Citizen AI: building AI security literacy across the workforce

AI risk doesn't stop at engineering - every employee using AI tools to automate work, build workflows, or make decisions is part of your organisation's risk surface. Citizen AI by Secure Code Warrior extends secure coding capability beyond developers, giving non-technical employees the practical AI literacy they need to use AI responsibly in day-to-day work. Starting with Automating with AI, a learning collection built specifically for business users, it teaches the situations employees are already facing - building AI-powered automations, troubleshooting workflows, recognising common AI risks, and understanding identity, credentials, and access - through short videos, practical guidelines, and an interactive walkthrough. The result: a workforce that adopts AI with confidence and judgment, not just enthusiasm.

Learning Objectives

By the end of this course, participants will be able to: 

• Explain how AI moves from conversational assistance to agentic action, and describe the components of a connected AI setup (agents that act on the learner's behalf, the anatomy of a connected AI setup)
• Decide which workflows are and are not appropriate to automate with AI, applying practical safety checks before building
• Identify the risks that persist even when an AI automation is working as intended, and apply habits that limit their impact
• Judge what data is safe to share with an AI tool, and validate AI outputs before acting on them (knowing what data is safe to share, how to validate AI outputs, and how to grant AI tools access responsibly)
• Grant, review, and restrict AI agent access in line with least-privilege principles
• Recognise when an issue exceeds their own competence and escalate to security, IT, or governance owners
• Demonstrate responsible AI use in a way that produces evidence for governance and audit (completion and assessment reporting as evidence of responsible AI adoption for leadership, auditors, and regulators)

Target Audience

Business users — everyone except developers and data scientists.

• Functions named: marketing, finance, HR, operations, sales, and customer-facing teams — employees who use AI at work every day but were never trained to do it securely
• Explicitly not: developer training; no technical background required. 
• Framing: "the workforce that builds with AI, not just the developers who deploy it" — people already building automations, sharing data with AI tools, and acting on AI outputs

Learning Approach

• Behaviour before terminology. Generic AI awareness training teaches theory and terminology; Citizen AI focuses on behaviour — the actual decisions employees face when building automations, sharing data with AI tools, validating outputs, and granting access. The stated goal is changed habits, not completed slideshows.
• Starts from the learner's real situation. The program skips AI theory and starts with the situations employees are already in, designed around four anchors: the AI tools they use every day, the workflows they automate, the data they share, and the access they grant.
• Mixed modality, short-form. The Automating with AI collection combines short videos, practical guidelines, and an interactive walkthrough across four topics — 5+ hours total, so consumable in a single sitting or drip-fed.
• Learn by building, not watching. Learners safely build their first AI workflow rather than reading about one, then practise troubleshooting it when it breaks — including recognising the "AI bug doom loop" that pushes people toward riskier "just fix it" tactics.
• No-code, scenario-driven. Real business scenarios, no code, no technical background required — deliberately built for people outside engineering.
• Habits paired to risks. Each of the three risk categories is paired with a set of practical habits that limit potential risk and damage, so every risk concept exits with a corresponding action.
• Same-day applicability. Content is designed to deliver knowledge learners can apply the same day, with completion and assessment records feeding governance and audit evidence.