ISC2 AI Security Certification Pilot: What Is Coming in 2027

ISC2 has released the pilot exam outline for its new ISC2 AI security certification, and cybersecurity professionals now have their first detailed look at the credential. The announcement came on October 26, 2026. The outline names six domains, sets out proposed experience requirements, and opens a pilot exam that will run from mid-December 2026 through late January 2027. About 3,000 volunteers will sit that pilot, and anyone who wants a seat must submit interest by November 4, 2026. The certification has no name, no price, and no launch date beyond 2027. This post separates what ISC2 has confirmed from what candidates still have to wait for.

ISC2 AI Security Certification: What ISC2 Announced on October 26

ISC2 released the pilot exam outline for its new AI security certification on October 26, 2026. The outline names six domains, from AI concepts to AI threats and lifecycle management. About 3,000 volunteers will sit the pilot exam from mid-December through late January, and ISC2 plans a launch in 2027.

ISC2 is the nonprofit body behind CISSP, and it counts more than 270,000 certified members and associates worldwide. According to the ISC2 announcement, the pilot outline is the next step in a standards-based development process shaped by input from nearly 10,000 volunteer professionals through Job Task Analysis surveys, exam item development and expert review. In other words, practitioners built the outline, and practitioners will now test it.

Casey Marks, Chief Operating Officer at ISC2, explained the purpose of the pilot in the announcement. The pilot exam, he said, provides critical evidence to evaluate whether the examination measures AI security competence “reliably, fairly and defensibly”. That evidence decides what happens next. If the pilot succeeds, the certification becomes operational in 2027. If the data raises problems, ISC2 adjusts the exam before anyone can book it as a finished product.

The Six Domains of the ISC2 AI Security Certification Pilot

The pilot exam outline names six domains. The weights below are the pilot exam weights published on the ISC2 program page, and each domain carries topics and subtopics inside the outline document itself.

Domain	Pilot exam weight	Focus in plain terms
Artificial Intelligence (AI) Concepts and Security Fundamentals	10%	How AI systems work and the security basics that apply to them
AI Governance, Ethics, Risk and Compliance	17%	Policy, accountability and the rules that govern AI use
AI Data Management, Privacy and Model Security	19%	Protecting training data, personal data and the models themselves
Secure AI Architecture, Engineering and Identity and Access Management (IAM)	18%	Building AI systems with sound architecture and controlled access
Secure AI Operations and Incident Response (IR)	19%	Running AI systems safely and responding when something goes wrong
AI Threats, Testing and Lifecycle Management	17%	Attack methods against AI, security testing and care across the lifecycle

Two points stand out from the table. First, governance is a full domain, not a side topic, and it carries more weight than the fundamentals domain. Second, data and model security ties with operations and incident response as the heaviest area at 19 percent. The outline therefore treats AI security as a broad professional practice, not a narrow testing specialty.

Who the ISC2 AI Security Certification Is Built For

ISC2 says the certification is intended for professionals responsible for securing the design, deployment and maintenance of AI and machine learning systems throughout the AI lifecycle. The program page names security architects, engineers, operations leads, risk managers and strategists. The work extends beyond technical defense into governance, ethics, risk-based guidance and enterprise collaboration.

The proposed experience requirements are demanding, and ISC2 uses the word “proposed” because the pilot will confirm the final scheme:

• A minimum of four years of cumulative, paid full-time experience in cybersecurity or AI-related fields
• Two of those years must be in cybersecurity, and one year must cover two or more domains from the exam outline
• An active CISSP, ISSAP, ISSEP, ISSMP, CCSP or CSSLP credential can substitute for the entire experience requirement
• A degree in computer science, IT, STEM or a related field can satisfy up to one year, and part-time work and internships may also count

Candidates are not required to hold an ISC2 certification. However, the four-year bar makes this a mid-career credential, closer in spirit to CISSP than to an entry-level certificate.

Pilot Exam Dates, Format and the November 4 Deadline

The pilot is a real exam sitting, not a survey. ISC2 has published the pilot exam facts on its program page:

Pilot exam detail	What ISC2 has published
Exam length	3 hours
Number of items	160
Item format	Multiple choice
Language	English
Testing center	Pearson Professional Center (PPC)
Pilot window	Mid-December 2026 through late January 2027
Seats	Approximately 3,000 qualified volunteers, selected on knowledge and experience

To volunteer, submit interest through the form on the ISC2 program page by November 4, 2026. Volunteering is open to the global cybersecurity community, and ISC2 encourages non-members with AI security experience to take part. The reward for pilot candidates is significant: anyone who passes the pilot, meets the experience requirements and completes the endorsement process becomes one of the first holders of the new certification.

Why ISC2 Is Building an AI Security Credential Now

ISC2 argues that professionals already use AI to analyze threats, secure AI-enabled systems, make decisions based on AI outputs and govern AI systems, yet no global standard defines the skills that work requires or how employers should validate them. The new certification is ISC2’s answer to that gap.

The announcement also lands in a crowded season for AI credentials. CompTIA has announced AgentOps+, a vendor-neutral certification for operating AI agents, planned for Q2 2027; our CompTIA AgentOps+ announcement post covers its five skill areas. The focus differs, though: AgentOps+ targets operations work with agents, while the ISC2 credential targets the security of AI systems and demands years of experience. On the assurance side, the AICPA AI assurance guide explains how SOC 2 and AIUC-1 will audit AI systems from the outside. ISC2 is instead certifying the people who secure those systems from the inside, and the heavy governance domain shows how seriously it takes that overlap.

What Is Not Announced Yet for the ISC2 AI Security Certification

An honest announcement post needs a clear list of gaps, because candidates plan around them:

• The name. The certification has no name yet. ISC2 refers to it only as the AI security certification, and CEO Scott Beale confirmed to Infosecurity Magazine that it does not have a name at this stage.
• The price. ISC2 has published no fee for the pilot or for the operational exam.
• The operational exam format. The 160 items and 3 hours describe the pilot. ISC2 has not confirmed that the launched exam will keep the same length or item count.
• The pass score. No passing standard has been published, which is normal before a pilot, because pilot data helps set the standard.
• The final objectives. The pilot outline is detailed, but ISC2 will analyze pilot results before the operational program, so treat the outline as a first edition rather than a frozen blueprint.
• The exact launch date. ISC2 says 2027. Beale estimated the first quarter of 2027, possibly as early as January, in the same Infosecurity Magazine report. That is an estimate from an interview, not a date ISC2 has committed to.

What Candidates Can Do Today

First, read the pilot exam outline itself and the program page, because the topics and subtopics inside each domain are the closest thing to a study syllabus that exists right now. Second, if your experience fits the proposed requirements, submit the volunteer form before November 4, 2026; pilot seats are the fastest route to the credential, and selection favors relevant knowledge and experience. Third, map your career against the six domains and the four-year rule, and note any gaps you can close during 2027. Finally, watch for the name, price and launch announcements, because a full study guide only becomes possible once ISC2 freezes the operational objectives.

Frequently Asked Questions

When does the ISC2 AI security certification launch?

ISC2 says the certification will become operational and launch in 2027 if the pilot exam phase succeeds. No exact date is confirmed. A first quarter 2027 estimate has been reported from a CEO interview, but treat it as an estimate until ISC2 publishes a date.

How do I volunteer for the pilot exam?

Submit your interest through the volunteer form on the ISC2 program page by November 4, 2026. ISC2 will select approximately 3,000 qualified volunteers based on relevant knowledge and experience, and the pilot runs from mid-December 2026 through late January 2027.

Do I need CISSP before I can take this certification?

No. Candidates are not required to hold an ISC2 certification. The proposed requirement is four years of experience, with two years in cybersecurity and one year across two or more outline domains. An active CISSP, ISSAP, ISSEP, ISSMP, CCSP or CSSLP can substitute for the entire experience requirement.

What does the ISC2 AI security certification cost?

ISC2 has not announced a price for the pilot or the operational exam. Any fee quoted by a third-party site today is a guess, so budget only after ISC2 publishes its own pricing.

The Short Version

ISC2 released the pilot exam outline on October 26, 2026. Six domains, pilot weights from 10 to 19 percent, a 160-item, 3-hour pilot exam for about 3,000 volunteers from mid-December through late January, and a volunteer deadline of November 4, 2026. A four-year experience requirement is proposed. The name, price, pass score and exact 2027 launch date are still to come.