Table of Contents

CompTIA SecAI+ (CY0-001) is the certification for cybersecurity professionals who secure artificial intelligence systems and use AI to defend the enterprise. It validates your ability to understand AI fundamentals, protect AI systems from adversarial attacks, apply AI to security operations, and govern AI use responsibly. This course covers all four exam domains so you build the practical and governance skills needed to pass. CompTIA recommends 3 to 4 years of IT experience with at least 2 years of hands-on cybersecurity work, plus Security+, CySA+, or PenTest+ knowledge.

DomainTitleExam Weight
1.0Basic AI Concepts Related to Cybersecurity17%
2.0Securing AI Systems40%
3.0AI-assisted Security24%
4.0AI Governance, Risk, and Compliance19%

Exam details: Maximum of 60 questions, multiple-choice and performance-based, 60 minutes, passing score of 600 on a scale of 100 to 900. The exam is available in English and launched on February 17, 2026.

Resources

Basic AI Concepts

  • Explain core AI and machine learning concepts, including generative AI, deep learning, statistical learning, transformers, GANs, and natural language processing
  • Compare model training techniques, including supervised, unsupervised, reinforcement, and federated learning, plus fine-tuning, pruning, quantization, epochs, and model validation
  • Apply prompt engineering, including system and user prompts, system roles, templates, and zero, one, and multi-shot prompting
  • Manage data processing for AI, including cleansing, verification, lineage, provenance, integrity, augmentation, and balancing across structured, semi-structured, and unstructured data
  • Describe grounding techniques, including retrieval-augmented generation, embeddings, vector storage, and watermarking
  • Secure the AI life cycle from business use case through data preparation, deployment, monitoring, and feedback, with human-in-the-loop, oversight, and validation

Domain 2: Securing AI Systems (40%)

Securing AI Systems

  • Use AI threat-modeling resources, including the OWASP LLM Top 10, OWASP ML Security Top 10, MITRE ATLAS, MIT AI Risk Repository, and the CVE AI Working Group
  • Implement model and gateway controls, including model evaluation, guardrails, prompt firewalls, rate, token, and input limits, modality limits, and guardrail testing
  • Apply access controls for models, data, agents, and APIs under least privilege
  • Apply data protection, including encryption in transit, at rest, and in use, plus anonymization, classification labels, redaction, masking, and minimization
  • Monitor AI systems with prompt monitoring, log sanitization and protection, confidence scoring, rate monitoring, cost monitoring, and quality auditing
  • Defend against adversarial attacks, including prompt injection, jailbreaking, data and model poisoning, backdoor, trojan, transfer learning, and skewing attacks, model inversion, theft, and membership inference
  • Mitigate application-layer risks, including insecure output handling, insecure plug-in design, excessive agency, overreliance, and model denial of service, then map compensating controls to each attack

At 40% this is the heaviest-weighted domain, so build deep hands-on familiarity with adversarial threats and AI-specific controls.

Domain 3: AI-assisted Security (24%)

AI-assisted Security

  • Use AI-enabled tools, including IDE, browser, and CLI plug-ins, chatbots, personal assistants, and Model Context Protocol servers
  • Apply AI to defensive use cases, including signature matching, anomaly detection, pattern recognition, vulnerability analysis, automated penetration testing, incident management, threat modeling, and fraud detection
  • Automate security operations with low-code and no-code workflows, document synthesis, ticket management, AI-assisted approvals, and automated deployment and rollback
  • Integrate AI into the CI/CD pipeline, including code scanning, software composition analysis, unit, regression, and model testing
  • Recognize offensive misuse of AI, including deepfakes, impersonation, misinformation, disinformation, and AI social engineering
  • Understand AI-driven attack techniques, including reconnaissance, obfuscation, and automated attack generation of vectors, payloads, malware, honeypots, and DDoS

Domain 4: AI Governance, Risk, and Compliance (19%)

AI Governance, Risk, and Compliance

  • Establish AI governance structures, including an AI Center of Excellence and AI policies and procedures
  • Identify AI roles and responsibilities, including data scientists, AI architects, MLOps engineers, AI security architects, governance engineers, risk analysts, and AI auditors
  • Apply responsible AI principles, including fairness, reliability and safety, transparency, privacy and security, explainability, inclusiveness, accountability, and consistency
  • Assess AI risks, including bias, accidental data leakage, reputational loss, model accuracy and performance, intellectual property exposure, autonomous systems risk, and shadow AI
  • Comply with AI laws and frameworks, including the EU AI Act, OECD AI Principles, ISO AI standards, and the NIST AI Risk Management Framework
  • Govern AI adoption, including sanctioned versus unsanctioned AI, private versus public models, sensitive data governance, third-party compliance evaluation, and data sovereignty

Work through all four domains, then test your readiness with the CompTIA SecAI+ Practice Test before exam day. SecAI+ pairs well with Security+, CySA+, and PenTest+, so review those foundations if you need them. For more certification courses and hands-on playbooks, visit Courses and Playbooks .