AI Security Certification

Building the global standard for AI security certification.

Define the Future of AI Security with ISC2

ISC2 is developing a new AI security certification and inviting the cybersecurity community to help build it. With AI transforming how cybersecurity work is performed, now is the moment to define what it means to securely design, deploy and manage AI systems.

Developing a certification is a rigorous and collaborative effort, and the progress made to date reflects the dedication and expertise of over 9,000 volunteers working in partnership with ISC2 teams. Together, we are standardizing the knowledge, skills and abilities required to secure AI systems, manage AI threats and mitigate AI risk.

Next, this project will advance to the delivery phase where approximately 3,000 volunteers will be invited to participate in the pilot exam based on the Artificial Intelligence Security Pilot Exam Outline.

A Certification. A Standard. A Moment for the Profession.

ISC2 has begun a rigorous, standards-based process spanning three phases to develop a new AI security certification:

Definition – ISC2 will engage volunteers including ISC2 members and non-members around the world to identify the knowledge, skills and abilities necessary to securely design, implement and manage AI systems.

Development – ISC2 will engage ISC2 member volunteers from around the world to create items and questions for a pilot exam that validate the knowledge, skills and abilities identified during the definition phase.

Delivery – ISC2 will administer pilot exams and analyze results to ensure the exam accurately validates candidates’ knowledge, skills and abilities identified in the exam development process.

If the pilot exam is successful, the AI security certification will transition to an operational certification program within ISC2’s portfolio.

The Cybersecurity Profession Must Define AI Security

AI is no longer theoretical in cybersecurity. Professionals are already:

Using AI to analyze threats
Securing AI-enabled systems
Making decisions based on AI outputs
Governing AI systems, policies and agents

But there is no global standard for:

What skills are required
How roles are evolving
How expertise is validated

Meanwhile, organizations are already looking for professionals who can secure AI systems. But without a standard, it is difficult to assess or verify knowledge, skills and abilities. That is why your participation matters. Help us define what it takes for a professional to secure AI systems.

Your participation will influence:

What critical skills and competencies are identified
How expertise is assessed and validated
How employers evaluate the AI security capabilities of their teams

This engagement is a rare opportunity to help shape how the profession evolves. Participation now will directly influence the certification’s structure, scope and long-term relevance.

Loading component...

Program Progress
Updated October 26, 2026

More than 9,500 volunteers from more than 150 countries have expressed interest in participating in AI security certification development activities.
First Job Task Analysis (JTA) workshops were held in Alexandria, VA, London and Singapore in August 2026 to define a recommended certification scheme and exam outline.
Job Task Analysis Survey closed with over 1,100 responses from those who expressed interest via our volunteer form, further validating initial findings from the in-person workshops.
A second Job Task Analysis (JTA) workshop to finalize the pilot exam outline and certification scheme recommendations was held in Alexandria, VA with participants representing global inclusivity.
Item Development Workshops are underway for ISC2 member participation. Remote workshop opportunities will run through December 18. In-person item review workshops have concluded in Alexandria, VA, and London. Singapore review workshops are in progress. Item Review workshops will be held in Denver, CO, both before and after ISC2 Security Congress.

AI Security Certification Exam Outline

The ISC2 AI Security Certification is designed for experienced cybersecurity professionals—including security architects, engineers, operations leads, risk managers, and strategists—responsible for leading, assessing, and governing the secure and responsible adoption of artificial intelligence. It validates the critical knowledge, skills, and judgment required to secure AI models and infrastructure, defend against adversarial AI-driven attacks, and effectively leverage AI technologies to augment security operations, assurance testing, and threat detection.

Bridging strategic oversight and technical execution, credential holders demonstrate the competence to integrate AI into enterprise security architecture, risk management, ethical governance, and regulatory compliance frameworks. They possess the practical acumen required to evaluate third-party AI services, establish robust security controls, challenge technical decisions, and determine when specialized technical expertise is necessary—making this the definitive credential for cybersecurity professionals navigating the dual imperative of securing AI and utilizing AI for defense across both strategy and operations.

The broad spectrum of topics included in the AI security pilot exam outline ensure its relevancy across all disciplines in the field of information security. Successful candidates are competent in the following six domains:

Artificial Intelligence (AI) Concepts and Security Fundamental
AI Governance, Ethics, Risk, and Compliance
AI Data Management, Privacy, and Model Security
Secure AI Architecture, Engineering, and Identity and Access Management (IAM)
Secure AI Operations and Incident Response (IR)
AI Threats, Testing, and Lifecycle Management

Experience Requirements

Candidates must have a minimum of four years cumulative, paid full-time experience in cybersecurity or AI-related fields. Two years must be in cybersecurity, and one year must be in two or more of the domains of the AI Security Certification Exam Outline. An active CISSP, ISSAP, ISSEP, ISSMP, CCSP, or CSSLP credential may be substituted for the entire AI Security Certification experience requirement.

Earning a post-secondary degree (bachelors or masters) in computer science, Information Technology (IT), Science, Technology, Engineering, Math (STEM), or related fields may satisfy up to one year of the required experience. Only one year of experience can be waived. Part-time work and internships may also count towards the experience requirement.

AI Security Pilot Examination Information

Length of exam	3 hours
Number of items	160
Item format	Multiple choice
Exam language availability	English
Testing center	Pearson Professional Center (PPC)

AI Security Examination Weights

Domains	Weight
1. Artificial Intelligence (AI) Concepts and Security Fundamentals	10%
2. AI Governance, Ethics, Risk, and Compliance	17%
3. AI Data Management, Privacy, and Model Security	19%
4. Secure AI Architecture, Engineering, and Identity and Access Management (IAM)	18%
5. Secure AI Operations and Incident Response (IR)	19%
6. AI Threats, Testing, and Lifecycle Management	17%
Total	100%

Loading component...

Domains

1.1 - Artificial Intelligence (AI) Concepts and Security Fundamentals

AI types, evolution, and the broader AI ecosystem
ML paradigms (e.g., supervised, unsupervised, reinforcement)
Deep learning and evolutionary computation
Neural networks (e.g., Convolutional Neural Networks (CNN), Recurrent Neural Networks (RNN), transformers)
AI hardware infrastructure (e.g., Graphics Processing Unit (GPU), Tensor Processing Unit (TPU), memory)

1.2 - Analyze Generative Artificial Intelligence (GenAI) and Modern Architectures

GenAI, language, and multi-modal models
Prompt engineering concepts
Retrieval-Augmented Generation (RAG)
Model fine-tuning techniques (e.g., Low-Rank Adaptation (LoRA), Parameter-Efficient Fine-Tuning (PEFT))
Autonomous systems, agents, and Agentic AI (e.g., agent-to-agent, session persistence, memory)
Natural Language Processing (NLP) building blocks
Embeddings and context windows
Token management
Vector databases

1.3 - Evaluate AI Limitations and Performance

Model reliability limitations (e.g., hallucinations, non-determinism, uncertainty)
Lifecycle degradation (e.g., model, data, and behavioral drift)
Model collapse
Standard evaluation metrics and benchmarks
Operational modes (e.g., Human-in-the-Loop (HITL) vs. automated execution)

1.4 - Apply Data Management and Privacy in AI

Data types and collection parameters (e.g., structured vs. unstructured)
Data lifecycle stages (e.g., acquisition, extraction, cleaning, transformation, labeling)
Data quality standards (e.g., accuracy, completeness, relevance)
Data provenance
Privacy preservation techniques (e.g., tokenization, k-anonymity, masking, synthetic data)

1.5 - Identify AI Security Fundamentals and Threats

Zero Trust (ZT) principles in AI
Adversarial threats (e.g., prompt injection, jailbreaking, evasion, exfiltration)
Model inversion and data poisoning
Common AI threat frameworks (e.g., Open Worldwide Application Security Project (OWASP), National Institute of Standards and Technology (NIST), MITRE Adversarial Threat Landscape for Artificial-Intelligence Systems (ATLAS))

1.6 - Implement AI Controls, Safeguards, and Principles

Large Language Model (LLM) guardrails (e.g., input/output validation, toxicity detection)
Responsible AI principles (e.g., transparency, explainability, fairness, bias awareness)
Model verification techniques
Isolation techniques for AI environments

1.7 - Analyze AI Solutions and Use Cases

AI deployments in business workflows and software development
Industry-specific use cases (e.g., healthcare, finance, law enforcement)
AI for security operations (e.g., threat analysis, vulnerability management, security automation)

2.1 - Establish AI Governance, Frameworks, and Policies

Core AI regulations and standards (e.g., European Union (EU) AI Act, NIST AI Risk Management Framework (AI RMF), International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 42001, General Data Protection Regulation (GDPR))
Differences between AI governance and traditional Information Technology (IT) governance
AI policies, standards, and procedures
Centralized AI use-case inventories
Organizational roles (e.g., Chief AI Officer, AI Champions, AI Ethics Officer)

2.2 - Apply Responsible AI Principles and Ethics

Core Responsible AI principles (e.g., fairness, reliability, safety, privacy, inclusiveness, transparency)
Algorithmic bias mitigation and fairness across protected groups
AI transparency and explainability
Systemic impacts, sustainability, and societal tradeoffs of AI deployments

2.3 - Implement AI Risk Management and Assessments

AI-specific risk quantification and mapping
Impact assessments (e.g., algorithmic risk, blast radius, autonomous actions)
Use-case risk tiers based on human impact and technical complexity
Risk treatments for AI components
Reassessment triggers (e.g., model updates, behavioral drift, vulnerability disclosures)

2.4 - Ensure Data Privacy, Protection, and Intellectual Property (IP) Rights

Regulated and sensitive data types (e.g., Personally Identifiable Information (PII), Protected Health Information (PHI), financial, export-controlled)
IP, copyright compliance, and fair use of training data
Risks of data derivation and regulatory contamination
Data retention and deletion management
Consent mechanisms for data collection and public data usage

2.5 - Manage Third-Party and AI Supply Chain Risks

Third-party AI due diligence and provider security controls
Procurement controls, security Service-Level Agreements (SLA), and incident notification rights
AI component dependency tracking (e.g., Software Bill of Materials (SBOM) and AI Bill of Materials (AIBOM))
Shared responsibility models
Data center security considerations (e.g., Trusted Execution Environments, confidential computing)

2.6 - Enforce Accountability, Human Oversight, and Auditing

Human-in-the-Loop (HITL) and Human-on-the-Loop (HOTL) oversight
Intervention, override, and sign-off authorities
Shadow AI detection and management
Governance artifacts (e.g., model documentation, decision logs, exception records)
AI interaction labeling (e.g., synthetic content, deepfake disclosure)
Internal and external audits for compliance, bias, drift, and business outcomes

2.7 - Develop AI Security Education and Awareness

Skills assessments and gap analyses for AI operator competence
Role-based AI security and ethics training programs
Metrics for training program effectiveness and risk-aware culture

3.1 - Establish AI Data Governance, Lineage, and Accountability

Data ownership roles (e.g., information owner, steward, controller)
Data sovereignty and cross-border residency requirements
Data classification, tagging, and sensitive data impact assessments
Data provenance, lineage, and sourcing (e.g., real vs. synthetic)
Chain-of-custody controls
AI data lifecycle (e.g., collection, validation, transformation, retention, archiving, deletion)

3.2 - Implement Data Privacy and Compliance Controls

Privacy by Design principles (e.g., consent, purpose limitation, lawful usage, data minimization)
Data protection techniques (e.g., tokenization, anonymization, differential privacy, masking, noise injection)
Global privacy regulations (e.g., General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA), Payment Card Industry Data Security Standard (PCI DSS))
AI-specific privacy challenges (e.g., unintentional bias, right to erasure)

3.3 - Secure AI Training Data and Datasets

Training data integrity
Mitigation of data poisoning, backdoors, and extraction threats
Protection against unauthorized label modification and malicious datasets
Dataset tampering and versioning
Recursive training data security and synthetic data trustworthiness

3.4 - Apply Cryptographic and Data Protection Solutions

Data Security Posture Management (DSPM)
Data Loss Prevention (DLP) and semantic filtering on AI inputs/outputs
Encryption for data states (e.g., in use, in transit, at rest)
Key management lifecycle (e.g., Key Management Service (KMS), Bring Your Own Keys (BYOK), secret management, key rotation)
Purpose-based and restricted data access controls (e.g., Agentic AI data catalogs)
Media sanitization on high-density AI storage (e.g., cryptographic erasure, micro-shredding)

3.5 - Manage AI Model Lifecycle and Security Governance

Model governance (e.g., ownership, risk classification, approval workflows)
Model documentation and approved model registries (e.g., model cards)
Model deployment pipeline security (e.g., validation, packaging, serving, credential management)
Input/output sanitization, updates, and rollback procedures
Security lifecycle monitoring (e.g., model drift, bias tracking, anomaly detection)
Privacy-preserving audit trails for AI data events

3.6 - Ensure Model Confidentiality, Integrity, and Availability

Model confidentiality (e.g., secure model weights, algorithms, IP)
Model extraction prevention
Model watermarking and fingerprinting
Model integrity (e.g., model signing, hashing, version control)
Model availability controls (e.g., rate limiting, quota enforcement, graceful degradation)

3.7 - Assess AI Data and Model Supply Chain Risks

Supply chain risk assessments for third-party, open, and public datasets
Provenance and authenticity verification for third-party vendors
Risks associated with foundation and pre-trained models

4.1 - Apply AI Architecture and Secure Design Principles

AI-specific security strategies (e.g., Zero Trust (ZT), Defense-in-Depth (DiD), Privacy-by-Design, Secure Defaults)
AI threat modeling across architectural components (e.g., Retrieval Augmented Generation (RAG), vector databases, inference)
Architectural trade-offs (e.g., latency vs. explainability vs. cost)
Build vs. buy evaluations (e.g., hosted vs. self-managed)
Secure integration for tools, Application Programming Interfaces (API), and plugins (e.g., Model Context Protocol (MCP), Agent-to-Agent (A2A))

4.2 - Architect Secure AI Infrastructure and Platforms

Hardening of cloud, on-premises, and hybrid AI deployments
Isolation and sandboxing for AI training and inference workloads
Availability controls against resource exhaustion (e.g., rate limiting, compute throttling)
Isolated accelerator capacity
Physical and environmental security (e.g., data center power, cooling, rack security, fire suppression)

4.3 - Secure Data and Model Deployment Pipelines (e.g., MLOps/LLMOps)

Secure CI/CD and model deployment pipelines (e.g., packaging, containerization)
Integrity and confidentiality controls for data ingestion and transformation
Lineage tracking for fine-tuning
Validation checkpoints and pipeline gating patterns
Data unlearning capabilities for trained artifacts

4.4 - Design and Implement AI Guardrails and Controls

AI input/output handling (e.g., prompt sanitization, content filtering, context boundary validation)
Architectural guardrails for autonomous AI behavior (e.g., harness, orchestration)
Functional, performance, and load testing
Stress testing and exception handling validation

4.5 - Implement AI Identification and Authentication Strategies

Classification of human vs. non-human identities (e.g., workloads, agents, services, tools)
Identity architectures for non-repudiation and verified accountability
Machine-to-Machine (M2M) authentication protocols and API tokens
Federated identities, Multi-Factor Authentication (MFA), and Single Sign-On (SSO)
Secrets and key management for AI platforms

4.6 - Design and Enforce AI Authorization and Access Controls

Principle of Least Privilege (PoLP) and Separation of Duties (SoD) across AI models and agentic workflows
Authorization methodologies and Just-in-Time (JIT) access (e.g., RBAC, ABAC, PBAC)
Execution boundaries and API scope limitations
Prevention of excessive agency, over-delegation, and lateral movement by autonomous Agents

4.7 - Manage Identity Lifecycle and Auditing

AI identity inventories (e.g., human, non-human)
Provisioning and deprovisioning transitions
Periodic access reviews and Identity Security Posture Management (ISPM)
Audit of AI resource utilization (e.g., token accounting, rate limits, session time-outs)

5.1 - Establish AI SecOps Foundations and Operational Readiness

Core security principles in AI operations (e.g., Principle of Least Privilege (PoLP), Separation of Duties (SoD))
AI operational roles and responsibilities (e.g., model owners, data owners)
Release requirements (e.g., human override baselines, reject rate thresholds)
Operational playbooks, runbooks, and tabletop simulations (e.g., data poisoning, model tampering)
Configuration Management (CM), automated model updates, and configuration drift tracking

5.2 - Monitor, Log, and Collect AI Security Telemetry

AI telemetry data (e.g., prompts, completions, embeddings, tool calls, Application Programming Interface (API) traffic)
AI event correlation across Security Information and Event Management (SIEM), Security Orchestration, Automation and Response (SOAR), and threat intelligence pipelines
Log integrity and evidence documentation
Privacy-preserving telemetry masking
Real-time monitoring of AI behavior, performance drift, and agent actions

5.3 - Detect Runtime Threats, Misuse, and Compromises

Runtime threat detection (e.g., inputs, prompts, retrieval chains, outputs, resource consumption)
AI access and agency misuse (e.g., unauthorized identities, over-privileged agents)
Secret exposure and tool execution anomalies
AI asset and lifecycle integrity (e.g., data, knowledge bases, models, deployment pipelines)
AI-driven security operations (e.g., User and Entity Behavior Analytics (UEBA), automated alert triage, threat hunting)

5.4 - Manage AI Vulnerabilities and Asset Posture

Model vulnerability and exposure registers
Context and consequence prioritization
Patch management for AI pipelines, dependencies, and open-source components
Compensating controls and strict usage restrictions for legacy models
Continuous AI security reviews and posture assurance metrics

5.5 - Respond to and Contain AI Security Incidents

AI-specific triage taxonomy (e.g., prompt injection, jailbreaking, data poisoning, model theft)
Multi-disciplinary escalation paths (e.g., SecOps, MLOps, data science, legal, compliance)
AI-specific containment actions (e.g., model rollback, endpoint isolation, rate limiting)
Pipeline suspension and agent termination
Preservation of investigative artifacts (e.g., model states, weights, configurations, dataset snapshots)

5.6 - Investigate, Eradicate, and Perform Forensics on AI Incidents

Attack kill chain reconstruction (e.g., data poisoning, untrusted tool outputs)
Root Cause Analysis (RCA), forensics, and timeline tracking
Threat actor attribution
Threat eradication (e.g., data sanitization, model retraining, patching vulnerabilities)
Safety regression testing prior to production reintroduction

5.7 - Execute Recovery, Business Continuity (BC), and Post-Incident Reviews

Recovery strategies (e.g., trusted model rollback, clean checkpoint restoration, vector-store recovery)
AI circuit breakers and kill switches
Business Continuity and Disaster Recovery (BC/DR) plans and critical AI dependency Mapping
Post-incident reviews, lessons learned, and Tactics, Techniques, and Procedures (TTP) register updates
Secure decommissioning, disposal, and remediation (e.g., machine unlearning, model termination)

6.1 - Conduct AI Threat Modeling and Intelligence

Threat modeling methodologies for AI/ML pipelines (e.g., Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE), Process for Attack Simulation and Threat Analysis (PASTA), Multi-Agent Environment, Security, Threat, Risk, & Outcome (MAESTRO))
AI threat actors, objectives, and insider threats (e.g., human, non-human)
Adversarial ML attacks (e.g., evasion, poisoning, model extraction, model inversion, backdoors)
Threats specific to GenAI, RAG, agentic workflows, and multimodal systems
Availability attacks (e.g., compute, token exhaustion)

6.2 - Manage Secure AI Development Lifecycle (AIDLC) and Change Management

Security integration across the AI/ML pipeline and CI/CD environments (e.g., MLOps/LLMOps)
Environmental control adaptations (e.g., separation, PoLP, secure API integration)
AI-specific change management (e.g., model, dataset, retrieval versioning)
Staged rollouts and rollback procedures (e.g., canary deployments)

6.3 - Secure AI Supply Chain, Procurement, and Provenance

Third-party vendor risks, certifications, and assessment reports
AI acquisition practices, data ownership, licensing, and legal/regulatory considerations
Pedigree and provenance verification (e.g., cryptographic hashing, digital signatures)
AI Bill of Materials (AI-BOM) for hardware, software, and data dependencies

6.4 - Design and Execute AI Security Testing and Red Teaming

Scope, objectives, and test scenarios for AI security assessments
Adversarial testing targeting GenAI, RAG, and Agentic AI architectures
AI red teaming methodologies
AI-assisted security tools for evaluating AI controls and novel attack paths

6.5 - Evaluate, Validate, and Report Assessment Findings

Triage of assessment findings (e.g., severity, exploitability, reproducibility, business impact)
Differentiation between security vulnerabilities and model limitations (e.g., hallucinations)
Correlation of findings against industry frameworks (e.g., MITRE ATLAS, OWASP LLM Top 10)
Documentation of evidence and reproducibility steps
Risk communication strategies for stakeholders (e.g., technical vs. non-technical)

6.6 - Define, Implement, and Validate Mitigations

Targeted mitigations (e.g., adversarial training, provenance tracking, data validation)
Filtering, sandboxing, rate limiting, and watermarking
Mitigation prioritization based on risk feasibility and business context
Mitigation validation via regression testing
Continuous monitoring for residual risks

Loading component...

What are ISC2’s plans for an AI security certification?

ISC2 has announced that it is developing an AI security certification. This marks the start of a rigorous process to define what knowledge, skills and abilities cybersecurity professionals need to securely design, implement and manage AI systems in real-world environments.

Visit www.isc2.org/new-ai-certification for program updates, opportunities to volunteer and instructions for taking the pilot exam when registration opens.

What happens during the development process?

ISC2 certifications are built in phases:

Definition – ISC2 will engage volunteers including ISC2 members and non-members around the world to identify the knowledge, skills and abilities necessary to securely design, implement and manage AI systems.
Development – ISC2 will engage ISC2 member volunteers from around the world to create items and questions for a pilot exam that validate the knowledge, skills and abilities identified during the definition phase.
Delivery – ISC2 will administer pilot exams and analyze results to ensure the exam accurately validates candidates’ knowledge, skills and abilities identified in the exam development process.

If the pilot exam is successful, the AI security certification will transition to an operational certification program within ISC2’s portfolio.

Why is ISC2 taking this approach instead of launching something quickly?

ISC2 certifications are built for long-term value, trust and global recognition. That requires input from the profession, validation of real-world skills and a structured development process. It is not about speed to market.

ISC2 certifications meet the world’s highest accreditation standards. Our AI security certification will be developed and maintained to the same rigorous standards that members, employers and the broader cybersecurity community expect from ISC2 credentials.

Why is ISC2 developing an AI security certification now?

AI is reshaping cybersecurity work, and introducing new risks, responsibilities and skills requirements. ISC2 has been monitoring and acting upon the AI’s impact within the profession. AI security concepts are already integrated throughout more than 50 cybersecurity exam domains across ISC2’s entire certification portfolio.

Through ongoing Job Task Analysis (JTA), exam blueprint development, item writing, peer review, standard setting and publishing cycles, input from volunteer subject matter experts underscores the need for a clear, trusted standard for AI security expertise. ISC2 is leading the effort to ensure the profession and employers can adopt that standard with a new AI security certification.

What problem is this certification intended to solve?

Organizations and professionals are adopting AI quickly, but there is no shared standard for what “AI security expertise” means. This certification is intended to define that standard and provide a credible way to validate it.

Why is an AI security certification necessary if ISC2 has already incorporated AI into its existing certifications?

ISC2 has already integrated AI-related knowledge across its existing certification portfolio to reflect how AI is shaping cybersecurity work today. However, as AI continues to evolve, it is also creating new and more specialized responsibilities, risks and roles that go beyond the scope of existing certifications.

This new certification is being developed to define and validate those emerging areas of expertise by providing a clearer standard for professionals whose roles require dedicated AI security knowledge and giving them an opportunity to distinguish themselves in a competitive job market.

ISC2 believes the time is right to develop a certification that reflects both the breadth of AI’s impact across cybersecurity and the emergence of new, specialized areas of practice. This is all informed directly by the cybersecurity community and grounded in real-world professional requirements.

What is the value for a cybersecurity professional to earn another certification?

As organizations increasingly prioritize AI security, employers are looking for trusted ways to identify professionals with the specific skills needed to secure AI systems and address AI-driven threats. Professionals can help differentiate themselves in an AI world with an AI security certification that proves they have the ability to secure AI systems.

Is this a new certification I can take right now?

This December ISC2 will begin to administer pilot exams and analyze results to ensure the exam accurately validates candidates’ knowledge, skills and abilities identified in the exam development process. During this time, the examination is only open to selected candidates who completed the volunteer interest form by November 4, 2026.

Who will this certification be for?

What kinds of roles might this certification apply to?

The AI Security Certification Professional is responsible for securing the design, deployment, and maintenance of Artificial Intelligence (AI) and Machine Learning (ML) systems throughout the entire AI lifecycle. This role leads the ongoing identification, assessment, treatment, and monitoring of cybersecurity risks associated with AI-enabled services. Key technical responsibilities include identifying vulnerabilities within AI pipelines, ensuring robust data privacy, and actively defending against adversarial threats such as model poisoning and prompt injection.

Beyond technical defense, the AI Security Certification Professional collaborates across the enterprise to establish comprehensive governance and security requirements. By evaluating the effectiveness of both technical and organizational controls and providing ethical, risk-based guidance, this professional ensures that all AI solutions operate securely, responsibly, and in strict compliance with organizational policies.

Example Job Titles:

AI Infrastructure Security Architect
AI Risk and Governance Analyst
AI Security Engineer
AI Trust and Safety Manager
Data Privacy and AI Compliance Officer
Machine Learning (ML) Security Specialist SecOps Engineer
Chief AI Officer
Chief Data Officer
SOC Analyst
Forward Deployed Engineer
Third-Party Risk Manager
Forensics Analyst
AI Security Consultant

What kind of experience is ISC2 looking for in volunteers to help develop the AI security certification?

All professionals interested in helping develop the AI security certification can complete the volunteer form. Professionals experienced in areas like AI risk assessment, secure-by-design AI development, AI systems security, regulatory compliance, AI governance and ethics, and other aspects of AI security are encouraged to participate and share their expertise.

Why should I participate in the development process?

AI’s impact on the cybersecurity profession is going to redefine the workplace, roles, responsibilities, tasks and more. This is a rare opportunity for those working in the field to help define what AI security means for the profession. Your input will influence what skills are necessary, how skills are validated, and how organizations and employers will assess AI security expertise in the future. And you’ll earn Continuing Professional Education (CPE) credits for your time!

Do I need an ISC2 certification to participate?

No. ISC2 is seeking input from the global cybersecurity community. We NEED cybersecurity professionals who do not hold any ISC2 certifications to participate to ensure the certification reflects diverse real-world perspectives.

Should employers encourage their teams to participate?

Yes. Employers can help ensure the certification will reflect the skills and capabilities their teams actually need to secure AI systems and respond to emerging threats.

How does this relate to ISC2’s existing AI training and certificates?

ISC2 already offers AI courses, workshops and certificates to help professionals learn and build skills. This new certification is intended to validate skills at a professional level.

How is this different from ISC2’s AI Security Certificate?

The ISC2 AI security certificate focuses on learning and skill development. It is a one-time demonstration of learning.

The AI security certification will be a formal credential designed to validate professional competence through ISC2’s certification process, requiring ongoing continuing education and renewal.

When will the certification be available?

The certification is not expected to become operational until 2027. The current focus is on building and validating the certification through its development and pilot phases.

Loading component...

What is a certification pilot program?

Before a certification program becomes formally operational, a rigorous process of exploration, research and validation is necessary to ensure the qualification meets its intended purpose, as well as the demanding standards of the cybersecurity community. The pilot program for a potential AI security certification has entered the phase where we need participants to sit for the pilot exam. We are looking for existing cybersecurity and/or AI individuals with four years cumulative, paid full-time experience in cybersecurity or AI-related fields interested in taking the pilot exam. This will enable us to evaluate the effectiveness of the exam and its ability to accurately assess candidates’ grasp of the subject matter (also called domains) on which the exam is based.

What will be covered in the certification pilot exam?

Pilot exam candidates can now access the pilot exam outline to help them understand the scope and structure of the exam before participating.

When will ISC2 begin administering the AI Security certification pilot exam?

The initial pilot exam administration period begins mid-December. Registration for the pilot exam opens for candidates that are selected from the volunteer interest list mid-November, with appointments currently available until late January 24, 2027. The pilot exam administration period may be shortened or extended depending on the number or participants taking the exam. We recommend that any interested candidates schedule their exam as early as possible. Any unused authorizations or undelivered exams that are a part of this pilot will not be converted to the regular certification program once it becomes available.

Where will the pilot exam be administered?

Pilot exams will be administered in the English language at ISC2-authorized Pearson Professional Centers only. This examination will not be available at Pearson Authorized Test Centers, learn more. Due to the nature of the pilot program special accommodations cannot be offered. For questions, please contact ExamAdministration@isc2.org

Can I take the exam online?

No. The AI Security pilot exam will only be available in person at ISC2-authorized Pearson Professional Centers (PPCs).

How do I volunteer for the pilot exam?

Candidates may volunteer for the pilot exam by completing the Volunteer Interest Form before November 4, 2026. Space is limited to 3,000 candidates. Please note that while you do not need to be an ISC2 member to volunteer a valid ISC2 account is required to receive the exam authorization and proceed with scheduling.

What topics are covered by this exam?

There are six domains to this certification, listed below. For further details, visit the https://www.isc2.org/new-ai-certification.

Is there any education available for candidates pursing the pilot exam?

Not at this time. ISC2 will offer a choice of flexible options after the ISC2 Board approves the certification scheme. To prepare for the pilot exam candidates should refer to the exam outline and the suggested references.

Will a course be available for the pilot certification exam?

No. Official ISC2 courses will be available after the certification becomes operational. Certification courses are not required to sit for an ISC2 exam.

Is the pilot exam available worldwide?

Candidates will be able to take the pilot exam at ISC2-authorized Pearson Professional Centers that offer English language examinations. This examination will not be available at Pearson Authorized Test Centers, learn more.

Is the pilot exam available in multiple languages?

No. The pilot exam is only available in English. Additional languages may become available once the certification is approved by the ISC2 Board.

Can candidates skip a test item on the exam and answer it later?

No. Candidates cannot skip an exam item and return it later.

How will I know if I pass the pilot exam?

Since this is a pilot exam program, candidates will not immediately receive results. Pilot exam candidates will receive a notification at the end of their exam that states results will be available in 8 to 12 weeks following the conclusion of the pilot exam period, which allows for a thorough assessment and evaluation of the pilot exam. Candidates will receive notice of a pass or fail on their ISC2 Dashboard at the end of the 8 to 12 weeks pilot exam review period. No scores or relative performance related to specific domains will be available for the pilot exam.

How much does the pilot exam cost?

There is no charge to participate in the pilot exam.

How long is the pilot exam?

The pilot exam contains 160 test items in a standard, linear exam format. There is a three (3) hour maximum administration time that is inclusive of all optional breaks and information screens.

Standard ISC2 exam policies and practices apply to the pilot exam program. Learn more here, https://www.isc2.org/exams. It is recommended that all candidates review these policies and procedures prior to sitting for the pilot exam.

Will there be prerequisites or experience requirements?

If I pass the pilot exam, will I earn the certification?

Yes. Assuming the pilot exam program is successful, and the pilot exam becomes the operational certification scheme, a pilot exam candidate who successfully passes the exam and satisfies any experience requirements will be among the first to earn the new AI security certification.

When will details, like the certification name and future pricing, be announced?

Details such as the certification name, pricing and availability will be announced after the pilot phase concludes, if ISC2 decides to move forward with an operational certification launch.

How will employers use this certification once it’s available?

The certification is intended to give employers a trusted, globally recognized way to validate AI security expertise and assess workforce readiness in an increasingly AI-driven environment.

What makes this initiative significant for the cybersecurity profession?

AI is fundamentally changing how cybersecurity work is performed. This effort represents a critical step in defining how the profession adapts, ensuring there is a shared understanding of what it means to securely work with AI systems and manage AI-related risk.

What will the maintenance requirements be for keeping this certification?

Continuing Professional Education (CPE) requirements have not yet been established. These will be defined as part of the final certification framework, once the certification has been fully developed and validated.

How much will the Annual Maintenance Fees (AMFs) be?

Annual Maintenance Fees (AMFs) for this certification have not yet been determined. However, it is expected that AMFs will be in line with our broader certification portfolio of U.S. $135.

What will the certification be called?

The name of the certification has not yet been determined. ISC2 is currently focused on defining the certification before finalizing elements such as name. These details will be announced later in the process, after the certification has been developed and validated through the pilot phase.

Loading component...

Stay Informed on the Process

October 8, 2026

The Role of Practitioners in AI Security Certification

As AI Reshapes Cybersecurity, Governance Emerges as a Top Priority

September 25, 2026

As AI Reshapes Cybersecurity, AI Governance Emerges as a Top Priority

Loading component...

Program Progress
Updated October 26, 2026

More than 9,500 volunteers from more than 150 countries have expressed interest in participating in AI security certification development activities.

First Job Task Analysis (JTA) workshops were held in Alexandria, VA, London and Singapore in August 2026 to define a recommended certification scheme and exam outline.

Job Task Analysis Survey closed with over 1,100 responses from those who expressed interest via our volunteer form, further validating initial findings from the in-person workshops.

A second Job Task Analysis (JTA) workshop to finalize the pilot exam outline and certification scheme recommendations was held in Alexandria, VA with participants representing global inclusivity.

Item Development Workshops are underway for ISC2 member participation. Remote workshop opportunities will run through December 18. In-person item review workshops have concluded in Alexandria, VA, and London. Singapore review workshops are in progress. Item Review workshops will be held in Denver, CO, both before and after ISC2 Security Congress.

Experience Requirements

AI Security Pilot Examination Information

Length of exam

3 hours

Number of items

160

Item format

Multiple choice

Exam language availability

English

Testing center

Pearson Professional Center (PPC)

AI Security Examination Weights

Domains

Weight

1. Artificial Intelligence (AI) Concepts and Security Fundamentals

10%

2. AI Governance, Ethics, Risk, and Compliance

17%

3. AI Data Management, Privacy, and Model Security

19%

4. Secure AI Architecture, Engineering, and Identity and Access Management (IAM)

18%

5. Secure AI Operations and Incident Response (IR)

19%

6. AI Threats, Testing, and Lifecycle Management

17%

Total

100%

AI Security Certification

Define the Future of AI Security with ISC2

A Certification. A Standard. A Moment for the Profession.

The Cybersecurity Profession Must Define AI Security

Loading component...

Program Progress Updated October 26, 2026

AI Security Certification Exam Outline

Experience Requirements

AI Security Examination Weights

Loading component...

Domains

1.1 - Artificial Intelligence (AI) Concepts and Security Fundamentals

1.2 - Analyze Generative Artificial Intelligence (GenAI) and Modern Architectures

1.3 - Evaluate AI Limitations and Performance

1.4 - Apply Data Management and Privacy in AI

1.5 - Identify AI Security Fundamentals and Threats

1.6 - Implement AI Controls, Safeguards, and Principles

1.7 - Analyze AI Solutions and Use Cases

2.1 - Establish AI Governance, Frameworks, and Policies

2.2 - Apply Responsible AI Principles and Ethics

2.3 - Implement AI Risk Management and Assessments

2.4 - Ensure Data Privacy, Protection, and Intellectual Property (IP) Rights

2.5 - Manage Third-Party and AI Supply Chain Risks

2.6 - Enforce Accountability, Human Oversight, and Auditing

2.7 - Develop AI Security Education and Awareness

3.1 - Establish AI Data Governance, Lineage, and Accountability

3.2 - Implement Data Privacy and Compliance Controls

3.3 - Secure AI Training Data and Datasets

3.4 - Apply Cryptographic and Data Protection Solutions

3.5 - Manage AI Model Lifecycle and Security Governance

3.6 - Ensure Model Confidentiality, Integrity, and Availability

3.7 - Assess AI Data and Model Supply Chain Risks

4.1 - Apply AI Architecture and Secure Design Principles

4.2 - Architect Secure AI Infrastructure and Platforms

4.3 - Secure Data and Model Deployment Pipelines (e.g., MLOps/LLMOps)

4.4 - Design and Implement AI Guardrails and Controls

4.5 - Implement AI Identification and Authentication Strategies

4.6 - Design and Enforce AI Authorization and Access Controls

4.7 - Manage Identity Lifecycle and Auditing

5.1 - Establish AI SecOps Foundations and Operational Readiness

5.2 - Monitor, Log, and Collect AI Security Telemetry

5.3 - Detect Runtime Threats, Misuse, and Compromises

5.4 - Manage AI Vulnerabilities and Asset Posture

5.5 - Respond to and Contain AI Security Incidents

5.6 - Investigate, Eradicate, and Perform Forensics on AI Incidents

5.7 - Execute Recovery, Business Continuity (BC), and Post-Incident Reviews

6.1 - Conduct AI Threat Modeling and Intelligence

6.2 - Manage Secure AI Development Lifecycle (AIDLC) and Change Management

6.3 - Secure AI Supply Chain, Procurement, and Provenance

6.4 - Design and Execute AI Security Testing and Red Teaming

6.5 - Evaluate, Validate, and Report Assessment Findings

6.6 - Define, Implement, and Validate Mitigations

Loading component...

Loading component...

Loading component...

Stay Informed on the Process

October 8, 2026

The Role of Practitioners in AI Security Certification

September 25, 2026

As AI Reshapes Cybersecurity, AI Governance Emerges as a Top Priority

Loading component...

A Certification. A Standard. A Moment for the Profession.

The Cybersecurity Profession Must Define AI Security

Program Progress Updated October 26, 2026

AI Security Certification Exam Outline

Experience Requirements

AI Security Examination Weights

Domains

1.1 - Artificial Intelligence (AI) Concepts and Security Fundamentals

1.2 - Analyze Generative Artificial Intelligence (GenAI) and Modern Architectures

1.3 - Evaluate AI Limitations and Performance

1.4 - Apply Data Management and Privacy in AI

1.5 - Identify AI Security Fundamentals and Threats

1.6 - Implement AI Controls, Safeguards, and Principles

1.7 - Analyze AI Solutions and Use Cases

2.1 - Establish AI Governance, Frameworks, and Policies

2.2 - Apply Responsible AI Principles and Ethics

2.3 - Implement AI Risk Management and Assessments

2.4 - Ensure Data Privacy, Protection, and Intellectual Property (IP) Rights

2.5 - Manage Third-Party and AI Supply Chain Risks

Program Progress
Updated October 26, 2026

Program Progress
Updated October 26, 2026