Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by CompTIA
Exam Format
60 min
Maximum of 60
600 (on a scale of 100-900)
Expansion
Registration
$359 USD
Pearson VUE or online proctoring
English
Validity
3 years
Complete continuing education (CE) activities; Earn higher-level CompTIA certifications; Retake the most current version of the exam
CY0-001 Exam Topics and Domains
CY0-001 is organized into 4 weighted domains.
1
Basic AI Concepts Related to Cybersecurity
17%
Compare and contrast various AI types and techniques used in cybersecurity
Types of AILanguage ModelsModel Training TechniquesPrompt Engineering
- Compare and contrast generative AI, machine learning, statistical learning, transformers, deep learning, and NLP
- Differentiate between LLMs, SLMs, and GANs and their cybersecurity applications
- Explain model training techniques including supervised, unsupervised, and reinforcement learning
- Describe fine-tuning methods including epoch management, pruning, and quantization
- Apply prompt engineering techniques including system prompts, user prompts, and various prompting strategies
Explain the importance of data security in relation to AI
Data ProcessingData TypesWatermarkingRetrieval-Augmented Generation (RAG)
- Explain data processing concepts including cleansing, verification, lineage, integrity, provenance, augmentation, and balancing
- Differentiate structured, semi-structured, and unstructured data types and their security implications
- Describe the role of watermarking in AI content attribution
- Explain RAG architecture including vector storage and embeddings and their security considerations
Explain the importance of security throughout the life cycle of AI
AI Lifecycle PhasesHuman-Centric AI Design Principles
- Describe each phase of the AI lifecycle from business use case through feedback and iteration
- Explain security requirements at each AI lifecycle phase
- Apply human-centric AI design principles including human-in-the-loop, oversight, and validation
2
Securing AI Systems
40%
Given a scenario, use AI threat-modeling resources
OWASP AI Security ResourcesMIT AI Risk RepositoryMITRE ATLASCVE AI Working GroupThreat-Modeling Frameworks
- Apply OWASP LLM Top 10 and ML Security Top 10 to assess AI system risks
- Use MITRE ATLAS to identify and categorize adversarial AI threats
- Leverage the MIT AI Risk Repository for structured risk assessment
- Apply CVE AI Working Group resources for vulnerability tracking
- Select and apply appropriate threat-modeling frameworks to AI systems
Given a set of requirements, implement security controls for AI systems
Model ControlsGateway ControlsGuardrail Testing and Validation
- Implement model-level security controls including guardrails and prompt templates
- Configure gateway controls including prompt firewalls, rate limits, token limits, and input quotas
- Design and execute guardrail testing and validation procedures
Given a scenario, implement appropriate access controls for AI systems
AI Access Control Domains
- Implement access controls for AI models, data, agents, and network/API endpoints
- Apply least-privilege and zero-trust principles to AI system access
Given a scenario, implement data security controls for AI systems
Encryption RequirementsData Safety Controls
- Implement encryption controls for data in transit, at rest, and in use within AI systems
- Apply data safety controls including anonymization, classification, redaction, masking, and minimization
Given a scenario, implement monitoring and auditing for AI systems
Prompt MonitoringLog ManagementOperational MonitoringAuditing for Quality and Compliance
- Implement prompt monitoring for queries and responses
- Configure log monitoring, sanitization, and protection for AI systems
- Monitor response confidence levels, rates, and costs
- Audit AI systems for hallucinations, accuracy, bias, fairness, and access compliance
Given a scenario, analyze the evidence of an attack and suggest compensating controls for AI systems
AI-Specific AttacksCompensating Controls
- Identify and analyze evidence of AI-specific attacks including prompt injection, poisoning, jailbreaking, model inversion, model theft, and supply chain attacks
- Recommend appropriate compensating controls for identified AI attacks
- Apply defense-in-depth principles to AI system security
3
AI-Assisted Security
24%
Given a scenario, use AI-enabled tools to facilitate security tasks
AI Security Tools and ApplicationsSecurity Use Cases for AI Tools
- Identify and select appropriate AI-enabled tools for security tasks
- Apply AI tools for signature matching, vulnerability analysis, anomaly detection, and incident management
- Understand Model Context Protocol (MCP) and its role in AI tool integration
Explain how AI enables or enhances attack vectors
AI-Generated Content ThreatsAI-Enhanced Attack Capabilities
- Explain how AI enables deepfakes, impersonation, and disinformation campaigns
- Describe how AI enhances reconnaissance, social engineering, malware development, and DDoS attacks
- Identify AI-driven attack patterns and their distinguishing characteristics
Given a scenario, use AI to automate security tasks
AI Automation in SecurityAI Agents and CI/CD Security
- Implement AI-driven automation for scripting, incident response, and change management
- Integrate AI agents and automation into CI/CD security pipelines
- Apply AI for code scanning, SCA, and automated testing
4
AI Governance, Risk, and Compliance
19%
Explain organizational governance structures that support AI
Organizational Structures for AIAI-Related Roles
- Explain AI governance structures including AI Center of Excellence and AI policies
- Describe AI-related organizational roles and their governance responsibilities
Explain risks associated with AI
Responsible AI PrinciplesAI Risk Categories
- Apply responsible AI principles including fairness, reliability, transparency, privacy, explainability, inclusiveness, and accountability
- Identify and assess AI-specific risks including bias, data leakage, IP concerns, and shadow AI
Summarize the impact of compliance on business use and development of AI
Regulatory FrameworksCorporate AI PoliciesCompliance Operations
- Explain the EU AI Act, OECD standards, ISO AI standards, and NIST AI RMF and their impact on AI deployment
- Develop corporate AI policies addressing sanctioned vs unsanctioned use and sensitive data governance
- Evaluate third-party AI vendors for compliance and manage data sovereignty requirements
How do I earn this certification?
Passing CY0-001 earns the CompTIA SecAI+ certification. It sits in the Cybersecurity - AI Security Expansion track.
Next Level Options
CAS-005 - CompTIA SecurityX (formerly CASP+)Advanced architecture and enterprise security certification
Alternative Paths
- AAISM - ISACA Advanced in AI Security ManagementISACA's AI security certification with heavier governance and risk management focus; complements SecAI+ for those in GRC roles
- AIGP - IAPP AI Governance ProfessionalFocuses specifically on AI governance and privacy engineering; deeper privacy focus than SecAI+
- CISSP - ISC2 Certified Information Systems Security ProfessionalBroad enterprise security certification; SecAI+ adds specialized AI security depth
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
The most effective way to prepare for CY0-001 is by using the PlanetCert Simulator to practice questions and review detailed explanations.
What's changed on this exam?
Current Status
- ACTIVE
- Last content update: 2026-02-17
- Announcement date: 2026-02-17
Updates
- Model Context Protocol (MCP) Directly tested in Domain 3 (AI-Assisted Security) under AI-enabled tools
- OWASP LLM Top 10 and ML Security Top 10 Core resources for Domain 2 (Securing AI Systems) threat modeling objectives
- MITRE ATLAS Essential resource for Domain 2 threat modeling scenarios
- EU AI Act Directly tested in Domain 4 (AI GRC) compliance objectives
Who should take this exam?
- 3-4 years of general IT experience
- 2+ years of hands-on cybersecurity experience
- CompTIA Security+ certification or equivalent
- CompTIA CySA+ certification or equivalent
- CompTIA PenTest+ certification or equivalent