Last week ISC2 announced the new AI Security Certification pilot and published the pilot exam outline. I consider myself extremely fortunate to have been invited to help put it together, and I wanted to share a few thoughts on what came out of all that work. One caveat before anything else: as you might imagine, all the work we did in Job Task Analysis (JTA) 1 and JTA2 remains confidential, so what follows is my opinion alone and based only on the published material. Nothing here represents ISC2's position, and it is not a reflection of the conversations in the room, which I can't discuss, and which were every bit as good as I hinted after my week in Singapore.
It is close to impossible to cover everything related to AI security. The field spans model internals, data pipelines, identity for non-human actors, regulation, and a threat landscape that shifts every time a new agent framework ships. The CISSP has never covered everything in security either, and no one who has sat for it would claim otherwise. But what it did was give a profession a shared (and high) bar: a common vocabulary and baseline that employers, practitioners, and educators could aim at, argue about, and improve over time. That is what ISC2 aims for here too. Personally, I see a lot of opportunity for the likes of ISACA, SANS, and CompTIA to augment and build upon the approach and scope built here as well.
Just as the CISSP has evolved over the years, I expect this exam to as well. For those who, like me, took the paper exam and had to memorize which gas was used to extinguish fires in data centers (it was Halon back in my day), the sheer breadth of what was part of the exam was what made it so daunting but also so rewarding. Today, that same seemingly immeasurable breadth and depth exist inside AI security. Consider the distance from a governance lead mapping the EU AI Act onto a chatbot that quietly became an agent, to an architect wrestling with identity and authorization for an agent whose access needs change with every task, then to a SOC analyst triaging a novel attack against AI with no malware and no signature, and finally to a model developer who needs to recognize when a few hundred poisoned documents have backdoored an entire model.
That is the challenge ISC2 took on with this certification, and it is why I want to talk about the personas the certification intersects with, and why leaders need to understand a bit of what each of them faces.
Before we dive into the personas, it's important to review the domain titles and weights associated with them. The pilot exam outline linked earlier goes much deeper on what's in each domain.
| # | Domain | Weight |
|---|---|---|
| 1 | Artificial Intelligence (AI) Concepts and Security Fundamentals | 10% |
| 2 | AI Governance, Ethics, Risk, and Compliance | 17% |
| 3 | AI Data Management, Privacy, and Model Security | 19% |
| 4 | Secure AI Architecture, Engineering, and Identity and Access Management (IAM) | 18% |
| 5 | Secure AI Operations and Incident Response (IR) | 19% |
| 6 | AI Threats, Testing, and Lifecycle Management | 17% |
| Total | 100% |
Look at the domains and weights in the outline and you'll see that five of the six sit between 17% and 19%, with fundamentals at 10%. To me that evenness accomplishes two things. First, it forces practitioners who are deep in one or two areas to expand their knowledge to have a reasonable chance at passing; and second, it demonstrates to leaders who use this cert for credibility that there are many ways AI is relevant to the business and security needs to be top of mind. A SOC analyst who is excellent at using AI to triage and remediate vulnerabilities might still have a large gap before they understand AI architectures and governance. Let's dive into the four personas I personally see represented.
The first three are the ones you would expect: governance personnel, who turn regulation and risk appetite into policy, oversight, and accountability; security architects and engineers, who build the controls; and security operations practitioners, SOC analysts included but far from limited to them, who have to detect and respond when something goes wrong. Ask people which of the three matters most and you will get a confident answer that tends to match the asker's job title. I don't think there is a right answer. All three need to be represented, and leadership needs to understand the tension each one feels.
Governance is asked to demonstrate oversight and explainability for systems that change faster than the policy cycle. Architects are asked to build guardrails and scope identity for agents whose behavior isn't deterministic. Operations is asked to detect and contain attacks using telemetry that was never designed for any of this, where the evidence of a breach may be a conversation instead of a log line. When those tensions go unacknowledged, you get policies demanding irrelevant controls, poorly documented security implementations that don't match compliance, and operational alerts nobody knows how to triage.
This is why leadership needs to see across all three. Fifteen years ago, the CISSP gave many security leaders a working picture of the breadth of problems their teams were dealing with, from cryptography to physical security to business continuity, and that shared picture made them better at prioritizing across teams. A leader who only sees one of these seats will optimize for it and be surprised when the other two fall flat. The leader who understands what each persona deals with every day will notice that a new policy has no owner in engineering, or that a new control has no one watching it.
The fourth persona matters a great deal to me: AI architects who are trying to build securely in regulated or high-sensitivity environments. Security has a long habit of navel-gazing, and for the foreseeable future the people building with AI will understand what is happening inside these systems far better than security folks do. Those building where the data is sensitive or the regulator is watching are already making hard trade-offs about data lineage, residency, and what a model is allowed to see, often without practical guidance. They also meet the failure modes first, which makes them the people best placed to tell us whether a control survives contact with a real pipeline. A certification written only for security people would miss the people who know these systems best. In the cloud era, the security teams that sat beside builders early got better results than the ones who arrived with a checklist at the end, and I would like us to learn that lesson faster this time.
ISC2 describes certification development as a practitioner-led process and says more than 9,000 volunteers have contributed to this work so far. That breadth is what gives a standard its legitimacy, and it only continues if people with real experience keep showing up. If you sit in any of those four seats, ISC2 needs your experience more than it needs another opinion piece, mine included. You can learn how to volunteer through ISC2's volunteer program and the AI security certification page, which also links the volunteer interest form for the pilot exam.
At Generative Security, we will keep working on the problems these personas share. GenR3d helps architects and engineers find industry-specific abuse cases before an agent reaches production, and Agent Vardøger watches agents in production for the teams who have to respond. If you want to compare notes on how these four perspectives fit together in your own organization, or what the outline means for your team, reach out at questions@generativesecurity.ai. We're happy to delve into it with you.
About the author
Michael Wasielewski is the founder and lead of Generative Security. With 20+ years of experience in networking, security, cloud, and enterprise architecture Michael brings a unique perspective to new technologies. Working on generative AI security for the past 3 years, Michael connects the dots between the organizational, the technical, and the business impacts of generative AI security. Michael looks forward to spending more time golfing, swimming in the ocean, and skydiving... someday.
