ISC2 has published the outline for its forthcoming AI Security Certification pilot, offering a useful picture of the skills employers may soon expect from people responsible for securing AI deployments. The outline covers six domains, from model and data protection to architecture, incident response, governance and testing. It is a reminder that buying an AI security product does not remove the need for someone who understands how the whole system behaves.
Two domains, AI data management and model security, and secure AI operations and incident response, each carry 19 percent of the proposed exam weighting. Architecture and identity management account for 18 percent. Governance and compliance and threats and lifecycle management each receive 17 percent, while fundamentals take 10 percent. These proportions are revealing. The proposed professional role is broader than detecting malicious prompts or configuring a model endpoint.
An enterprise assistant may read internal files, retrieve customer records, invoke tools and send information to external services. Its security boundary therefore includes the permissions granted to those tools, the quality of retrieved data, and the way untrusted text is handled. Traditional access controls still matter. So do logging, testing, isolation and procedures for stopping a compromised workflow.
For employers, the practical question is whether their security teams can trace an AI-enabled action from the original user request through retrieved material to a downstream system. A checklist limited to model selection and acceptable-use policy will miss much of that path. Teams should inventory AI integrations, identify high-impact tool permissions, test misuse scenarios and define who can disable an agent during an incident.
The pilot is scheduled to begin in mid-December 2026, with selected candidates registering from mid-November. ISC2 says the three-hour pilot will contain 160 multiple-choice questions and be delivered in person. The certification remains in development, so employers should avoid treating the pilot as an established hiring requirement.
The larger signal is that AI security is becoming a distinct combination of engineering, operational response and risk ownership. Organizations can use the published domain structure now as a gap assessment, even before the credential is finalized.