TL;DR: Earn CompTIA SecAI+ (CY0-001) first if you work hands-on in security (SOC, security engineering, cloud security) and want proof that you can defend AI systems and use AI tools safely. Earn ISACA AAISM (Advanced in AI Security Management) first if you already hold an active CISM or CISSP and your work is in governance, risk and security leadership. The two do not compete head on. SecAI+ has no formal prerequisite and tests technical and applied skill in up to 60 questions over 60 minutes. AAISM is locked behind CISM or CISSP and tests management judgment across 90 questions. If you hold neither CISM nor CISSP, AAISM is not available to you yet, which means you choose.
Key Takeaways
- They answer different questions. SecAI+ asks “Can you secure and operate AI systems?” AAISM asks “Can you govern, manage risk for and lead security around AI?”
- Eligibility decides first. ISACA states you must hold an active CISM or CISSP to pursue AAISM. SecAI+ lists no formal prerequisites, though CompTIA recommends 3 to 4 years of IT experience with about 2 in hands-on cybersecurity.
- Weights show the focus. SecAI+ puts 40% on securing AI systems. AAISM puts 38% on AI technologies and controls and 62% on governance, program management and risk.
- AAISM costs more. ISACA lists USD 459 (member) or USD 599 (non-member) for the exam plus a one-time USD 50 application fee. CompTIA’s pages do not list a SecAI+ price, and reseller listings we saw ran from about USD 253 to USD 298.
- AAISM depends on your base certification. ISACA says maintaining AAISM requires maintaining CISM or CISSP.
- Doing both is realistic for some people. A CISSP holder who leads a security program may want AAISM for strategy and SecAI+ for technical credibility, but the order depends on your role.
- Neither is a guarantee. Both are new, and employers are still learning how to read them.
Quick Facts
| Item | CompTIA SecAI+ | ISACA AAISM |
| Full name | CompTIA SecAI+ V1 (CY0-001) | Advanced in AI Security Management |
| Launch | February 17, 2026 | Announced August 19, 2025 |
| Type | Expansion certification for working security staff | Advanced credential layered on CISM or CISSP |
| Formal prerequisite | None. Recommended: 3 to 4 years in IT, about 2 years in cybersecurity | Active CISM or CISSP required |
| Questions | Up to 60, multiple-choice and performance-based | 90 (ISACA’s content outline) |
| Time | 60 minutes | Not listed on the ISACA pages we reviewed. Third-party guides report 150 minutes |
| Passing score | 600 on a 100 to 900 scale | Not listed on the ISACA pages we reviewed. Third-party guides report 450 on a scaled score |
| Domains | Basic AI concepts 17%, Securing AI systems 40%, AI-assisted security 24%, AI governance, risk and compliance 19% | AI governance and program management 31%, AI risk management 31%, AI technologies and controls 38% |
| Exam fee | Not listed by CompTIA. Reseller listings seen: about USD 253 to 298 | USD 459 member, USD 599 non-member, plus USD 50 application fee |
| Keeping it current | Not stated on the SecAI+ pages we reviewed. CompTIA certifications generally run three years, so confirm | 10 hours of AI-focused CPE a year, 30 over three years, annual fee USD 20 member or USD 35 non-member |
| Delivery | Check CompTIA for current options | PSI test centers or remote proctoring, with continuous registration |
Prices and policies change. Confirm on the vendor pages before you pay.
What Is CompTIA SecAI+?
SecAI+ is CompTIA’s AI security certification for people who already work in cybersecurity. CompTIA calls it an expansion certification: it is not tied to a single job title, and it is designed to sit beside Security+, CySA+, PenTest+ and SecurityX rather than replace them. CompTIA says it is not meant for people entering cybersecurity for the first time.
The official objectives read like a practitioner’s checklist. You are expected to know how generative AI and machine learning differ, how a model moves through its life cycle and how to threat model AI systems with resources such as the OWASP LLM and ML Top 10 lists and MITRE ATLAS. The largest domain covers controls and attack recognition: prompt injection, data and model poisoning, model inversion, model theft, insecure output handling, excessive agency and similar. The exam also covers using AI for defense (detection, triage, automation) and understanding AI-enhanced attacks such as deepfakes.
Two things to know before you plan around it. CompTIA says ISO 17024 accreditation and DoD 8140 mapping are pending, so if you need those for a government contract, check the status. And the exam price is not shown on CompTIA’s pages, so you will need the store or an authorized seller for a number.
What Is ISACA AAISM?
AAISM is ISACA’s AI-focused security management credential. ISACA introduced it in August 2025 and positions it for experienced professionals in security or advisory roles who have some expertise assessing, implementing and maintaining AI systems. The key rule: you must hold an active CISM or CISSP to pursue it.
Its three domains are AI governance and program management (31%), AI risk management (31%) and AI technologies and controls (38%). The task list in ISACA’s outline is a manager’s list: build a governance charter, write AI-specific security policies, run risk assessments, assess vendors and the AI supply chain, conduct AI impact assessments, define security metrics, maintain AI incident handling and develop awareness training and acceptable use guidelines. Technical content exists (AI security architecture, life cycle controls, data management controls), but you are expected to advise on and review these controls, not configure them.
If you are choosing between CISM and CISSP as your base, our CISSP vs CISM guide and CISA vs CISM guide cover that decision.
How Do the Exam Contents Compare?
SecAI+ leans technical and applied. AAISM leans toward governance, risk and leadership. The weights make the difference clear.
| Area | SecAI+ | AAISM |
| Foundations (AI concepts, life cycle) | Domain 1, 17% | Woven into Domain 3 (AI life cycle, model selection, training and validation) |
| Securing AI systems and controls | Domain 2, 40%: threat modeling resources, guardrails, gateway controls, access control, data security, monitoring, attack recognition | Domain 3, 38%: security architecture and design, data management controls, privacy, ethics, trust and safety controls, security controls and monitoring |
| Using AI in security work | Domain 3, 24%: AI-enabled tools, AI-enhanced attacks, automation | Not a separate domain. Appears as AI security tools within the program |
| Governance and compliance | Domain 4, 19%: governance structures, AI risks, EU AI Act, NIST AI RMF and similar | Domain 1, 31%: stakeholders, frameworks, regulations, policies, asset and data life cycle, program development, continuity and incident response |
| Risk management | Inside Domains 2 and 4 | Domain 2, 31%: risk assessment, threat and vulnerability management, vendor and supply chain management |
What this means in practice: if your day involves system logs, prompts, pipelines and controls, SecAI+ matches the work. If your day involves charters, policies, risk registers and steering committees, AAISM matches the work. The overlap is real in governance and risk, but SecAI+ gives it 19% of the exam, while AAISM gives it about 62%.
How Do the Exam Formats Compare?
SecAI+ is shorter and mixes in hands-on tasks. AAISM is longer and more scenario-driven, based on the information we could confirm.
- SecAI+: up to 60 questions in 60 minutes, multiple-choice and performance-based, scored from 100 to 900 with 600 to pass. That is about a minute per question, and performance-based items eat time.
- AAISM: 90 questions across three domains per ISACA’s content outline. ISACA’s pages we reviewed do not list the duration or passing score. Third-party guides report 150 minutes and a scaled pass mark of 450, but treat those as unconfirmed until you see them in ISACA’s candidate materials. ISACA states the exam is computer-based at PSI test centers or remotely proctored, with registration open all year and scheduling possible as early as 48 hours after payment. Your eligibility window runs six months from registration.
Neither vendor publishes a pass rate, so ignore any percentage you see online.
What Are the Requirements for Each?
SecAI+ has no formal gate. AAISM requires an active CISM or CISSP.
For SecAI+, CompTIA recommends 3 to 4 years of IT experience, about 2 years of hands-on cybersecurity, and Security+, CySA+, PenTest+ or equivalent knowledge. These are recommendations, not checks at registration.
For AAISM, ISACA’s certification page lists these steps:
- Hold an active CISM or CISSP.
- Pass the AAISM exam.
- Submit an application within five years of passing and pay the USD 50 application processing fee.
- Agree to ISACA’s Code of Professional Ethics and the CPE policy.
ISACA’s pages we reviewed do not state a separate work experience requirement for AAISM. A third-party guide also says it does not require formal experience, but your CISM or CISSP already carries its own experience rules. If you do not hold either one, the practical path to AAISM runs through one of them first, and our CISSP vs CCSP guide and SecurityX vs CISSP guide can help you plan that. If you are earlier in your career, start with the foundations in our ISC2 CC vs Security+ guide.
How Much Do They Cost?
AAISM is the more expensive route in fees and upkeep, and it also needs a CISM or CISSP you must keep current.
| Cost | SecAI+ | AAISM |
| Exam | Not listed by CompTIA. Reseller listings we saw: about USD 253 to 298 | USD 459 member, USD 599 non-member |
| Certification or application fee | None listed | USD 50 one-time, payable after scores are released |
| Annual maintenance | Not stated on the SecAI+ pages we reviewed | USD 20 member, USD 35 non-member |
| Study materials | CompTIA sells optional learning products. CompTIA says CertMaster Study, Labs and Perform together typically take about 20 to 25 hours | ISACA sells a review manual, an online review course and a question database. A third-party source lists the course at USD 449 member and USD 549 non-member |
| Ongoing education | Not stated | 10 AI-focused CPE hours a year, 30 over three years |
First-year cost, ignoring study materials, comes to about USD 253 to 298 for SecAI+ at the reseller prices we saw, against USD 509 (member) or USD 649 (non-member) for the AAISM exam plus application fee. These are planning numbers, not quotes. ISACA membership has its own fee that we have not included, and prices change, so confirm before you pay.
One more cost sits behind AAISM: it requires keeping CISM or CISSP active, so any upkeep fees and CPE for those continue too. ISACA notes that AI-focused CPE hours may be accepted by other ISACA certifications, which can reduce duplicate effort if you hold CISM.
How Hard Is Each Exam?
SecAI+ is hard in breadth and attack recognition. AAISM is hard in judgment and framing. Neither vendor publishes difficulty data, so this comparison is based on the published content.
SecAI+ asks you to separate look-alike attacks (membership inference vs model inversion, data poisoning vs backdoors) and match each to the best control, often under a one-minute-per-question clock. The performance-based items also assume you have worked with real tooling.
AAISM asks you to choose between defensible management actions. A typical question will not ask for a command. It will ask which action best reduces risk, which stakeholder should own a decision or how to build a control into a program. Candidates who have prepared for CISM or CISSP will recognize that style. Candidates who lean technical may find the governance weighting unfamiliar, and candidates who lean managerial may find SecAI+’s attack and control detail harder.
Which Certification Fits Which Career?
Match the certification to the work you do now and the work you want in two years.
| Your role | Better first choice | Why |
| SOC analyst or detection engineer | SecAI+ | Covers AI-enabled detection, triage, AI-enhanced attacks and defending AI systems |
| Security engineer or architect reviewing AI applications | SecAI+ | Threat modeling, guardrails, access control, data security, attack recognition |
| Cloud security engineer | SecAI+ | Securing AI deployments is a core domain |
| Security manager or director with CISSP or CISM | AAISM | Builds on your base certification and focuses on programs, risk and governance |
| GRC lead or risk manager with CISM | AAISM | Governance and risk make up about 62% of the exam |
| Consultant advising on AI risk | AAISM, with SecAI+ for technical depth | Strategy credibility first, technical credibility second |
| Auditor | See our guide on ISACA’s AAIR and ISACA’s audit-focused options | AAISM is a security management credential, not an audit one |
| Early-career security professional | Neither yet | Build core security first, such as Security+ (see our Security+ version guide) |
If you are also weighing ISC2’s AI credential, read our ISC2 AI security certification guide.
Decision Framework: Which One Should You Earn First?
Work through these questions in order:
- Do you hold an active CISM or CISSP? If no, SecAI+ is your only option of the two right now. If yes, continue.
- Is your daily work technical (logs, pipelines, controls) or managerial (policy, risk, program)? Technical points to SecAI+, managerial points to AAISM.
- Who will read your resume? Technical hiring managers often recognize CompTIA. Enterprise risk and security leadership roles often recognize ISACA and ISC2. Check postings for your target role.
- Does a contract or employer require DoD 8140 or ISO 17024? CompTIA lists both as pending for SecAI+, so confirm before you rely on it.
- What is your budget and timeline? SecAI+ has a lower entry cost and a shorter exam. AAISM has higher fees and ongoing CPE.
- Could you do both? If you hold CISSP and lead a team, AAISM first for strategy and SecAI+ later for technical depth is a sensible order. If you are a hands-on engineer, SecAI+ first and AAISM later (after you earn CISM or CISSP) is the usual direction.
Are They Worth It for Your Career?
They are worth it when AI security is already part of your job or your next job, and they are not a shortcut into the field. Both certifications are new, so there is limited market history on how employers weigh them. ISACA positions AAISM for security leaders, and CompTIA positions SecAI+ for practitioners, which fits how hiring tends to split in the field. A certification will help you show structured knowledge, but employers will still ask what you have actually secured, assessed or governed.
We do not quote salary figures. Pay depends on role, employer and region, and neither vendor publishes salary data for these credentials. Before you commit, search for your target job title and see how often SecAI+ or AAISM appears in requirements.
Study Plan Ideas
If you are preparing for SecAI+ (about six weeks for a working professional, our estimate):
- Weeks 1 and 2: AI basics, then the OWASP LLM and ML Top 10 and MITRE ATLAS, with notes on each attack and its control.
- Weeks 3 and 4: controls, access, data security, monitoring and AI-assisted security. Build a small lab with a local model and try safe prompt-injection tests.
- Week 5: governance (EU AI Act, NIST AI RMF, ISO) and risk.
- Week 6: timed sets of 60 questions, then review every miss against the objectives.
If you are preparing for AAISM (about 6 to 8 weeks if you already hold CISM or CISSP, our estimate):
- Weeks 1 and 2: Domain 1, AI governance and program management. Draw a governance structure and write a one-page AI security policy.
- Weeks 3 and 4: Domain 2, AI risk management. Practice an AI risk assessment, a vendor review and an impact assessment.
- Weeks 5 and 6: Domain 3, technologies and controls. Focus on what you must advise on, not configure.
- Weeks 7 and 8: scenario practice. For each question, ask what a security leader would do first and why.
Common Mistakes to Avoid
- Planning for AAISM without CISM or CISSP. ISACA requires one of them to be active.
- Treating SecAI+ as an introduction to security. CompTIA says it is not for first-time entrants.
- Choosing by brand instead of role. Pick the one that matches your daily work.
- Assuming price and validity. CompTIA’s SecAI+ pages do not list a price or validity, so confirm both. For AAISM, factor in the application fee, annual fee and CPE.
- Skipping governance in SecAI+. It is 19% and scenario-driven.
- Skipping the technical material in AAISM. Domain 3 is the largest at 38%.
- Ignoring maintenance. AAISM needs 10 AI-focused CPE hours a year and an active CISM or CISSP.
FAQS
Is AAISM harder than SecAI+?
Neither vendor publishes pass rates, so we cannot say. SecAI+ is harder on technical breadth and attack recognition, and AAISM is harder on governance and risk judgment.
Can I take AAISM without CISM or CISSP?
No. ISACA states candidates must hold an active CISM or CISSP.
Do I need Security+ for SecAI+?
No formal prerequisite exists. CompTIA recommends Security+, CySA+, PenTest+ or equivalent knowledge plus 3 to 4 years of IT experience.
Which AI security certification is better for a SOC analyst?
SecAI+ fits better. It covers AI-assisted detection, triage and automation as well as defending AI systems.
Which is better for a CISO or security manager?
AAISM fits better if you hold CISM or CISSP, because it centers on governance, risk and program management.
How many questions are on the AAISM exam?
90, according to ISACA’s exam content outline.
How many questions are on the SecAI+ exam?
Up to 60 questions in 60 minutes, with a passing score of 600 on a 100 to 900 scale.
How much does AAISM cost?
ISACA lists USD 459 for members and USD 599 for non-members for the exam, plus a USD 50 application processing fee after you pass.
How much does SecAI+ cost?
CompTIA’s pages we reviewed do not list a price. Reseller listings we saw ranged from about USD 253 to 298, so confirm with CompTIA’s store.
Do I need to renew AAISM?
Yes. ISACA requires 10 AI-focused CPE hours each year and 30 over three years, an annual fee (USD 20 member, USD 35 non-member) and an active CISM or CISSP.
Is SecAI+ accepted for DoD 8140?
Not confirmed. CompTIA says DoD 8140 mapping and ISO 17024 accreditation are pending.
Should I get both SecAI+ and AAISM?
Some people will. A CISSP or CISM holder in a leadership role may want AAISM first and SecAI+ later for technical depth. A hands-on engineer usually starts with SecAI+.
Is there salary data for AAISM or SecAI+?
Neither vendor publishes it, and both certifications are new, so there is little market history. Check job postings for your role and region.
Final Thoughts
The choice mostly makes itself once you answer two questions: do you hold an active CISM or CISSP, and do you work on the technical or the managerial side of security? Without CISM or CISSP, SecAI+ is the one you can take now. With one of them and a leadership role, AAISM builds directly on what you have. Whichever you choose, read the official outline first, confirm the cost and maintenance terms and check the vendor’s own pages before you register. ISACA’s AAISM page lists the current eligibility rules and fees.
