Security teams are being asked to secure AI systems and use AI in their own operations, and until 2026 there was no vendor-neutral, hands-on CompTIA credential that tested either. SecAI+ (exam CY0-001) is CompTIA's answer: a short, intermediate exam that weights securing AI systems above everything else. This guide sets out what CompTIA publishes about the exam format, the four domains, the recommended experience and the continuing education rules, then adds a preparation plan built on the standards the objectives point to and a view on where SecAI+ sits next to other AI and security certifications. It is written for security engineers, SOC analysts and architects who hold Security+ or similar and now own AI risk, and for the managers who fund their training. Facts are as published on comptia.org, checked 27 October 2026; CompTIA changes them, so confirm on the linked pages before you book.
Key takeaways
- It is live, not a beta. CompTIA lists SecAI+ V1, exam code CY0-001, with a launch date of 17 February 2026 and an estimated retirement about three years after launch.
- The exam is short. A maximum of 60 multiple-choice and performance-based questions in 60 minutes, with a passing score of 600 on a scale of 100 to 900, offered in English and Japanese.
- Securing AI systems is 40% of the marks. The other domains are AI-assisted security (24%), AI governance, risk and compliance (19%) and basic AI concepts related to cyber security (17%).
- It assumes security experience. CompTIA recommends three to four years in IT and at least two years of hands-on cyber security, with Security+, CySA+, PenTest+ or equivalent knowledge.
- Renewal is light but separate. SecAI+ needs 15 CEUs and a $75 CE fee per three-year cycle, and CompTIA states that it does not fully renew any other CompTIA certification.
Who the certification is for
CompTIA describes SecAI+ as the first certification in its expansion series, an add-on to the core cyber security pathway rather than a replacement for it. The certification page does not list target job titles; it frames the candidate by experience instead. In practice the objectives map to three groups of people.
- Security engineers and architects who are asked to review or harden AI deployments: model hosting, retrieval pipelines, LLM applications and agents. The 40% securing AI systems domain is written for them.
- SOC and detection staff who are adopting AI-assisted triage, alert correlation and response orchestration, and need to know where those tools help and where they fail. This is the 24% AI-assisted security domain.
- GRC and risk practitioners with a technical background who must map AI projects to regulation and frameworks such as GDPR and the NIST AI RMF. The 19% governance domain covers this, but at awareness level compared with a dedicated governance credential.
It is less suited to data scientists who want an AI engineering credential, and to auditors who need a governance or assurance qualification. For the second group, compare the ISACA options in the ISACA AAISM and AAIA AI Certifications Guide. For the job itself, see the AI Security Engineer Career Guide.
Exam format and domains
| Item | As published by CompTIA (checked 27 Oct 2026) |
|---|---|
| Exam code and version | CY0-001, V1 |
| Launch date | 17 February 2026 |
| Retirement | Estimated three years after launch |
| Number of questions | Maximum of 60 |
| Question types | Multiple-choice and performance-based |
| Duration | 60 minutes |
| Passing score | 600 on a scale of 100 to 900 |
| Languages | English and Japanese |
| Recommended experience | 3 to 4 years in IT and 2+ years hands-on cyber security; Security+, CySA+, PenTest+ or equivalent |
Sixty minutes for up to 60 questions, some of them performance-based, leaves roughly a minute per item. Time management matters more here than on longer CompTIA exams: flag performance-based items that stall and return to them.
| Domain | Weight | Objectives CompTIA lists | What to be able to do |
|---|---|---|---|
| 1. Basic AI concepts related to cybersecurity | 17% | Core AI principles and terminology (machine learning, deep learning, natural language processing, automation); AI applications in security; AI-driven threats such as automated phishing, polymorphic malware, adversarial machine learning and malicious use of generative AI | Explain how a model is trained, served and prompted, and name the attack class for a given scenario |
| 2. Securing AI systems | 40% | Implement security controls for AI systems, data and models; secure deployment environments across on-premises, cloud and hybrid; mitigate adversarial risks to models, data pipelines and inference layers | Pick the control for a weakness: access to model endpoints, training data integrity, output handling, secrets used by AI services, isolation of tools an agent can call |
| 3. AI-assisted security | 24% | AI-driven detection and response; automating event triage, alert correlation and response orchestration; threat modelling, behaviour analysis and continuous monitoring | Judge when AI output in the SOC can be trusted, where a human must approve, and how to measure the tool |
| 4. AI governance, risk, and compliance | 19% | Regulatory frameworks and their implications; GRC across the AI lifecycle; responsible AI use, including GDPR and the NIST AI RMF | Place an AI project in a risk process, identify the obligations that apply, and document decisions |
CompTIA's page summarises the objectives inline. Download the full exam objectives document from the certification page before you start, because the detailed sub-objectives and the acronym list are what the questions are written from.
Prerequisites and experience
There is no mandatory prerequisite on the certification page: the experience figures are recommendations. The more useful question is which gaps will cost you marks.
| Your background | Likely strength | Likely gap to close first |
|---|---|---|
| Security+ holder, 2 years in security operations | Controls vocabulary, IAM, logging | How models, embeddings and retrieval pipelines work; adversarial ML terms |
| CySA+ or SOC analyst | Domain 3, triage and correlation | Domain 2 deployment controls and model supply chain |
| PenTest+ or red team | Attack thinking, prompt injection testing | Domain 4 governance and the regulatory frameworks |
| Cloud or platform engineer | Deployment environments, network isolation, secrets | AI-specific threats and the governance domain |
| Data scientist or ML engineer | Domain 1 concepts | Security fundamentals; consider Security+ first |
Candidates without the general security foundation should take Security+ first. See the CompTIA Security+ Guide.
Preparation plan
The domains are broad and the exam is short, so prepare by working through real artefacts rather than memorising definitions. A six-week plan for someone with the recommended experience:
- Week 1, objectives and baseline: download the CY0-001 objectives, mark each sub-objective red, amber or green, and read the acronym list. Spend the most time on Domain 2, since it carries 40% of the weight.
- Week 2, AI concepts and threats: learn the lifecycle of a model (data, training, evaluation, deployment, inference) and the vocabulary of adversarial ML: evasion, poisoning, model extraction, membership inference. The Adversarial ML Taxonomy Guide and the MITRE ATLAS Guide give the structured view.
- Week 3, LLM application risks: read the OWASP Top 10 for LLM Applications 2025 end to end: LLM01 Prompt Injection to LLM10 Unbounded Consumption. For each risk, write the control you would apply and how you would test it. See the OWASP Top 10 for LLM Applications Guide.
- Week 4, securing deployments: build or review one small deployment: a hosted model API behind a gateway, an application calling it with a scoped key, and a retrieval store. Practise least privilege for the service identities, logging of prompts and tool calls, rate limits, and isolation between tenants. This is the closest you will get to the performance-based items.
- Week 5, AI in the SOC and governance: evaluate an AI triage feature against a sample of known alerts and record false positives and missed detections. Then read the NIST AI RMF core functions (Govern, Map, Measure, Manage) and map one AI project to them. See the NIST AI RMF Guide.
- Week 6, timed practice: take practice tests under the 60-minute limit, review every wrong answer against the objectives, and revisit amber items. Book the exam only when you finish practice sets with time to spare.
Hands-on matters more than courseware. CompTIA sells bundles that pair an exam voucher with Retake Assurance and its own training. Whichever material you use, the deployment exercise in week 4 is what distinguishes candidates who can apply the controls from those who recognise their names.
Cost, renewal and continuing education
| Item | SecAI+ | For comparison: Security+ |
|---|---|---|
| Renewal cycle | Three years | Three years |
| CEUs required per cycle | 15 | 50 |
| CE fee per three-year cycle | $75 | $150 |
| Fully renews another CompTIA certification | No | See CompTIA's multiple renewals table |
| Exam voucher price | Not shown on the pages checked; see CompTIA's store for your region | See CompTIA's store |
- Fee timing: CompTIA states that CE fees are due before the certification's expiration date and are not required annually. All fees must be paid and CEUs uploaded to renew.
- Routes to CEUs: training, work experience, other activities, CertMaster CE, or earning a higher-level CompTIA certification, as described on the CEU page.
- Interaction with Security+: CompTIA's multiple renewals table shows partial CEU credit between SecAI+ and Security+ (and A+), but SecAI+ does not fully renew any other certification. If you hold Security+ and SecAI+, budget for both CE fees.
- Exam retirement: the estimated retirement about three years after launch applies to the CY0-001 exam version, not to your certification. A new exam version would follow; your existing certification keeps its own renewal date.
Where it fits on the career path
| Credential | Focus | Choose it when |
|---|---|---|
| CompTIA Security+ | Core security foundation | You do not yet have a recognised security baseline |
| CompTIA SecAI+ | Hands-on securing of AI systems, AI in security operations, AI GRC awareness | You already work in security and now own AI systems or AI tooling |
| CompTIA CySA+ or PenTest+ | Defensive analysis or offensive testing in depth | Your role is SOC or testing first and AI second |
| ISACA AAISM or AAIA | AI security management (AAISM) or AI audit (AAIA) | Your role is governance, management or assurance of AI |
| CompTIA SecurityX | Advanced security architecture and engineering | You need senior architect breadth beyond AI |
- Small organisations: one engineer often covers cloud, security and AI. SecAI+ is a reasonable single add-on because it spans controls, operations and governance at a practical level.
- Large organisations: AI security is split between platform security, the SOC and an AI governance office. Match the credential to the seat: SecAI+ for engineers and analysts, a governance or audit credential for the risk function.
- Identity practitioners: much of Domain 2 is identity work in practice: service accounts that call model endpoints, API keys for model providers, and the credentials and permissions given to agents. See the Agentic AI Security Guide.
For the wider map of credentials, see the Cybersecurity Certifications Guide.
Practitioner checklist
- Confirm the current exam version, launch and retirement dates on CompTIA's SecAI+ page before booking.
- Download the CY0-001 exam objectives and acronym list, and rate yourself against every sub-objective.
- Close the security foundation gap first if you lack Security+ level knowledge.
- Put most study time into Domain 2, securing AI systems, at 40% of the exam.
- Read the OWASP Top 10 for LLM Applications 2025, MITRE ATLAS and the NIST AI RMF core alongside the objectives.
- Build or review one real AI deployment and practise least privilege, logging and isolation on it.
- Rehearse under the 60-minute limit with performance-based style tasks.
- Plan renewal: 15 CEUs and a $75 CE fee per three-year cycle, separate from Security+.
Standards and references
- CompTIA: SecAI+ Certification
- CompTIA: Earn Continuing Education Units (CEUs)
- CompTIA: Continuing Education Renewal Fees
- CompTIA: Renewing Multiple Certifications
- NIST: AI Risk Management Framework
- OWASP: Top 10 for LLM Applications 2025
- MITRE: ATLAS
Related NHI Mgmt Group resources: ISACA AAISM and AAIA AI Certifications Guide · AI Security Engineer Career Guide · CompTIA Security+ Guide · Cybersecurity Certifications Guide