ISC2 AI Security: the 2026 certification pilot outline

ISC2 published the first detailed outline for its future artificial intelligence security certification on October 26, 2026. The final credential name has not been announced, and the certification is not expected to become operational until 2027. The pilot, however, is now concrete: six weighted domains, 160 questions in three hours, an experience requirement and a testing window planned from mid-December 2026 through late January 2027.

That distinction matters. This is neither a certification immediately open to everyone nor a course completion certificate. ISC2 expects to select about 3,000 volunteers from people who joined its interest list by November 4, 2026. Selected candidates will be able to schedule from mid-November and sit the free pilot in English at participating Pearson Professional Centers.

Pilot exam at a glance

These conditions appear on ISC2 Developing AI Security Certification (opens in a new tab), updated October 26. ISC2 says candidates cannot skip a question and return later. The pilot will not report domain-level scores.

Passing leads to the credential only if the pilot becomes an operational certification and the candidate satisfies the experience requirements. The final name, future price, maintenance CPEs and definitive annual fee have not been established. Treating them as confirmed would be misleading.

Six domains for an end-to-end AI security practice

ISC2's official first look at the outline (opens in a new tab), also dated October 26, describes a role that secures the design, deployment and maintenance of AI and ML systems. The published weights are:

The structure avoids two common reductions. AI security is not only prompt-injection defense, and it is not only policy governance. The outline connects technical concepts, data, models, architecture, identity, operations, investigation and lifecycle control.

Domain 1: understand what you are securing

Fundamentals account for 10%. They include AI types, supervised and unsupervised learning, reinforcement learning, neural networks, transformers, hardware infrastructure, language and multimodal models, embeddings, context windows, RAG, fine-tuning and agents.

The goal is not to turn a cybersecurity professional into a data scientist. Candidates must nevertheless distinguish components and their risks. A vector store, a model, an agent tool and a fine-tuning pipeline have different assets and trust boundaries.

For study, take a simple application and label every component: training data, grounding data, prompt, model, memory, tool, output and log. Map confidentiality, integrity and availability to every stage. This prevents applying a generic control to a poorly located problem.

Domain 2: governance, ethics, risk and compliance

This domain weighs 17%. It covers frameworks and regulations, policy, use-case inventories, roles, accountability, human oversight, audit and risk communication. It expects coordination among security, data, legal, compliance, procurement, business owners and leadership.

The practical skill is moving from principle to evidence. “Use AI responsibly” is not enough. You need to identify who approves a use case, which data is permitted, how an exception is recorded, which indicator triggers reassessment and how a provider is reviewed.

OnLevelUp's comparison of four new ISC2 courses on AI governance, data, policy and risk may help develop some related deliverables. Those courses are neither the official pilot curriculum nor evidence that all six domains are covered. ISC2 says no official pilot-specific course is currently available.

Domain 3: data, privacy and model security

At 19%, this is one of the heaviest domains. It covers quality, provenance, classification, access, retention, privacy, dataset integrity and model protection. Attack surfaces include training data, model weights, prompts, RAG systems and pipelines.

Study poisoning, leakage, extraction, inversion, exfiltration and model tampering by identifying the asset, entry point, observable signal, containment and recovery. In a RAG system, for example, distinguish a compromised document from an authorization failure in retrieval and a misleading model output. They require different evidence and responses.

A data register is a useful study artifact. For each source, record owner, legal basis, sensitivity, location, transformations, uses, controls, retention and deletion conditions. Add the version of the model that consumed the data so an investigation can reconstruct what happened.

Domain 4: secure architecture, engineering and IAM

This block weighs 18%. ISC2 names Zero Trust, defense in depth, privacy by design, threat modeling, secure integrations, deployment pipelines, checkpoints, rollback and guardrails for autonomous systems.

IAM becomes more complicated when an agent can act. Separate the user, service, agent, session and tool; minimize permissions; protect secrets and tokens; authorize both invocation and action; and retain useful evidence. Human approval placed after the action is not a control.

Practice an architecture where an assistant proposes and then executes a change. Compare read-only, proposal-with-approval and automatic-execution modes. For each, document identity, authorization, exposed data, evidence, rate limit, kill mechanism and rollback.

Domain 5: secure operations and incident response

The other 19% domain asks professionals to monitor AI activity, detect misuse and drift, maintain asset visibility and respond to prompt injection, poisoning, model theft or agent abuse.

Traditional playbooks need adaptation. Disabling an endpoint may stop leakage but also interrupt a critical process. Restoring a model is insufficient if the vector store or logs were compromised. Preserve versions, provenance, configurations, evaluations and dependencies to reconstruct state.

Create an incident sheet with detection, triage, containment, evidence preservation, communication, recovery and post-incident review. Add AI-specific decisions: suspend a tool, change the model, isolate memory, invalidate embeddings or switch to a degraded mode.

Domain 6: threats, testing and lifecycle

The remaining 17% covers threat modeling, adversarial testing, evaluation, dependency security, vulnerability management and end of life. The important skill is testing a defined property, not collecting jailbreak prompts.

Before a test, state the asset, adversary, boundary and expected result. Afterward, record model version, configuration, corpus, accessible tools and criteria. Without those elements, a success or failure is difficult to reproduce.

Lifecycle work also includes model change, data updates, drift, retirement and destruction. A launch-time assessment does not prove the system remains safe after repeated changes.

Who can satisfy the experience requirement?

ISC2 announces a minimum of four cumulative years of paid professional experience in cybersecurity or AI-related fields. Two years must be in cybersecurity, and one year must cover at least two domains in the outline. An active CISSP, ISSAP, ISSEP, ISSMP, CCSP or CSSLP credential can substitute for the full experience requirement.

Only one year can be waived through education; part-time work and internships may count under ISC2 rules. Before volunteering, map each role to verifiable activities and retain contact details for people able to attest to the experience.

The pilot therefore targets experienced security architects, engineers, operations leads, risk managers and strategists. A beginner can use the outline as a roadmap, but should not interpret a free pilot as an exam without prerequisites.

Should you attempt the pilot?

The pilot fits if you submitted the interest form in time, meet the experience conditions, can travel to an English-language Pearson Professional Center and accept delayed results. You will help validate a professional standard still under construction.

Do not make it your only goal if you need an immediate credential, guaranteed date or complete official training. Places are limited, selection is not automatic and the calendar may change.

Everyone else can still use the outline. Assess yourself across all six domains, select two priority gaps and produce one real artifact: threat model, data register, identity matrix, incident playbook or test protocol. That will prepare you for the future credential better than unofficial question collections.

Key takeaway

ISC2 is not yet launching a public operational exam. It is publishing a first testable standard and organizing a pilot. The verified information is already substantial: six domains, weights, format, experience and selection conditions. The final name, operational price and maintenance rules remain open.

Until the scheme is approved, call it the “pilot for the future ISC2 AI Security Certification” and date your information. That language clearly separates a program under validation from an available certification.

Official sources

• ISC2 Developing AI Security Certification, updated October 26, 2026 (opens in a new tab)
• ISC2 Insights, What Will the ISC2 AI Security Certification Cover?, October 26, 2026 (opens in a new tab)