ISC2 announcement October 26, 2026; pilot exam from mid-December 2026 through late January 2027
ISC2 Publishes the Pilot Exam Outline for a New AI Security Certification
ISC2, the nonprofit membership organization for cybersecurity professionals, released the pilot exam outline for a new AI security certification on October 26, the next step in a development process informed by input from nearly 10,000 volunteer professionals through job task analysis surveys, item development, and expert review. The outline covers six areas of practice: AI concepts and security fundamentals; AI governance, ethics, risk, and compliance; AI data management, privacy, and model security; secure AI architecture, engineering, and identity and access management; secure AI operations and incident response; and AI threats, testing, and lifecycle management. Proposed experience requirements are four years of cumulative paid full-time experience in cybersecurity or AI-related fields, including two years in cybersecurity and one year in two or more exam domains, with an active CISSP, ISSAP, ISSEP, ISSMP, CCSP, or CSSLP credential accepted as a substitute for the entire experience requirement, and candidates are not required to hold an ISC2 certification. Approximately 3,000 qualified volunteers will sit for the pilot exam from mid-December through late January, with volunteer interest due by November 4, and ISC2 says a successful pilot leads to an operational launch in 2027, with pilot passers who meet the requirements becoming the first holders of the credential.
Executives
A dedicated AI security credential is being standardized, which gives hiring and staffing a common vocabulary for a role many organizations are currently improvising. When vendors and candidates claim AI security expertise, a defined domain structure, governance, data and model security, architecture, operations, and lifecycle testing, is a useful checklist for what the claim should cover.
CIO / CISO
Use the six domains as a gap check for your own AI security staffing and training plans, whether or not anyone pursues the credential. If your program is thin on AI incident response or on model lifecycle testing, the outline documents that those are now baseline professional expectations, which supports the training request.
Engineers
If you secure AI systems day to day, the pilot is a low-cost way to be in the first cohort: volunteers are selected from those who submit interest by November 4, the pilot runs from mid-December through late January, and passing it with the experience and endorsement requirements met makes you a charter holder when the certification launches in 2027.
Everyone (non-IT)
A new professional certificate is being created for the people who secure AI systems, separate from general cybersecurity credentials. It reflects how quickly securing AI has become its own job, with its own skills in governance, data protection, and incident response.