TL;DR: CompTIA SecAI+ (CY0-001) is an expansion certification for working security professionals. It tests whether you can secure AI systems, use AI tools in security work, and handle AI governance, risk, and compliance. It launched on February 17, 2026, allows up to 60 questions in 60 minutes (multiple-choice and performance-based), and is passed at 600 on a 100 to 900 scale. Four domains: Securing AI Systems 40%, AI-Assisted Security 24%, AI Governance, Risk and Compliance 19% and Basic AI Concepts 17%. CompTIA recommends 3 to 4 years of IT experience with about 2 years of hands-on cybersecurity, so it is not a first certification. CompTIA’s own pages do not show a price, but resellers list the voucher at roughly USD 253 to 298, so budget about USD 300 and confirm before you buy. It is worth it if AI security is already part of your job or your next job. If you are new to security, take Security+ first.
Quick Facts
| Item | Detail |
| Certification | CompTIA SecAI+ V1 |
| Exam code | CY0-001 |
| Launch date | February 17, 2026 |
| Type | Expansion certification (adds AI security skills to an existing security career) |
| Questions | Up to 60, multiple-choice and performance-based |
| Time | 60 minutes |
| Passing score | 600 on a 100 to 900 scale |
| Domain weights | Basic AI Concepts 17%, Securing AI Systems 40%, AI-Assisted Security 24%, AI Governance, Risk and Compliance 19% |
| Recommended experience | 3 to 4 years in IT, about 2 years of hands-on cybersecurity |
| Prerequisites | None required. Security+, CySA+, PenTest+ or equivalent knowledge is recommended |
| Exam price | Not shown on CompTIA’s pages. Reseller listings we checked ranged from about USD 253 (discounted) to USD 298 (list) |
| Validity | Not stated on the pages we reviewed. Most CompTIA certifications run three years, so confirm |
| Accreditation | ISO 17024 accreditation and DoD 8140 mapping are listed as pending |
| Expected retirement | About three years after launch, based on CompTIA’s usual cycle (an estimate, not an announcement) |
Confirm price, languages, validity and accreditation on CompTIA’s site before you register. These details can change.
Key Takeaways
- The exam is built around three jobs: protecting AI systems, using AI inside security work and governing AI responsibly. Basic AI knowledge supports all three.
- Securing AI Systems carries 40%. It is the domain to master. It covers threat modeling resources, guardrails, access control, data protection, monitoring and recognizing attacks.
- You must recognize specific attacks. The objectives name more than twenty, from prompt injection and data poisoning to model inversion, excessive agency and AI supply chain attacks.
- The exam is tool-aware. Expect references to RAG, vector databases, MCP servers, AI plug-ins and AI agents.
- Governance is easy to underestimate. At 19%, it is larger than Basic AI Concepts, and it asks you to apply frameworks such as the NIST AI RMF and the EU AI Act to scenarios.
- Sixty minutes is tight. Performance-based questions take longer, so practice under a timer.
- It adds to your credentials, it does not replace them. CompTIA positions SecAI+ beside Security+, CySA+, PenTest+ and SecurityX.
What Is CompTIA SecAI+?
SecAI+ is a vendor-neutral CompTIA certification that validates AI security skills for people who already work in cybersecurity. CompTIA calls it an expansion certification. It does not map to one job title. Instead, it adds AI depth to roles you may already hold: SOC analyst, security engineer, cloud security engineer, GRC analyst or security architect.
The reason it exists is simple. Most organizations now run AI in three places at once. They deploy models and chatbots of their own, they buy security products with AI built in and their staff use public AI tools on their own. Each creates a different security problem, and SecAI+ is structured around those three problems rather than around a single product or cloud.
If you want to see where it sits next to other options, our AI security certifications guide compares the wider field, and our CompTIA certification roadmap shows how it fits into CompTIA’s security track.
Who Is SecAI+ Meant For?
It is meant for security practitioners with real experience, not for beginners. CompTIA recommends 3 to 4 years of IT experience, including about 2 years of hands-on cybersecurity, and says the exam is not designed for people entering the field.
SecAI+ is a good match if you are:
- A SOC analyst or detection engineer whose tools now include AI assistants and AI-driven detection.
- A security engineer or architect asked to review an LLM application, a RAG chatbot or an ML pipeline before launch.
- A cloud security engineer whose company is deploying AI services.
- A GRC analyst, auditor or risk professional who needs to assess AI risk against frameworks and regulations.
- A Security+, CySA+ or PenTest+ holder looking for a current, specialized next credential.
It is a weaker match if you are a data scientist with no security background (you would struggle with the security scenarios), a complete beginner (start with Security+ instead) or a manager who only needs a policy-level view (a governance credential such as the one in our IAPP AIGP exam guide may fit better).
What Are the SecAI+ Exam Domains and Weights?
Securing AI Systems is the largest domain at 40%, followed by AI-Assisted Security at 24%, AI Governance, Risk and Compliance at 19% and Basic AI Concepts at 17%.
| Domain | Weight | What it asks you to do |
| 1.0 Basic AI Concepts Related to Cybersecurity | 17% | Understand AI types, training methods, data security and the AI life cycle |
| 2.0 Securing AI Systems | 40% | Threat model, apply controls, manage access, protect data, monitor and respond to attacks |
| 3.0 AI-Assisted Security | 24% | Use AI tools, understand AI-enhanced attacks and automate security tasks |
| 4.0 AI Governance, Risk and Compliance | 19% | Explain governance structures, AI risks and compliance requirements |
Domain 2 and Domain 3 together make up 64% of the exam, and both are applied. If your study time is limited, put most of it there.
What Does Domain 1 Cover (Basic AI Concepts, 17%)?
Domain 1 covers the vocabulary and mechanics of AI that you need to secure it: AI types and training methods, data security for AI and security across the AI life cycle.
1.1 AI types, training techniques and prompt engineering
The objectives list generative AI, machine learning, statistical learning, transformers, deep learning, generative adversarial networks (GANs), natural language processing, large language models (LLMs) and small language models (SLMs). You do not need to build these, but you must know how they differ and why that matters for security. For example, a GAN pits two networks against each other and is the technology behind many deepfakes, while an SLM is smaller and often runs locally, which changes the data exposure picture.
Training techniques include supervised, unsupervised and reinforcement learning, federated learning, fine-tuning, model validation, epochs, pruning and quantization. A few connections worth remembering:
- Federated learning trains across decentralized data without pooling it, which helps with privacy but does not remove every risk.
- Fine-tuning adapts a pre-trained model, and a poisoned or compromised base model can carry hidden behavior into your version.
- Pruning and quantization shrink a model so it can run on smaller hardware. They are optimization techniques, and the exam expects you to recognize what they do.
Prompt engineering is also covered: system prompts, user prompts, zero-shot, one-shot and multi-shot prompting, system roles and templates. The security link is that system prompts and templates are controls, and attackers try to override them.
1.2 Data security for AI
This objective covers data processing steps (cleansing, verification, lineage, integrity, provenance, augmentation and balancing), data types (structured, semi-structured and unstructured), watermarking and retrieval-augmented generation (RAG) with vector storage and embeddings.
Two terms people mix up: lineage traces where data has moved and how it was transformed, while provenance is about its origin and authenticity. RAG matters because it connects a model to your documents. The documents are converted to embeddings and stored in a vector database, and whoever can query that store can potentially pull out sensitive content. That is why RAG shows up again in access control and data protection.
1.3 Security across the AI life cycle
The life cycle runs from business use case and data collection through data preparation, model development or selection, evaluation, deployment, validation, monitoring and maintenance, and feedback and iteration. The exam wants you to know that security belongs at every stage, not only at deployment. It also covers human-centric design: human-in-the-loop, human oversight and human validation.
How to study Domain 1: Build a one-page map of the life cycle and write one security risk and one control next to each stage. It is the fastest way to make the stages stick.
What Does Domain 2 Cover (Securing AI Systems, 40%)?
Domain 2 covers the full set of defensive work around AI systems: threat modeling, security controls, access control, data security, monitoring and auditing, and recognizing attacks with the right compensating controls. Spend about 40% of your study time here.
2.1 AI threat-modeling resources
You are expected to use the following in scenarios: the OWASP Top 10 for LLM applications, the OWASP Machine Learning Security Top 10, the MIT AI Risk Repository, MITRE ATLAS, the CVE AI Working Group and general threat-modeling frameworks. Learn what each one is for. OWASP lists the most common risks for LLM and ML systems. MITRE ATLAS documents adversary tactics and techniques against AI systems, in the same spirit as ATT&CK. A question may describe a threat and ask which resource you would use to map it.
2.2 Security controls for AI systems
Controls fall into two groups. Model controls include model evaluation, guardrails and prompt templates. Gateway controls include prompt firewalls, rate limits, token limits, input quotas (data size and quantity), modality limits and endpoint access controls. The objective also names guardrail testing and validation, which means you should know that a guardrail you have not tested is only an assumption.
2.3 Access controls for AI systems
Access control applies to four things: the model, the data, agents and network or API access. Agents deserve special attention. An AI agent that can call tools, send email or change records needs the same least-privilege thinking as a service account. The principles in our zero trust security guide apply directly here.
2.4 Data security controls
You need to know encryption in transit, at rest and in use, along with anonymization, classification labels, redaction, masking and minimization. Encryption in use is the least familiar of the three. It means protecting data while it is being processed, for example through trusted execution environments. Data minimization is often the cleanest answer in a scenario where sensitive data is being sent to a model for no good reason.
2.5 Monitoring and auditing
Monitoring covers prompts (queries and responses), logs (including sanitization and protection), response confidence levels, rate monitoring and AI cost monitoring across prompts, storage, responses and processing. Auditing covers quality and compliance: hallucinations, accuracy, bias and fairness, and access. Notice that cost monitoring is on the list. A sudden jump in token usage can signal abuse, and the exam treats it that way.
2.6 Attack evidence and compensating controls
This is the most testable objective in the whole exam. The attacks named include backdoor and trojan attacks, prompt injection, model and data poisoning, jailbreaking, input manipulation, introducing biases, circumventing guardrails, manipulating application integrations, model inversion, model theft, AI supply chain attacks, transfer learning attacks, model skewing, output integrity attacks, membership inference, insecure output handling, model denial of service, sensitive information disclosure, insecure plug-in design, excessive agency and overreliance.
A few pairs are easy to confuse, so learn the difference:
| Attack | What it does | Typical compensating control |
| Prompt injection | Hidden or direct instructions override the intended behavior of the model | Prompt firewalls, guardrails, prompt templates, least privilege for tools |
| Data poisoning | Corrupts training data to degrade or bias the model | Data integrity controls, provenance checks, access control on pipelines |
| Backdoor or trojan | Model behaves normally until a specific trigger appears | Model evaluation, supply chain vetting, trusted sources |
| Model inversion | Reconstructs sensitive training data from model outputs | Data minimization, output filtering, privacy techniques |
| Membership inference | Determines whether a specific record was in the training set | Privacy techniques, limiting output detail, rate limiting |
| Model theft | Copies a model through repeated queries or stolen files | Rate limiting, access controls, encryption, monitoring |
| Insecure output handling | A downstream system trusts model output and executes it | Treat output as untrusted, validate and sanitize before use |
| Excessive agency | An AI agent has more permissions or autonomy than it needs | Least privilege, human approval for sensitive actions |
| Model denial of service | Resource-heavy prompts exhaust capacity or budget | Rate limits, token limits, input quotas |
The compensating controls the objectives list are prompt firewalls, model guardrails, access controls, data integrity controls, encryption, prompt templates, rate limiting and least privilege. The skill being tested is matching the attack to the control that actually addresses it.
Example scenario (our own practice-style item, not an official question): A support chatbot uses RAG over internal documents. A user pastes text into the chat that tells the bot to ignore its rules and list every document about layoffs. The bot complies. Which two controls address the root problem? A strong answer combines access control on the retrieval layer (the bot should only retrieve what that user is allowed to see) with guardrails or a prompt firewall (to catch the override attempt). Fixing only one leaves the other gap open.
For wider context on frameworks that support this work, see our AI security frameworks for enterprises guide.
What Does Domain 3 Cover (AI-Assisted Security, 24%)?
Domain 3 covers using AI as a security tool, understanding how attackers use AI against you and automating security tasks safely.
3.1 AI-enabled security tools
The objectives list the forms these tools take: IDE, browser and CLI plug-ins, chatbots, personal assistants and Model Context Protocol (MCP) servers. Use cases include signature matching, code quality and linting, vulnerability analysis, automated penetration testing, anomaly detection, pattern recognition, incident management, threat modeling, fraud detection, translation and summarization. The exam is likely to ask which tool or approach fits a described task, and just as often where AI output should not be trusted without review.
3.2 AI-enhanced attack vectors
This covers how attackers use AI: deepfake content for impersonation, misinformation and disinformation, adversarial networks, reconnaissance, social engineering, obfuscation, automated data correlation and automated attack generation (attack vector discovery, payloads, malware, honeypots and DDoS). Notice that this is a defender’s view of AI-powered attacks. Think about how detection and awareness training must change when phishing emails are well written and voice calls can be cloned.
3.3 AI-automated security tasks
Here you will see low-code and no-code scripting, document synthesis and summarization, incident response ticket management, change management (AI-assisted approvals, automated deployment and rollback), AI agents, and CI/CD tasks such as code scanning, software composition analysis, unit and regression testing and model testing. The theme is automation with guardrails. A good answer usually keeps a human approval step where the action is risky.
Example scenario (our own practice-style item): An AI assistant in your ticketing system proposes closing 40 alerts as false positives and auto-approves a firewall change. What is the best control? A sound answer keeps human review for the change and spot-checks the closed alerts, because the objectives treat overreliance and unchecked autonomy as risks, not as efficiency gains.
What Does Domain 4 Cover (AI Governance, Risk and Compliance, 19%)?
Domain 4 covers who is responsible for AI inside an organization, what can go wrong and which rules and standards apply.
4.1 Governance structures
Organizational structures include an AI Center of Excellence and AI policies and procedures. The objectives also list roles: data scientist, AI architect, machine learning engineer, platform engineer, MLOps engineer, AI security architect, AI governance engineer, AI risk analyst, AI auditor and data engineer. Learn what each one does, because role-matching scenarios are easy points if you know them.
4.2 AI risks
Responsible AI principles include fairness, reliability and safety, transparency, privacy and security, differential privacy, explainability, inclusiveness, accountability, consistency and awareness training. Risks include introduction of bias, accidental data leakage, reputational loss, accuracy and performance of the model, intellectual property risks and autonomous systems. Shadow AI is also named: staff using unsanctioned AI tools, the same way shadow IT works. This is a very practical topic. An employee pasting customer data into a public chatbot is a data leak that no firewall rule caused.
4.3 Compliance impact
The objectives list the EU AI Act, OECD standards, ISO AI standards and the NIST AI Risk Management Framework, plus corporate policies (sanctioned vs. unsanctioned tools, private vs. public models and sensitive data governance), third-party compliance evaluations and data sovereignty. One way to keep them straight: the EU AI Act is a law with legal obligations, the NIST AI RMF is voluntary guidance, and ISO standards provide certifiable or reference practices. A candidate who sat the beta exam reported that scenario questions turned on exactly this kind of distinction, which is why governance should not be skipped.
How Is the SecAI+ Exam Structured?
The exam has up to 60 questions in 60 minutes, mixing multiple-choice and performance-based items, and you need 600 on a 100 to 900 scale to pass.
That works out to about a minute per question, but performance-based questions take longer, so you will need to move fast on the multiple-choice items. Scores are scaled, so 600 is not 600 out of 900 correct. CompTIA does not tell you how many questions you need to get right, and it does not publish a pass rate. Treat any pass-rate figure you find online as unofficial.
Test-day approach that works for CompTIA-style exams:
- Read the last sentence of a scenario first so you know what is being asked.
- Look for the word “best” or “first” and choose between answers that are all partly right.
- Flag performance-based questions if they eat time, then return to them.
- Leave a few minutes for flagged items.
How Much Does SecAI+ Cost?
CompTIA’s SecAI+ pages do not show a price, and resellers list the voucher at roughly USD 253 to 298. One reseller we checked listed the standard voucher at USD 298, discounted to about USD 253 on the day we looked, and a voucher plus retake package at about USD 282. A UK reseller listed the voucher at GBP 218 excluding VAT. Prices vary by seller and region and change often, so treat these as a planning range and confirm on CompTIA’s store.
Other costs to plan for:
- Study materials. CompTIA sells CertMaster Study, Labs and Perform, and says they typically take about 20 to 25 hours together, depending on background. That figure describes the product, not total preparation time.
- Practice tests. Optional, but useful for timing.
- Retake risk. A retake means buying another voucher unless you bought a retake package, so compare bundle prices.
- Voucher validity. One reseller states you must register within 12 months of receiving the code. Check the terms where you buy.
- Renewal. Most CompTIA certifications renew through continuing education every three years. SecAI+ validity was not stated on the pages we reviewed, so confirm.
If your employer pays, ask whether they have a CompTIA partner discount before you buy retail.
How Hard Is the SecAI+ Exam?
It is moderately hard for experienced security staff and hard for people without security experience. CompTIA does not publish difficulty data, but the objectives point to three pressure points.
First, the breadth is unusual. In one exam you move from how transformers work to rate limiting an API to the EU AI Act. Second, the attack list is long and many items sound similar, so you need to separate them precisely. Third, the scenario wording often has several defensible answers, and you must pick the best control for the exact threat described.
A candidate who sat the beta described the exam as not impossibly hard but new in scope, with AI fundamentals as a strength area and governance as the surprise. If you already work with cloud security, SIEM or MLOps, the applied content will feel familiar. If you come from a pure compliance background, expect to spend more time on the technical attack and control material, and the reverse if you come from engineering.
How Does SecAI+ Compare With Security+, CySA+, PenTest+ and SecurityX?
SecAI+ adds an AI layer. It does not replace any of them. CompTIA describes it as complementing its security certifications.
- Security+ teaches core security across the board. It is the right start for beginners, and our SY0-701 vs SY0-801 guide covers the current and upcoming versions.
- CySA+ focuses on detection, analysis and response. SecAI+ overlaps in Domain 3 but goes deeper on AI tooling and AI-specific attacks.
- PenTest+ covers offensive testing. SecAI+ looks at AI-enhanced attacks and AI attack techniques from the defender’s side.
- SecurityX targets advanced architecture and enterprise security. Our CySA+ vs SecurityX guide explains where that tier fits, and our CompTIA stackable certifications guide shows how the credentials combine.
A reasonable path for most people: Security+, then CySA+ or PenTest+ as your role demands, then SecAI+ once AI security is part of your daily work.
Is the SecAI+ Worth It?
It is worth it when AI security is already part of your job or the job you want, and it is not worth it as a general résumé add-on.
The case for it is real. The objectives are practical, they track threats organizations are dealing with now (prompt injection, shadow AI, agent permissions, RAG leakage) and the vendor-neutral approach means the skills transfer across clouds and AI platforms. It also gives you a structured way to learn the OWASP, MITRE ATLAS and NIST material instead of picking it up piecemeal.
The case against is just as clear. The exam is new, so there is little market history on how employers value it. Accreditation and DoD 8140 mapping are listed as pending, which matters if you work in government contracting. And a certificate alone will not make you credible in AI security. Hands-on work with real systems will.
A quick way to decide:
| If this describes you | Our view |
| You review or defend AI applications at work | Strong yes |
| You hold Security+ or CySA+ and want a current specialization | Yes |
| You are in GRC and AI risk is landing on your desk | Yes, after checking the technical load |
| You have under a year of security experience | Not yet. Build the base first |
| You need a DoD-approved credential right now | Wait for the mapping confirmation |
| You want a general AI literacy credential | Look at other options |
We do not quote salary figures, because pay depends on your role, employer and region, and CompTIA does not publish salary data for SecAI+. If you are mapping a longer path, our cybersecurity career path guide is a useful companion.
How Should You Study for SecAI+?
Start with the official exam objectives, weight your time by domain, and build a small hands-on lab. The objectives document even lists sample lab items such as Python and Jupyter environments, local LLM tools such as Ollama, vector databases, containers and cloud AI studios, which tells you what CompTIA expects you to touch.
A six-week plan for a working professional (about 8 to 10 hours a week; adjust to your background):
- Week 1: Domain 1. AI types, training methods, prompt styles, data terms, RAG and the life cycle. Write the life cycle map described above.
- Week 2: Domain 2 first half. Threat modeling resources (OWASP LLM and ML, MITRE ATLAS), model and gateway controls, and access control. Read the OWASP LLM Top 10 end to end.
- Week 3: Domain 2 second half. Data security controls, monitoring and auditing, and the attack table. Make flashcards pairing each attack with its best control.
- Week 4: Domain 3. AI-enabled tools, AI-enhanced attacks and automation. In your lab, run a local model and try safe prompt injection against a system prompt you wrote.
- Week 5: Domain 4. Governance roles, responsible AI principles and the EU AI Act, NIST AI RMF and ISO distinctions. Build a comparison sheet.
- Week 6: Practice and review. Take timed sets, review every miss by objective number and revisit weak areas.
Practical tips: study by objective number so nothing is skipped, keep a running list of look-alike terms (membership inference vs model inversion, lineage vs provenance), and practice explaining each attack in one sentence.
What Mistakes Should You Avoid?
- Treating it as an AI theory exam. It is a security exam about AI. Know controls, not just concepts.
- Skipping governance. It is 19% and it is scenario-driven.
- Mixing up similar attacks. Poisoning, backdoors, inversion, membership inference and theft each have different controls.
- Ignoring agents and integrations. Excessive agency, insecure plug-ins and MCP servers are named in the objectives.
- Studying from outdated material. Use the current CY0-001 objectives as your checklist, not general AI articles.
- Buying without checking price and terms. Compare sellers, retake options and voucher expiry.
- Neglecting the clock. Practice with a timer so performance-based questions do not drain your time.
FAQS
What is CompTIA SecAI+?
CompTIA SecAI+ is a vendor-neutral expansion certification for security professionals. It validates skills in securing AI systems, using AI in security operations and managing AI governance, risk and compliance.
What is the SecAI+ exam code?
CY0-001, also called SecAI+ V1. It launched on February 17, 2026.
How many questions are on the SecAI+ exam?
Up to 60 questions in 60 minutes, a mix of multiple-choice and performance-based items.
What is the SecAI+ passing score?
600 on a scale of 100 to 900.
What are the SecAI+ exam domains?
Basic AI Concepts Related to Cybersecurity (17%), Securing AI Systems (40%), AI-Assisted Security (24%) and AI Governance, Risk and Compliance (19%).
How much does the SecAI+ exam cost?
CompTIA’s pages we reviewed do not list a price. Reseller listings we checked ranged from about USD 253 (discounted) to USD 298 (list), with retake packages around USD 282 on one site. Confirm the current price on CompTIA’s store.
Is SecAI+ hard?
It is moderately hard for experienced security staff. The difficulty comes from breadth (AI, security and governance in one exam), many similar attack names and scenario wording. CompTIA does not publish a pass rate.
What experience do I need for SecAI+?
CompTIA recommends 3 to 4 years of IT experience with about 2 years of hands-on cybersecurity. There are no formal prerequisites.
Do I need Security+ before SecAI+?
No, but CompTIA recommends Security+, CySA+, PenTest+ or equivalent knowledge. If you are new to security, take Security+ first.
Is SecAI+ worth it?
It is worth it if AI security is part of your current or target role. Because the exam is new, there is limited data on how employers value it, so check job listings in your market before you pay.
How long is SecAI+ valid?
CompTIA’s pages we reviewed did not state a validity period. Most CompTIA certifications are valid for three years and renewed through continuing education, so confirm for SecAI+.
Is SecAI+ approved for DoD 8140?
Not confirmed yet. CompTIA lists DoD 8140 mapping and ISO 17024 accreditation as pending.
How long should I study for SecAI+?
CompTIA says its CertMaster Study, Labs and Perform products take about 20 to 25 hours together, but that is a product estimate. Most working professionals should plan around six weeks, longer if AI is new to you.
Final Thoughts
SecAI+ is a practical credential for security professionals whose work now includes AI. Its strength is the objectives themselves: they point to real work, such as reviewing a RAG application, limiting what an AI agent can do, spotting prompt injection and explaining which rules apply to an AI system. Download the official objectives, study by objective number, put the most time into Domain 2 and build a small lab so the attacks and controls are not abstract. Before you register, check the price, validity and accreditation status on CompTIA’s official SecAI+ page.
