check-in
  • Anonymous by default
  • Results feed your next refresher

Learning objectives

At the end of this course, learners can

Each objective and the lesson that covers it.

IDObjectiveSourceWhere it's covered
TO 118.0Achieve ≥ 80% on the final assessment-Whole course
SO 118.1Recognise shadow AI and request tools through the approved route + your infoOrganisation's AI tool request processWhole course
SO 118.2Explain prompt injection and spot suspicious instructions in documents, emails and web pagesOWASP Top 10 for LLM Apps 2025 (LLM01)Whole course
SO 118.3Treat AI outputs, links and code as untrusted until checkedNCSC/CISA Guidelines for secure AI system development; ISO/IEC 27001:2022Whole course
SO 118.4Report AI-related security incidents quickly + your infoOrganisation's incident procedureWhole course

Your part: what a template can't do for you

  • Your workplace details: fill in the 8 highlighted fields so the course describes your own policies, contacts and locations.
  • Records: record completion in your own LMS or record system.

Course outline

6 lessons, about 30 minutes

Minutes per lesson are an estimate, shared out by page count.

ContentInteractiveVideoYou customise
1

Shadow AI and a compromised chatbot

3 pages

6 min
Before you beginNoteList
The free assistant nobody approvedTextImage
How it happenedTimelineQuiz
2

Prompt injection and poisoned content explained

3 pages

6 min
What it isTabs
Spot the hidden instructionFlashcards
CheckMulti-select quiz
3

Request, use, check, report loop for AI tools

3 pages

5 min
The loopProcess
Approved, request first, neverSorting activity
CheckQuiz
4

Hidden instructions in PDFs and emails

2 pages

4 min
The PDFScenario
The emailScenarioMulti-select quiz
5

Free AI extensions and unknown code packages

2 pages

4 min
The extensionScenario
Unknown codeScenarioQuiz
6

Reporting incidents and requesting approved tools, then final assessment

3 pages

5 min
Report pathProcessYour infoKey fact
Request a toolAccordionYour info
PracticeQuiz

Live deck and surveys

10 slides to run live, two surveys to close the loop

Pink slides are interactive. Both surveys are anonymous; pink questions are written for this course.

ContentTitle and agenda
PollHave you heard of prompt injection?" (Yes · No · Not sure)
Word cloudWhich AI tools do you use that IT might not know about?
QuizYour assistant, summarising a PDF, asks for your login. You…
ContentRequest, use, check, report in four lines
QuizA free browser extension asks to read all website data. You…
PollHow confident are you spotting manipulated AI content?" (1-5)
Content · customiseHow to report an AI incident and request a tool {{AI_INCIDENT_REPORT_PATH}}
Q&AAsk the trainer anything
Content · customiseClosing {{SECURITY_CONTACT}}, {{SURVEY_2_URL}}
Post-course feedback: 11 questions, about 2 min
  1. Overall rating 5 stars
  2. Relevant, realistic, right length, helpful activities agree/disagree grid
  3. What was most useful? multi-select
  4. Confidence before this course, and now 1-5 scale
  5. Have you heard of prompt injection? multiple choice
  6. Do you know how to request a new AI tool? multiple choice
  7. How confident are you spotting a risky AI browser extension? 1-5 scale
  8. If I had shared something I shouldn't with an AI tool, I'd feel safe reporting it right away. 1-5 scale
  9. One thing we should change or add open text
  10. Would you recommend this course? NPS
30-day check-in
  1. Have you used what you learned since the course? multiple choice
  2. How confident are you today? Compare with day 1 1-5 scale
  3. Do you know where to find the AI tool request route and the incident report path? yes / no / not sure
  4. A moment where the training helped, or where you weren't sure open text
  5. Which topics should the next refresher focus on? ranking

Results show whether people use the training on the job, not just whether they finished it.

Make it yours

8 fields to fill in, and you're ready

Everything else is done. These are the details only your organisation knows; each one is highlighted inside the course.

  • AI incident report path{{AI_INCIDENT_REPORT_PATH}}
  • AI tool request form{{AI_TOOL_REQUEST_FORM}}
  • Approved AI tools{{APPROVED_AI_TOOLS}}
  • Security contact{{SECURITY_CONTACT}}
  • AI policy link{{AI_POLICY_LINK}}
  • LMS or record system{{LMS_OR_RECORD_SYSTEM}}
Show all 8 fields
  • Survey 1 URL{{SURVEY_1_URL}}
  • Survey 2 URL{{SURVEY_2_URL}}

FAQ

Common questions

Can I run AI security for everyone: Shadow AI, prompt injection and manipulated outputs training online?

Yes. The course is self-paced and online, and the live deck lets you add a live session in the room or online.

How often is this training needed?

Annually with the security awareness cycle; when AI tools are rolled out; after an AI-related near miss.

Who needs this training?

All employees; security champions; run by IT security, compliance or L&D.

What records should I keep?

Record completion in your own LMS or record system, so you can show who finished the course and when.

Can I edit the content?

Yes, everything. Change the wording, swap scenarios for ones from your workplace, add your logo, or remove parts that don't apply.

Related templates

Often taught together

All AI security templates →
Global

Secure AI-assisted software development: Coding assistants and agents without the risk

Software developers · AI security

45 min
Global

Deepfakes and AI-enabled fraud: Spot, stop and report synthetic voice, video and image scams

All staff · AI security

35 min
Global

Your data and AI tools: What you can and cannot share

All employees; run by data protection · AI security

30 min
Last reviewed: 21 October 2026Templates are a starting point, not legal advice.

Ready to run it?

Open the live deck to see how the session runs alongside the course and both surveys.

See the live deck