The short version
CY0-001 is the exam for CompTIA SecAI+, a security certification about artificial intelligence. It asks whether you can secure AI systems, use AI as a security tool, and handle the governance and risk side of AI. The exam is new (CompTIA launched it on February 17, 2026), and the details below come from CompTIA’s own exam page, checked on October 18, 2026.
What the exam is
SecAI+ sits alongside CompTIA’s other security certifications. It is not an AI course for beginners and it is not a data-science exam. Think of it as a security exam in which the thing being protected, or the thing doing the protecting, is an AI system.
That gives the exam two sides. On one side you defend AI: guardrails, access controls, data protection, monitoring, and recognizing attacks such as prompt injection or data poisoning. On the other side you use AI: detection, automation, and understanding how attackers use it against you. A fourth area covers policy, risk, and regulation. All of it is vendor-neutral, so you are not tested on one cloud provider’s product names.
Who it is for
CompTIA recommends 3 to 4 years of IT experience and at least 2 years of hands-on cybersecurity experience. It also lists Security+, CySA+, PenTest+, or equivalent knowledge as the recommended starting point. It states no formal prerequisite on the exam page. Typical candidates are security analysts, cloud and platform engineers who now run AI services, and governance or risk staff who have to answer for them. The prerequisites page has a self-check list.
Format at a glance
| Item | What CompTIA says |
|---|---|
| Exam code | CY0-001 (version V1) |
| Launch | February 17, 2026 |
| Number of questions | Maximum of 60 |
| Question types | Multiple-choice and performance-based |
| Time | 60 minutes |
| Passing score | 600 on a scale of 100 to 900 |
| Languages | English and Japanese |
| Expected retirement | Estimated 3 years after launch |
Delivery options, scoring, and retakes are explained on the exam format page.
The four domains and their weightings
| Domain | Weighting |
|---|---|
| 1.0 Basic AI concepts related to cybersecurity | 17% |
| 2.0 Securing AI systems | 40% |
| 3.0 AI-assisted security | 24% |
| 4.0 AI governance, risk, and compliance | 19% |
Basic AI concepts related to cybersecurity
The vocabulary and the life cycle. You compare types of AI (machine learning, deep learning, large and small language models, generative AI), training approaches, and prompt techniques. You also cover data handling such as cleansing, lineage, and retrieval-augmented generation, plus where security fits at each stage from business case to monitoring.
Securing AI systems
The biggest domain, and the heart of the exam. It covers threat-modeling resources, model and gateway controls, access control for models, data, and agents, data protection, monitoring and auditing, and analyzing evidence of attacks to pick compensating controls.
AI-assisted security
Using AI tools for security work: anomaly detection, vulnerability analysis, summarization, and automation in pipelines. It also covers how attackers use AI for deepfakes, reconnaissance, and social engineering.
AI governance, risk, and compliance
Roles and structures that keep AI under control, responsible-AI principles, risks such as bias and shadow AI, and frameworks and laws including the EU AI Act and the NIST AI Risk Management Framework.
Because domain 2 carries 40%, a weak spot there costs more than anywhere else. The domains explained page shows what each domain looks like in practice.
Official source
CompTIA’s SecAI+ exam page is the final authority if anything here differs.
More guides for CY0-001
- CY0-001 Study Plan: 4 and 8 Weeks
- CY0-001 Sample Questions With Answers
- Is CY0-001 Hard? SecAI+ Difficulty
- CY0-001 Renewal and Retakes Explained
- Is CY0-001 Worth It? An Honest Look
- CY0-001 Cheat Sheet: Key Facts to Review
- SY0-801 vs CY0-001: Which Exam First?
Next step
Read the domains explained page to see where your study time should go. When you want to check yourself, our CY0-001 practice tests are original practice sets built around these four domains.
Frequently asked questions
Is there a prerequisite for CY0-001?
CompTIA’s exam page states none. It does recommend 3 to 4 years of IT experience, about 2 years of hands-on cybersecurity experience, and knowledge at the level of Security+, CySA+, or PenTest+.
Does SecAI+ expire?
CompTIA’s continuing education page lists 15 continuing education units (CEUs) for SecAI+ over a three-year renewal cycle. Check that page for the current renewal options.
Is the exam available in languages other than English?
CompTIA lists English and Japanese.