CompTIA SecAI+ (CY0-001) — the full course

Every lesson and every lab is free to read, mapped one-to-one to CompTIA’s published exam objectives. The paid tier adds the 400-question exam simulator; nothing is taken away from the free course to make room for it.

33written lessons

52hands-on labs

54hours of lab work

27audio episodes

400practice questions

Start with lesson 1 — AI types, from statistical learning to transformers, and what each one can get wrong Exam simulator

Jump to a domain: 1. Basic AI Concepts Related to Cybersecurity · 2. Securing AI Systems · 3. AI-assisted Security · 4. AI Governance, Risk, and Compliance

What the exam weighs

Domain	Share of the exam	Lessons here
1. Basic AI Concepts Related to Cybersecurity	17%	5
2. Securing AI Systems	40%	13
3. AI-assisted Security	24%	8
4. AI Governance, Risk, and Compliance	19%	6

The curriculum

1. Basic AI Concepts Related to Cybersecurity 17% of the exam

01 AI types, from statistical learning to transformers, and what each one can get wrong objective 1.1 part single
- Classify ten AI systems, then watch a generative model do a classifier's job short · 35 min
02 How models are trained, validated and prompted, and the attack surface each step creates objective 1.1 part single
- Version a prompt template, then prove every change with the same evaluation applied · 75 min
- Catch the leak and the accuracy trap before a fraud model ships short · 35 min
03 Data processing for AI: cleansing, lineage, provenance and the data types a model learns from objective 1.2 part single
- Write provenance, lineage and integrity records for your corpus, and make the integrity check fire short · 40 min
04 Retrieval-augmented generation, embeddings and vector stores, and watermarking what a model produces objective 1.2 part single
- Treat the vector store as a data store, show vectors are not anonymous, and test what a watermark proves applied · 90 min
- Watch a restricted chunk reach the wrong user, then filter by identity before retrieval short · 40 min
05 Security across the AI life cycle, from business case to feedback loop objective 1.3 part single
- Gate the feedback loop, and match human control to impact and volume applied · 75 min
- Take the lab assistant through every gate and sign it into service, or refuse to capstone · 150 min
- Write the use-case record that could have stopped the project, and triage five proposals short · 35 min

2. Securing AI Systems 40% of the exam

01 The OWASP Top 10 for LLM applications and for machine learning, used as a working checklist objective 2.1 part single
- Walk both OWASP lists against your own lab short · 40 min
02 MITRE ATLAS, the MIT AI Risk Repository, CVE for AI and threat-modelling an AI system objective 2.1 part single
- Threat-model the lab's retrieval app with all four resources applied · 80 min
- Map one attack path through your lab to ATLAS and find the gaps short · 40 min
03 Model controls: evaluation, guardrails and prompt templates, and testing that they hold objective 2.2 part single
- Add an output canary guardrail and measure its error rates short · 45 min
04 Gateway controls: prompt firewalls, rate and token limits, quotas and endpoint access objective 2.2 part single
- Make the gateway a real choke point applied · 90 min
- Add a per-user rate limit and token limits to the gateway short · 45 min
05 Access control for models and the data behind them objective 2.3 part single
- Make retrieval respect the reader and stop the canary leaking short · 45 min
06 Access control for AI agents and the APIs they call objective 2.3 part single
- Review an over-equipped helpdesk agent and fence it in applied · 90 min
- Give a toy agent narrow tools that check their own parameters short · 45 min
07 Encryption for AI systems in transit, at rest and in use objective 2.4 part single
- Map every copy of a prompt, then encrypt the hop and the archive short · 45 min
08 Data safety for AI: anonymisation, classification labels, redaction, masking and minimisation objective 2.4 part single
- Minimise, label, mask and redact the RAG pipeline end to end applied · 85 min
- Measure what your redactor misses, using values you planted short · 40 min
09 Monitoring AI systems: prompts, responses, logs and confidence objective 2.5 part single
- Baseline one AI application and alert on departures from it applied · 85 min
- Sanitise the prompt log at write time and prove it with seeds short · 40 min
10 Rate and cost monitoring, and auditing AI for quality and compliance objective 2.5 part single
- Attribute every token to a caller and catch the runaway one short · 40 min
11 Prompt injection, jailbreaking and guardrail evasion: the evidence they leave and the controls that contain them objective 2.6 part single
- Contain indirect injection in your own retrieval app applied · 85 min
- Read the evidence of injection in a gateway log short · 40 min
12 Poisoning, introduced bias, model skewing and AI supply chain attacks objective 2.6 part single
- Catch a poisoned training set and pin the artefacts short · 45 min
13 Model theft, model inversion, membership inference, model denial of service and overreliance objective 2.6 part single
- Domain 2 capstone: defend the estate and prove every control capstone · 140 min
- Spot extraction and runaway cost in the query log short · 45 min

3. AI-assisted Security 24% of the exam

01 AI tools for security work: IDE, browser and CLI plug-ins, chatbots, assistants and MCP servers objective 3.1 part single
- Build a local MCP server and inventory every tool it exposes short · 45 min
02 AI for detection: signature matching, anomaly detection, pattern recognition and fraud objective 3.1 part single
- Score synthetic card transactions and choose a threshold you can defend applied · 90 min
- Pit a signature rule against an anomaly detector on synthetic gateway traffic short · 45 min
03 AI for code quality, vulnerability analysis, automated testing, incidents and threat models objective 3.1 part single
- Check an AI-drafted incident timeline against its source log short · 40 min
04 AI-generated content: deepfakes, impersonation, misinformation and disinformation objective 3.2 part single
- Detect a payment-change fraud from context, and sort misinformation from disinformation applied · 80 min
- Write a call-back runbook and drill it against eight written requests short · 40 min
05 How AI enhances reconnaissance, obfuscation and automated attacks, explained for defenders objective 3.2 part single
- Build an exposure inventory of your own AI lab and plant a honeytoken short · 45 min
06 Automating security work with AI: scripting, low-code and no-code tools, documents and tickets objective 3.3 part single
- Review an AI-generated clean-up script before it is allowed to run short · 40 min
07 AI agents, AI-assisted approvals and automated change objective 3.3 part single
- Put an AI agent through change control, a tested rollback and an audit capstone · 150 min
- Bound a toy containment agent with an allow-list, a blast-radius cap and a run log short · 45 min
08 AI in the CI/CD pipeline: code scanning, software composition analysis and model testing objective 3.3 part single
- Build a blocking model-test gate for your RAG app's release bundle applied · 90 min
- Prove an AI-written test suite detects anything, with mutation testing short · 40 min

4. AI Governance, Risk, and Compliance 19% of the exam

01 Governance structures for AI: the centre of excellence, policies and procedures objective 4.1 part single
- Run three proposals through an intake path and reconcile it with the log applied · 75 min
- Write the lab's AI policy, standard and procedure at the right level short · 40 min
02 AI roles and responsibilities, from data scientist to AI auditor objective 4.1 part single
- Build a RACI for the lab and test it for separation of duties short · 40 min
03 Responsible AI: fairness, reliability, transparency, explainability and accountability objective 4.2 part single
- Turn ten principles into controls, and measure consistency from the log short · 45 min
04 AI risks: bias, accidental leakage, reputation, accuracy, intellectual property, autonomy and shadow AI objective 4.2 part single
- Find the shadow AI in your own lab and set autonomy limits applied · 80 min
- Write the AI risk register for your own lab system short · 45 min
05 AI regulation and standards: the EU AI Act, OECD principles, ISO AI standards and NIST AI RMF objective 4.3 part single
- Crosswalk your lab's controls to NIST AI RMF, ISO/IEC 42001 and OECD short · 45 min
06 Corporate AI policy, third-party compliance and data sovereignty objective 4.3 part single
- Assess your lab's suppliers and map where its data goes applied · 85 min
- Assemble the governance pack for your lab system and audit it capstone · 140 min
- Publish an allow-list and a data-class map your documents can be checked against short · 40 min

Supplementary not examined — background reading

01 An AI lab you can break safely, on a machine you own and with data you wrote part single
- Build the isolated AI lab, log the first request, and prove the isolation can fail short · 45 min

The exam simulator

400 questions, every one mapped to an objective and to the lesson that teaches it. Timed full-length papers drawn to the real domain split, retakes weighted to your weak areas, and a readiness report from your own results.

Open the simulator See the paid tier

27 of the 33 lessons have an audio episode so far, and each plays in the lesson itself — there is nothing extra to sign up for.

The episodes are also a podcast: listen on Spotify.

This is an independent study companion for CompTIA SecAI+ CY0-001 and is not produced by or endorsed by CompTIA.