What are ISC2’s plans for an AI security certification?
ISC2 has announced that it is developing an AI security certification. This marks the start of a rigorous process to define what knowledge, skills and abilities cybersecurity professionals need to securely design, implement and manage AI systems in real-world environments.
Visit www.isc2.org/new-ai-certification for program updates, opportunities to volunteer and instructions for taking the pilot exam when registration opens.
Is this a new certification I can take right now?
No. This is the start of the certification development process, not the launch of an operational certification. ISC2 is currently focused on defining what the certification should be before building and validating the exam.
What happens during the development process?
ISC2 certifications are built in phases:
- Definition – ISC2 will engage volunteers including ISC2 members and non-members around the world to identify the knowledge, skills and abilities necessary to securely design, implement and manage AI systems.
- Development – ISC2 will engage ISC2 member volunteers from around the world to create items and questions for a pilot exam that validate the knowledge, skills and abilities identified during the definition phase.
- Delivery – ISC2 will administer pilot exams and analyze results to ensure the exam accurately validates candidates’ knowledge, skills and abilities identified in the exam development process.
If the pilot exam is successful, the AI security certification will transition to an operational certification program within ISC2’s portfolio.
How long does the certification development process take?
ISC2 anticipates administering a pilot exam in late 2026. Visit www.isc2.org/new-ai-certification for program updates, opportunities to volunteer and instructions for scheduling the pilot exam when registration opens.
Why is ISC2 taking this approach instead of launching something quickly?
ISC2 certifications are built for long-term value, trust and global recognition. That requires input from the profession, validation of real-world skills and a structured development process. It is not about speed to market.
ISC2 certifications meet the world’s highest accreditation standards. Our AI security certification will be developed and maintained to the same rigorous standards that members, employers and the broader cybersecurity community expect from ISC2 credentials.
Why is ISC2 developing an AI security certification now?
AI is reshaping cybersecurity work, and introducing new risks, responsibilities and skills requirements. ISC2 has been monitoring and acting upon the AI’s impact within the profession. AI security concepts are already integrated throughout more than 50 cybersecurity exam domains across ISC2’s entire certification portfolio.
Through ongoing Job Task Analysis (JTA), exam blueprint development, item writing, peer review, standard setting and publishing cycles, input from volunteer subject matter experts underscores the need for a clear, trusted standard for AI security expertise. ISC2 is leading the effort to ensure the profession and employers can adopt that standard with a new AI security certification.
What problem is this certification intended to solve?
Organizations and professionals are adopting AI quickly, but there is no shared standard for what “AI security expertise” means. This certification is intended to define that standard and provide a credible way to validate it.
Why is an AI security certification necessary if ISC2 has already incorporated AI into its existing certifications?
ISC2 has already integrated AI-related knowledge across its existing certification portfolio to reflect how AI is shaping cybersecurity work today. However, as AI continues to evolve, it is also creating new and more specialized responsibilities, risks and roles that go beyond the scope of existing certifications.
This new certification is being developed to define and validate those emerging areas of expertise by providing a clearer standard for professionals whose roles require dedicated AI security knowledge and giving them an opportunity to distinguish themselves in a competitive job market.
ISC2 believes the time is right to develop a certification that reflects both the breadth of AI’s impact across cybersecurity and the emergence of new, specialized areas of practice. This is all informed directly by the cybersecurity community and grounded in real-world professional requirements.
What is the value for a cybersecurity professional to earn another certification?
As organizations increasingly prioritize AI security, employers are looking for trusted ways to identify professionals with the specific skills needed to secure AI systems and address AI-driven threats. Professionals can help differentiate themselves in an AI world with an AI security certification that proves they have the ability to secure AI systems.
Who will this certification be for?
ISC2 is working with the cybersecurity community to determine exactly who the certification should serve. It is expected to support professionals whose roles are evolving as AI becomes integrated into cybersecurity operations, as well as those roles that may evolve to require specific AI systems security expertise.
What kinds of roles might this certification apply to?
Roles are still being defined as part of the process. However, AI security responsibilities are already emerging across areas like:
- Security and Risk Management
- Security Architecture and Engineering
- Communication and Network Security
- Security Assessment and Testing
- Security Operations
- Software Development Security
- Governance, Risk and Compliance
The certification will reflect how these roles are evolving in practice.
How can cybersecurity professionals get involved?
ISC2 is inviting professionals worldwide to contribute by:
- Participating in Job Task Analysis surveys
- Attending item development workshops
- Supporting exam development
- Taking the pilot certification exam
Volunteer participation is critical throughout the entire certification development process, and your input directly shapes the certification.
Visit www.isc2.org/new-ai-certification for program updates, opportunities to volunteer and instructions for scheduling the pilot exam when registration opens.
What kind of experience is ISC2 looking for in volunteers to help develop the AI security certification?
All professionals interested in helping develop the AI security certification can complete the volunteer form. Professionals experienced in areas like AI risk assessment, secure-by-design AI development, AI systems security, regulatory compliance, AI governance and ethics, and other aspects of AI security are encouraged to participate and share their expertise.
Why should I participate in the development process?
AI’s impact on the cybersecurity profession is going to redefine the workplace, roles, responsibilities, tasks and more. This is a rare opportunity for those working in the field to help define what AI security means for the profession. Your input will influence what skills are necessary, how skills are validated, and how organizations and employers will assess AI security expertise in the future. And you’ll earn Continuing Professional Education (CPE) credits for your time!
Do I need an ISC2 certification to participate?
No. ISC2 is seeking input from the global cybersecurity community. We NEED cybersecurity professionals who do not hold any ISC2 certifications to participate to ensure the certification reflects diverse real-world perspectives.
Should employers encourage their teams to participate?
Yes. Employers can help ensure the certification will reflect the skills and capabilities their teams actually need to secure AI systems and respond to emerging threats.
How does this relate to ISC2’s existing AI training and certificates?
ISC2 already offers AI courses, workshops and certificates to help professionals learn and build skills. This new certification is intended to validate skills at a professional level.
How is this different from ISC2’s AI Security Certificate?
The ISC2 AI security certificate focuses on learning and skill development. It is a one-time demonstration of learning.
The AI security certification will be a formal credential designed to validate professional competence through ISC2’s certification process, requiring ongoing continuing education and renewal.
What will be covered in the certification exam?
The exam content is not yet finalized. ISC2 is working with the community to determine the knowledge, skills and abilities the certification exam should cover based on real-world needs.
When will the certification be available?
The certification is not expected to become operational until 2027. The current focus is on building and validating the certification through its development and pilot phases.
Will there be a pilot exam?
Yes. ISC2 plans to administer a pilot exam period later in the process to validate the certification and ensure it accurately reflects the intended roles and responsibilities.
Will there be a fee to take the pilot exam?
This has not yet been determined. We will provide instructions for how to register for the exam at a later date.
Will pilot participants get guidance before the exam?
Yes. Pilot exam candidates will be able to access a pilot exam outline to help them understand the scope and structure of the exam before participating.
Will there be prerequisites or experience requirements?
Requirements have not yet been defined. They will be determined as part of the development process based on the roles and responsibilities the certification is designed to support.
If I pass the pilot exam, will I earn the certification?
Yes. Assuming the pilot exam program is successful, and the pilot exam becomes the operational certification scheme, a pilot exam candidate who successfully passes the exam and satisfies any experience requirements will be among the first to earn the new AI security certification.
Will existing ISC2 certifications count toward any experience waivers?
That has not been determined. ISC2 will evaluate potential pathways, including how existing certifications may relate, after the certification scope and requirements are finalized.
Will a course be available for the pilot certification exam?
No. Official ISC2 courses will be available after the certification becomes operational. Training cannot be released earlier because the final certification structure must first be defined and validated.
When will details, like the certification name and pricing, be announced?
Details such as the certification name, pricing and availability will be announced after the pilot phase concludes, if ISC2 decides to move forward with an operational certification launch.
How will employers use this certification once it’s available?
The certification is intended to give employers a trusted, globally recognized way to validate AI security expertise and assess workforce readiness in an increasingly AI-driven environment.
What makes this initiative significant for the cybersecurity profession?
AI is fundamentally changing how cybersecurity work is performed. This effort represents a critical step in defining how the profession adapts, ensuring there is a shared understanding of what it means to securely work with AI systems and manage AI-related risk.
How much will it cost?
The cost of the certification has not yet been determined. ISC2 is currently focused on defining and validating the certification before establishing pricing, which will be announced at a later stage if the certification becomes operational.
How many years of experience will be required?
Experience requirements have not yet been defined. ISC2 will determine eligibility criteria after the certification scope is finalized to ensure requirements align with the roles and responsibilities the certification is designed to support.
What will the maintenance requirements be for keeping this certification?
Continuing Professional Education (CPE) requirements have not yet been established. These will be defined as part of the final certification framework, once the certification has been fully developed and validated.
How much will the Annual Maintenance Fees (AMFs) be?
Annual Maintenance Fees (AMFs) for this certification have not yet been determined. However, it is expected that AMFs will be in line with our broader certification portfolio of U.S. $135.
When will courses be available?
Official ISC2 courses will be available after the certification becomes operational. Per accreditation standards, the ISC2 education team cannot begin developing courses until the operational certification scheme and exam outline are finalized and publicly released.
Certification courses are not required to sit for an ISC2 exam.
What will the certification be called?
The name of the certification has not yet been determined. ISC2 is currently focused on defining the certification before finalizing elements such as name. These details will be announced later in the process, after the certification has been developed and validated through the pilot phase.
