AI safety vs AI security

The two jobs

AI security asks: can someone steal data, jailbreak the model, or poison the supply chain? That is a CISO and AppSec problem. Courses in that lane look like TAISE, cloud security certs, and red-team workshops.

AI safety, in the sense Gabby Software trains, asks: can a PM, lawyer, or HR lead show that a human was in the loop? Disclosure, review triggers, and a policy an auditor can read. That is CASF. It is not a softer word for security.

Why the mix-up hurts teams who ship

Enterprise RFPs and the EU AI Act talk about human oversight and transparency. Security teams answer with prompt-injection controls. Both matter. They are not substitutes. A pentest report does not prove your recruiter knows what never goes in a prompt.

If you send a builder to a $795 security cert, they still cannot produce the one-page policy M0 trains in 90 minutes. If you send a CISO to CASF, they will be bored. Match the course to the job.

What to take

Need a badge that a human completed oversight training? CASF Foundations. Need to harden an API or a model endpoint? A security program. Need both? Sequence them. Do not buy one course and hope it covers the other word.