Validates knowledge of AI concepts, securing AI systems, AI-assisted security operations, and AI governance, risk and compliance.
SecAI+ tests whether you understand how AI systems work, how they are attacked and defended, how AI can support security operations, and how to govern its use. Learn the objectives with one course or book, read the threat frameworks they name, then practise with questions and PBQs.
Example scenario: Your fraud team has years of transactions already labelled as fraud or genuine. Which kind of model would you expect them to train, and what data risks would you check first?
Example scenario: An internal chatbot answers questions from HR documents. A user asks it to ignore its instructions and list everyone's salary. Which controls should have stopped this?
Example scenario: Your SOC uses an AI assistant to summarize alerts, and one summary names an IP address that does not appear in any log. What would you do before acting on it?
Example scenario: Your company plans to screen job applicants with an AI model. Which risk assessment and oversight steps would you put in place before it goes live?
Official CY0-001 exam objectives · CY0-001 (V1)
Choose the best answer from the options, or the stated number of answers when a question asks for more than one.
An attacker adds mislabelled records to the data a company uses to retrain its fraud model. Which attack is this?
A. Data poisoning corrupts the training data so the model learns the wrong patterns. Prompt injection targets a model's input at run time instead.
Complete a hands-on task in a simulated environment, such as configuring a setting, reading output or putting steps in order.
Match each AI risk to the control that best reduces it. Risks: prompt injection, sensitive data in prompts, model drift, unauthorized use of a model API.
Prompt injection → input filtering, sensitive data in prompts → data loss prevention, model drift → performance monitoring, unauthorized API use → API authentication.
Read the objectives and the threat frameworks they name. Work through one course or book, then spend the remaining time on questions and review.
Most candidates spend 15–40 hours. Plan for the low end if you already work on AI security; plan for the high end if machine learning terms are new to you.
Choose one main course or book. The LinkedIn Learning course and the Sybex guide are by the same authors, so you only need one of them.
Best short courseCompTIA SecAI+ (CY0-001) Cert Prep
Best bookCompTIA SecAI+ Study Guide
Best for employer-fundedCertMaster Perform for SecAI+Read the source frameworks. The objectives name the OWASP Top 10 for LLM applications and for machine learning, MITRE ATLAS and the MIT AI Risk Repository. Skim each one directly rather than relying on summaries.
Use practice questions to find weak domains, then review why each option is right or wrong. Practise PBQs, and take at least one full timed exam.
Buy a voucher and schedule with Pearson VUE. The voucher is valid for 12 months, subject to the exam retirement date.
In a March 2026 pass report, a commenter says the two OWASP lists, for LLM applications and for machine learning, caught them out. The candidate who scored 780 used the LinkedIn Learning course, a podcast and their own review.
Pass reports mention three or four performance-based questions. A May 2026 candidate who used CertMaster Perform saw about 50 questions and little overlap with Security+.