Roadmap - From AI Fundamentals to Maritime AI & Cyber Resilience

📚 Course Syllabus AI Cybersecurity Maritime IT/OT

Maritime AI Learning Roadmap

From AI Fundamentals to Maritime AI & Cyber Resilience

ShipPaulJobs Knowledge Series · Course Navigation Hub — updated as each lesson is published

Captain Paul

Maritime 4.0 · AI · Data · Cyber Resilience

This is not a general AI encyclopedia. The goal is not "learning AI" for its own sake — it is understanding how AI is changing Security Operations, Maritime IT/OT, and Cyber Resilience. This roadmap builds from AI fundamentals through Transformers, LLMs, RAG, AI Tools, and Agentic AI, into AI Engineering and AI Security, and finally into how AI is actually applied in Cybersecurity and Maritime environments — functioning as the AI/Intelligence layer that feeds into the existing Maritime Cybersecurity Learning Roadmap rather than competing with it.

🔗 Companion Roadmap This series connects directly into the Maritime Cybersecurity Learning Roadmap  →  https://www.shippauljobs.com/2026/09/maritime-cybersecurity-learning-roadmap.html

— Part 6 here leads into that roadmap's Maritime IT/OT and Cyber Resilience parts.

NIST AI Risk Management Framework — How This Roadmap Aligns

The NIST AI RMF 1.0 (January 2023) organises AI risk management around four core functions. On April 7, 2026, NIST released a Concept Note: AI RMF Profile for Trustworthy AI in Critical Infrastructure — directly relevant to maritime operators adopting AI in fleet management, navigation assistance, and OT environments. The six parts of this roadmap map to those four functions as follows:

🔷 GOVERN

Policies, roles, culture and accountability structures that shape how an organisation designs and deploys AI responsibly.

→ PART 5: AI Guardrails (L22) · AI Gateway & Governance (L24)

→ PART 6: AI Security governance, MITRE ATLAS threat model

🔷 MAP

Categorise the context, capabilities, and risks associated with a specific AI system before it is deployed.

→ PART 3: RAG, Function Calling, MCP (L10–14)

→ PART 4: Agentic AI — understanding what an agent can do (L15–19)

🔷 MEASURE

Analyse, assess, benchmark and monitor AI risk — quantitatively where possible.

→ PART 5: AI Evaluation (L21) · AI Observability (L23)

→ PART 5: Fine-tuning & Synthetic Data validation (L20)

🔷 MANAGE

Prioritise and address AI risks based on projected impact; allocate resources and respond to adverse events.

→ PART 6: AI-Assisted SOC (L25) · Threat Hunting (L26)

→ PART 6: From AI SecOps to Maritime Cyber Resilience (L27)

🆕 NIST AI RMF — Critical Infrastructure Profile (April 7, 2026)

NIST released a concept note for an AI RMF Profile specifically targeting critical infrastructure operators — including maritime. It guides operators on risk management practices when deploying AI-enabled capabilities in safety-critical environments: exactly the intersection of PART 5 (AI Engineering & Security) and PART 6 (AI × Cybersecurity) in this roadmap. Read the concept note ↗

📄 NIST AI 600-1 — Generative AI Profile (July 26, 2024)

NIST AI 600-1 profiles risks unique to generative AI and proposes actions best aligned with each organisation's goals. Directly relevant to PART 2 (LLMs), PART 3 (RAG and tool use), and PART 4 (Agentic AI) — particularly prompt injection, data poisoning, and hallucination risks. NIST AI 600-1 ↗

6

Parts

27

Lessons Outlined

9

Stages to Cyber Resilience

2

Roadmaps — AI + Cybersecurity

4

NIST AI RMF Functions Aligned

This roadmap is designed to expand over time, following the same Course Navigation Hub model as the Cybersecurity Learning Roadmap. The lessons listed below under each part are what is currently outlined — additional lessons may be added to each part as the series develops, and this page will be updated with links as each one publishes.

The Learning Path

AI Fundamentals → Transformer / LLM → RAG / Knowledge / Tools → Agentic AI → AI Engineering & Security → AI-Assisted Cybersecurity → Maritime AI → Maritime IT/OT → Cyber Resilience

Parts 1–6 below cover the first six stages. Maritime IT/OT and Cyber Resilience are the destination — covered in depth in the companion Maritime Cybersecurity Learning Roadmap.

How This Series Is Written

Every lesson in this series follows the same editorial standard as the Cybersecurity Learning Roadmap, extended for AI-specific sourcing:

• Based on verifiable technical facts, drawing first on official sources — NIST, CISA, MITRE, IMO, IACS, IEC, ISO, classification societies, and official vendor documentation.
• For core AI/ML techniques, checks the original or peer-reviewed paper where possible — cited with author, title, venue/preprint source, year, and a DOI or official paper link (arXiv preprints marked as such, with the published version noted if one exists).
• Distinguishes the role of each source type: official standards for regulation/frameworks, academic papers for technical principles, vendor documentation for actual product capability.
• Clearly distinguishes currently confirmed fact, industry trend, the author's technical interpretation, and forward-looking forecast — and does not present unverified statistics, market sizes, performance comparisons, or incidents as fact.
• Notes the applicable version, revision, or publication date for topics that change over time, and links directly to official/primary URLs rather than search results or secondary blogs.
• For AI security topics, checks NIST AI RMF, the NIST Generative AI Profile, and MITRE ATLAS first; for maritime topics, checks IMO/IACS and classification society sources first; does not declare one product superior to another without evidence.
• Explains attack and misuse techniques conceptually, for education and defense — never as step-by-step exploitation instructions.

FULL CURRICULUM

PART 1 · AI Fundamentals

Before Transformers, LLMs, or AI agents, it helps to understand how AI actually got here. This part traces AI's evolution from rule-based systems through machine learning, deep learning, and computer vision, to the generative models that set up everything in Part 2.

🔑 Foundational — underpins every later part

• 1
  From AI to Generative AIRead →

  AI's development is often summarized as a straight line from Rule-based AI to Machine Learning, Deep Learning, Transformers, and Generative AI — but each stage solved a specific limitation of the one before it. This lesson traces that progression and sets up the vocabulary the rest of this roadmap uses.
• 2
  How Machines Learn from DataRead →

  This lesson covers the basic vocabulary of machine learning — Dataset, Training, Model, Inference, Classification, and Feature — and the core idea behind Deep Learning: that a model learns its own features from data rather than being told what to look for.
• 3
  CNN, RNN and the Deep Learning EraRead →

  CNN (Convolutional Neural Network), RNN (Recurrent Neural Network), and LSTM/GRU (Long Short-Term Memory / Gated Recurrent Unit) are often taught as separate specializations. This lesson frames them instead as sequential stages in deep learning's development, each addressing a specific limitation of what came before.
• 4
  Computer Vision and Object DetectionRead →

  This lesson explains how AI learned to "see" — the relationship between ImageNet (the dataset that catalyzed modern computer vision), CNNs, and object-detection architectures such as YOLO (You Only Look Once) — and where this technology is actually applied.
• 5
  From GANs to Generative AIRead →

  GANs (Generative Adversarial Networks) were an early breakthrough in getting AI to create rather than just classify. This lesson explains how GANs work and traces the line from there to today's Diffusion models and Generative AI. Goodfellow et al., 2014 ↗

Additional lessons — more topics may be added as this part develops.

PART 2 · Transformer & Large Language Models

The Transformer architecture is the single technical development that made modern LLMs possible. This part explains how it works, what an LLM actually is, and how interacting with these models has evolved from simple prompts to full context engineering.

🔑 Foundational — core AI technology

• 6
  Transformer: The Architecture That Changed AI

  This lesson explains Attention, Self-Attention, and the Query/Key/Value mechanism at the core of the Transformer architecture, and why this single architectural shift became the foundation for nearly every major AI advance since. Vaswani et al., 2017 ↗
• 7
  What Is an LLM?

  This lesson defines the core vocabulary of large language models — Token, Embedding, Context (window), Training, Inference, and Hallucination — the last of which is not a bug to be patched away but a structural property of how these models generate text.
• 8
  Prompt Engineering to Context Engineering

  Early LLM use was mostly about crafting the right prompt. This lesson explains why the field has shifted toward Context Engineering — deliberately managing what information, tools, and history a model has access to — and what that means in practice.
• 9
  Generative AI Assistants

  This lesson looks at the common architecture behind consumer and enterprise AI assistants such as ChatGPT and Claude, and what changes — and what doesn't — when the same underlying technology is deployed for enterprise use.

Additional lessons — more topics may be added as this part develops.

PART 3 · RAG, Knowledge & AI Tools

An LLM's knowledge is frozen at training time and limited to what it learned. This part covers how AI systems are connected to live, external knowledge and capabilities — retrieval, vector search, knowledge graphs, and the mechanisms that let a model call tools and external systems.

🔑 Foundational — AI + external data/tools 🔷 NIST AI RMF — MAP ↗

• 10
  RAG: How AI Works with Enterprise Data

  This lesson explains RAG (Retrieval-Augmented Generation) — Embedding, Vector Search, Retrieval, Reranking, and Grounding — and how these pieces combine so a model can answer using an organization's own data rather than only what it learned in training.
• 11
  Vector Databases and Semantic Search

  This lesson covers Vector representations, Similarity Search, and Embedding-based Semantic Search, and how they underpin the retrieval step in RAG covered in the previous lesson.
• 12
  Knowledge Graphs and AI

  This lesson introduces Entity, Relationship, Ontology, and Graph structures, and how AI systems represent and reason over structured knowledge alongside unstructured vector search.
• 13
  Function Calling: When AI Learned to Use Tools

  This lesson explains how an LLM calls external APIs and systems and uses the results — the mechanism that turns a model from a pure text generator into something that can take real actions.
• 14
  MCP: Connecting AI to Tools and Data

  This lesson introduces MCP (Model Context Protocol) — a standardized way to connect an AI model to external tools and enterprise systems — and how it builds on the function-calling concept from the previous lesson. Official MCP site ↗

Additional lessons — more topics may be added as this part develops.

PART 4 · Agentic AI

Once a model can retrieve knowledge and call tools, the next step is autonomy — systems that plan, act, and evaluate their own results rather than just answering a single question. This part covers how AI agents actually work, individually and in collaboration.

🔷 NIST AI RMF — MAP ↗

• 15
  Agentic AI: From Answers to Actions

  This lesson introduces the Agent Loop — Goal, Reasoning, Planning, Tool Use, Observation, Action, and Evaluation — the cycle that lets an AI system pursue a multi-step objective instead of just returning a single answer.
• 16
  Inside an AI Agent

  This lesson breaks down an agent's internal structure — Model, Context, Memory, Tools, Planning, Execution, and Evaluation — and how these components work together in the Agent Loop from the previous lesson.
• 17
  Multi-Agent Collaboration

  This lesson moves beyond a single agent to how Planner, Research, Analysis, Security, and Reporting agents can collaborate on a shared task — and the coordination challenges that introduces.
• 18
  AI Orchestration and Automation

  This lesson covers Routing, Workflow, State, and Tool Selection in multi-step AI systems, and why Human-in-the-loop checkpoints remain important as orchestration and automation increase.
• 19
  AI Memory and Stateful Systems

  This lesson explains Short-term and Long-term Memory, Episodic vs. Semantic Memory, and how an agent maintains State across a multi-step task or an ongoing relationship with a user.

Additional lessons — more topics may be added as this part develops.

PART 5 · AI Engineering & AI Security

Building an AI system is one thing — operating it reliably, safely, and cost-effectively is another. This part covers the engineering discipline around AI: adapting models, evaluating them, constraining their behavior, observing them in production, and managing cost.

🔷 NIST AI RMF — MEASURE ↗ 🔷 NIST AI RMF — GOVERN ↗

• 20
  Fine-tuning, Synthetic Data and Distillation

  This lesson covers Domain Adaptation, LoRA/PEFT (Low-Rank Adaptation / Parameter-Efficient Fine-Tuning), Synthetic Data, and the Teacher/Student Model relationship in distillation, from a practical engineering perspective.
• 21
  AI Evaluation

  This lesson covers how AI systems are actually evaluated — Accuracy, Relevance, Groundedness, Hallucination rate, and Agent-specific evaluation — and the evaluation frameworks used to measure them.
• 22
  AI Guardrails

  This lesson covers Input, Output, and Tool guardrails, and how they relate to Policy, Safety, and Permission controls that constrain what an AI system is allowed to do.
• 23
  AI Observability

  This lesson covers Logs, Traces, Metrics, Token Usage, Latency, and Tool Calls — the telemetry that gives operators visibility into how an AI system is actually behaving in production.
• 24
  AI Gateway and Cost Optimization

  This lesson covers Model Routing, Governance, Rate Limiting, Caching, and Token/Inference Cost — the operational layer that sits between applications and the underlying AI models.

Additional lessons — more topics may be added as this part develops.

PART 6 · AI × Cybersecurity

This closing part connects everything covered so far back to Security Operations, applying AI directly to SOC work, threat hunting, and detection engineering — and pointing toward the companion Maritime Cybersecurity Learning Roadmap's Maritime IT/OT and Cyber Resilience parts.

🔷 MITRE ATLAS ↗ 📄 NIST AI RMF ↗ 🔷 NIST AI RMF — MANAGE ↗ 🆕 Critical Infrastructure Profile (2026) ↗

• 25
  AI in Cybersecurity and the AI-Assisted SOC

  This lesson covers Anomaly Detection, Threat Intelligence enrichment, Alert Summarization, Investigation, and Correlation, and how a Human-in-the-loop AI-assisted SOC differs from a traditional SOC — connecting to the "What Is a Security Operations Center?" and "AI SOC" lessons in the Cybersecurity Learning Roadmap.
• 26
  AI-Assisted Threat Hunting & Detection Engineering

  This lesson applies AI to the Threat → TTP → Telemetry → Detection → Investigation → Response pipeline, showing where AI genuinely accelerates the process and where human judgment still leads — building on the Threat Hunting and Detection Engineering lessons in the Cybersecurity Learning Roadmap.
• 27
  From AI Security Operations to Maritime Cyber Resilience

  This closing lesson brings the whole picture together — AI-assisted SOC, Maritime IT/OT, and IACS UR E26/E27 — showing how this AI roadmap and the Cybersecurity Learning Roadmap converge on the same destination: Cyber Resilience.

Additional lessons — more topics may be added as this part develops.

EACH LESSON'S STRUCTURE

How Every Lesson Is Structured

To keep the series consistent and to make each lesson useful on its own as well as part of the roadmap, every lesson follows the same fixed structure:

• Why This Matters — why this technology or concept emerged
• What Is It? — a precise definition a general reader can follow
• How Does It Work? — the core structure and mechanism
• How It Evolved — what changed versus what came before
• Real Security / Engineering Context — how it's actually used in practice
• Current State — actual adoption level and technical maturity
• Technical Interpretation — the author's reading, kept separate from fact
• Maritime Connection — the link to maritime IT/OT and cyber resilience
• Security Considerations — security, reliability, and misuse potential
• What We Learned — a 3–5 point summary
• Where This Leads Next — the link to the following lesson
• Official Sources / Further Reading — primary sources first

How This Roadmap Connects to the Cybersecurity Roadmap

• 1AI-related lessons link to the relevant lesson in the Cybersecurity Learning Roadmap wherever a direct connection exists.
• 2AI-assisted SOC lessons connect to the SOC, SIEM, EDR/XDR, Threat Hunting, Detection Engineering, and SOAR lessons already outlined there.
• 3Maritime AI topics connect to Smart Ship, Maritime IT/OT, and autonomous-ship content as it publishes.
• 4If AI × IACS UR E26/E27 content is added, it will link both ways with the existing E26/E27 hub and related compliance lessons.
• 5The final lesson in this roadmap points explicitly to Maritime Cyber Resilience as the shared destination of both roadmaps.

This navigation hub is updated as lessons move from Planned to Published, with links added here as each one goes live.

The Goal of This Series

This roadmap does not stop at explaining AI. It explains why each technology developed the way it did, how that technology changes Security Operations, how it looks different again inside Maritime IT/OT, and ultimately how it contributes to Cyber Resilience — the same destination as the companion Maritime Cybersecurity Learning Roadmap.

Maritime 4.0 · AI & Cybersecurity Intelligence from Real Shipyard Experience
www.shippauljobs.com

⚓ Join the ShipPaulJobs Community

Join →