AI SECURITY
Securing AI in Healthcare: Prompt Injection to Unauthorized Actions
Course Description
Securing AI in Healthcare: Prompt Injection to Unauthorized Actions is a SecureStack™ instructor-led healthcare AI security course focused on two distinct security questions: what content should an AI-enabled healthcare workflow be permitted to consume, and what actions should that workload be permitted to perform?
Learners first examine an indirect prompt-injection scenario involving a synthetic clinical record that contains legitimate healthcare information and an embedded adversarial instruction. Using Azure AI Content Safety Prompt Shields, they distinguish a legitimate user request from malicious instructions contained in untrusted document content. They examine how the detection result informs the application's security decision and evaluate evidence showing whether the application blocked processing of the malicious document before generative AI model invocation.
The course distinguishes detection from enforcement. Prompt Shields identifies potential malicious instructions; the Azure Function App applies application-level processing rules that determine whether the workflow stops or continues. Learners examine the meaning of model invocation—the point at which an application sends a request to a generative AI model—and interpret evidence showing that the tested malicious document was blocked before that invocation occurred. This enforcement decision is separate from Azure Blob Storage permissions and Azure RBAC.
Learners next evaluate an independent authorization boundary. Using an Azure Logic App workload identity and Azure Role-Based Access Control (Azure RBAC), they test whether required READ access to protected synthetic clinical data remains available while an unnecessary WRITE operation is denied. These are direct authorization tests, not a demonstration of an AI agent autonomously following a malicious instruction.
The course emphasizes defense in depth and evidence over assumption. Detection, application enforcement, model invocation, workload identity, and resource authorization are treated as distinct security functions. Learners connect the demonstrated concepts to relevant OWASP and NIST security principles while distinguishing observed results, hypothetical attack paths, and residual risk. Security conclusions remain limited to the identities, operations, resources, and execution paths actually tested.
The course applies AI workload security, identity, and trust-boundary principles through a healthcare-specific scenario, emphasizing application-level enforcement, least-privilege authorization, and evidence-based validation of security controls.
Who This Program Is For
-
Security engineers responsible for securing cloud and AI-enabled workloads and validating security controls through observable evidence.
-
Cloud and AI engineers responsible for application identities, workflow permissions, Azure Functions, Logic Apps, storage access, and AI-connected application paths.
-
Security architects responsible for defining content, identity, authorization, and least-privilege boundaries for AI-enabled applications.
-
AI security and governance practitioners responsible for evaluating how AI-enabled workloads process untrusted content and interact with protected data and cloud resources.
-
Healthcare cybersecurity practitioners responsible for protecting AI-enabled workflows that process sensitive or regulated clinical information.
Your Day
One day, 9:00 AM–5:00 PM Central Time, including scheduled breaks and a 90-minute lunch period.
- 9:00–9:20 AMWelcome, course orientation, healthcare AI scenario, and evidence-over-assumption framework
- 9:20–10:00 AMModule 1 — AI Security Boundaries in Healthcare
- 10:00–10:35 AMModule 2 — Indirect Prompt Injection and Untrusted Clinical Content
- 10:35–10:45 AMBreak
- 10:45–11:15 AMModule 3 — Detection, Application Enforcement, and Evidence
- 11:15 AM–12:00 PMLab 01 — SecureStack™ AI Content Boundary: Defend Against Indirect Prompt Injection
- 12:00–1:30 PMLunch
- 1:30–2:00 PMModule 4 — Authorization and Least Privilege for AI-Enabled Workloads
- 2:00–2:25 PMModule 5 — Positive and Negative Authorization Testing
- 2:25–2:35 PMBreak
- 2:35–2:55 PMModule 6 — Model Behavior Is Not Authorization
- 2:55–4:00 PMLab 02 — SecureStack™ AI Authorization Boundary: Enforce Least Privilege for an AI-Enabled Healthcare Workflow
- 4:00–4:20 PMModule 7 — Evidence Boundaries and Defensible Security Conclusions
- 4:20–4:40 PMModule 8 — Connecting the Content and Authorization Boundaries
- 4:40–5:00 PMEvidence review, learning-outcome validation, questions, and close
Curriculum
Eight modules across one day of instructor-led training.
Module 1 — AI Security Boundaries in Healthcare
Establishes the two security questions that govern the entire course: what an AI-enabled application may safely consume, and what the workload is actually authorized to do. Learners see why a secure healthcare workload must control both.
Content boundary vs. authorization boundaryHealthcare workflows with sensitive clinical dataEvidence over assumptionModule 2 — Indirect Prompt Injection and Untrusted Clinical Content
Examines the difference between a legitimate user instruction and untrusted external document content, why instructions embedded in retrieved content should not automatically acquire authority, and how Prompt Shields evaluates attack signals. Prepares learners for Lab 01.
Direct vs. indirect prompt injectionUntrusted retrieved contentPrompt Shields attack-signal evaluationModule 3 — Detection, Application Enforcement, and Evidence
Distinguishes security detection from application enforcement: Azure AI Content Safety Prompt Shields evaluates untrusted content for attack indicators, while the Azure Function App applies the processing decision. Learners examine application response evidence to determine whether the tested malicious document was blocked before generative AI model invocation. Prepares learners for the second half of Lab 01.
Detection is not enforcementApplication response evidenceExpected state vs. tested stateModule 4 — Authorization and Least Privilege for AI-Enabled Workloads
Defines the required capability of an AI-enabled healthcare workflow versus unnecessary authority, covering authentication versus authorization, workload identities, and least-privilege design. Prepares learners for Lab 02.
Required capability vs. unnecessary authorityAuthentication vs. authorizationLeast privilegeModule 5 — Positive and Negative Authorization Testing
Teaches learners how to interpret the authorization evidence they collect, proving that a required operation remains available while a prohibited operation is denied, and why an expected failed operation can represent successful security enforcement.
Positive and negative testingInterpreting authorization evidenceFailed prohibited operationsModule 6 — Model Behavior Is Not Authorization
Prevents learners from conflating AI instructions with independently enforced cloud security: model refusals, system instructions, and application intent are not enforceable cloud permissions.
Model refusal vs. authorization denialSystem instructions vs. cloud permissionsAI instructions are not cloud authorizationModule 7 — Evidence Boundaries and Defensible Security Conclusions
Teaches learners to state exactly what their tests prove, separating tested evidence from universal claims, expected from observed results, and identifying residual risk in security conclusions.
Tested evidence vs. universal claimsExpected vs. observed resultsResidual riskModule 8 — Connecting the Content and Authorization Boundaries
Brings the two labs together without conflating their controls, showing how the content boundary and the authorization boundary are different security questions addressed by different controls.
Content boundaryAuthorization boundaryEvidence-based conclusions
Hands-On Labs
The January 12, 2027 session includes two hands-on SecureStack™ labs. Registered participants receive the complete lab materials in session.
Hands-On Lab 01 — SecureStack™ AI Content Boundary: Defend Against Indirect Prompt Injection
Learners examine a synthetic clinical record containing an embedded adversarial instruction, evaluate the legitimate prompt and untrusted document independently with Azure AI Content Safety Prompt Shields, execute the protected application workflow, and use observed evidence to determine whether processing was blocked before model invocation.
Hands-On Lab 02 — SecureStack™ AI Authorization Boundary: Enforce Least Privilege for an AI-Enabled Healthcare Workflow
Learners evaluate an AI-enabled healthcare workflow's authorization boundary by proving that its required READ operation remains available while a tested unnecessary WRITE operation is denied by Azure authorization. Learners compare positive and negative execution evidence and establish a defensible least-privilege conclusion.
What You'll Walk Away With
Distinguish a Content Boundary from an Authorization Boundary in an AI-enabled healthcare workflow.
Identify an indirect prompt-injection condition introduced through external clinical-document content.
Use Azure AI Content Safety Prompt Shields to evaluate a legitimate user prompt separately from an untrusted document.
Distinguish security detection from application enforcement.
Validate application evidence showing that a tested malicious document was blocked before model invocation.
Define the minimum capability required by an AI-enabled healthcare workflow before evaluating its permissions.
Execute a positive authorization test proving that a required READ operation remains available.
Execute a negative authorization test proving that a tested unnecessary WRITE operation is denied.
Distinguish AI model behavior and natural-language instructions from independently enforced Azure authorization.
Interpret a failed prohibited operation as expected secure behavior when the failure is caused by authorization enforcement.
Use observed evidence — not assumed configuration — to determine whether the tested security boundary held.
State defensible security conclusions without extending the result beyond the inputs, operations, resources, identities, and execution paths actually tested.
Date
January 12, 2027
Time
9:00 AM–5:00 PM Central Time
Format
In-Person Instructor-Led Training (ILT)
Location
Granite Place, Southlake, Texas
Group size
Maximum 10 participants
Price
$700 per participant
Registration closes
January 7, 2027 at 11:59 PM CT
Upcoming Open-Enrollment Sessions
Tools Covered
Who Should Attend
Your Instructor
Serling A. Davis
Founder & Chief Learning Architect, NTEKNO, Inc.
Serling A. Davis is a cloud security and technical education professional with 20 years of experience developing and delivering advanced technical training across cybersecurity, cloud infrastructure, telecommunications, and enterprise technologies.
Before founding NTEKNO, Serling served as Principal Content Developer within Microsoft Worldwide Learning's Security, Compliance & Identity organization. He was the principal content developer and global portfolio custodian for AZ-500: Microsoft Azure Security Technologies, responsible for curriculum quality, technical accuracy, practitioner alignment, and continuous program improvement. He also developed the SC-5002 Applied Skills learning path, including GitHub-based technical labs, assessments, validation guidance, and supporting instructional resources.
His career includes technical instructor and curriculum development positions with Palo Alto Networks, Ericsson, Huawei Technologies, Imperva, and Alcatel. His instructional experience spans optical networking, 2G, 3G, 4G LTE and 5G infrastructure, network virtualization, cloud orchestration, and cloud-native security.
Throughout his career, Serling has developed technical training content and delivered instructor-led education for organizations including Verizon Wireless, Vodafone Germany, Swisscom AG, Spark New Zealand, TELUS Canada, Orange SA, China Telecom Hong Kong, Tata Communications Canada, Level 3 Communications, Sprint Corporation, Santee Cooper Power, and the Metropolitan Atlanta Rapid Transit Authority (MARTA).
As Founder and Chief Learning Architect of NTEKNO, Inc., Serling created SecureStack™, a scenario-based cloud and AI security training portfolio incorporating Microsoft technologies such as Defender for Cloud, Sentinel, Purview, Security Copilot, Copilot in Azure, and Azure AI Content Safety Prompt Shields.
His instructional approach emphasizes a central principle: security conclusions must be supported by what technology demonstrably detects, enforces, authorizes, and records—not by assumption.
For Securing AI in Healthcare: Prompt Injection to Unauthorized Actions, Serling applies this methodology through hands-on instruction examining indirect prompt injection, application-layer enforcement, authorization boundaries, and observable technical evidence.
NTEKNO, Inc. — Southlake, Texas
Granite Place · 550 Reserve Street, Suite 190 · Southlake, Texas, 76092 · United States of America
Frequently Asked Questions
Who is this training designed for?
The training is designed for security professionals, cloud and AI practitioners, architects, engineers, and technical leaders responsible for securing AI-enabled workloads in healthcare environments.
What should I expect from this training?
This is an in-person, instructor-led security training experience with two hands-on labs focused on prompt injection, authorization boundaries, and evidence-based validation in healthcare AI workflows.
Is this a hands-on technical training course?
Yes. The training includes two hands-on labs using Microsoft cloud and AI security technologies. Participants examine prompt-injection controls, application enforcement, authorization boundaries, and observable technical evidence.
What Microsoft technologies are used during the training?
The training uses Azure AI Content Safety Prompt Shields, Azure Blob Storage, Azure Functions, Azure Logic Apps, and Azure Authorization.
Do I need my own Azure subscription?
No. An Azure subscription is not required from participants during the training. Each participant will be assigned an Azure resource group for the hands-on exercises.
What should I bring?
Bring your own laptop and the charging accessories required for your device. Your laptop will be used during the hands-on portions of the training.
Will I receive a certificate of completion?
Yes. Participants who complete the training receive an NTEKNO Certificate of Completion documenting the instructional experience.
Is this training eligible for CPE or CEU credit?
The training documents 370 minutes (6 hours 10 minutes) of instructional and hands-on lab time. Participants receive an NTEKNO Certificate of Completion. CPE or CEU eligibility and any credit awarded are determined by the applicable credentialing organization.
What is the cancellation and refund policy?
For open-enrollment ILT, cancellations submitted 26 or more calendar days before the scheduled training start date are eligible for a refund of the registration fee or transfer to a future available open-enrollment session. Cancellations submitted less than 26 calendar days before the scheduled start date are non-refundable, except where otherwise required by applicable law. NTEKNO's Terms of Use govern.
Related SecureStack™ Courses
View All Courses →
AI Security
Securing AI in Healthcare: Prompt Injection to Unauthorized Actions
Instructor-led healthcare AI security training focused on indirect prompt injection, application enforcement, and least-privilege authorization boundaries for AI-enabled workflows.
Incident Simulation
Code Red: PHI Exposure Simulation (Healthcare)
Incident Simulation
Code Red: Critical Infrastructure Data Exposure Simulation (Energy & Utilities)
Request an invite
Get your teams incident-ready — rehearse real breaches before they happen.