CompTIA SecAI+ (CY0-001)
What is CompTIA SecAI+? The new AI security certification, explained
CompTIA SecAI+ is the vendor-neutral certification for securing AI systems and using AI in security operations. This guide covers what it validates, the four exam domains and their weightings, who it is for, how difficult it is, and what it costs in Australia.
Last reviewed: September 2026
What is CompTIA SecAI+?
CompTIA SecAI+ (exam code CY0-001) is a vendor-neutral certification that validates two related skill sets: how to secure artificial intelligence systems, and how to use AI to do security work better. CompTIA launched Version 1 on 17 February 2026, and the exam has roughly a 3-year life before the code is refreshed.
The structural point that trips people up is that SecAI+ is what CompTIA calls an expansion certification. It is not a beginner credential, and it is not a replacement for a foundational cert like Security+. It sits on top of your existing security knowledge and adds an AI specialisation. Think of it as a layer: Security+ (or equivalent experience) establishes that you understand core security concepts, and SecAI+ proves you can apply that judgement to the specific problems AI introduces, from prompt injection and data poisoning through to AI governance and model risk.
That framing matters when you decide whether the cert is right for you, because it assumes you already bring real security experience to the table. SecAI+ is designed for the practitioner who now has to defend AI systems, or defend against attackers who are using AI, and wants a recognised way to prove it.
Who is SecAI+ for?
SecAI+ is aimed at working security practitioners who now have to deal with AI, whether because their organisation is deploying it or because attackers are weaponising it. The clearest fits are:
- SOC analysts who need to triage AI-related alerts and recognise AI-enabled attacks such as deepfakes and automated, polymorphic malware.
- Security engineers and cloud or DevSecOps practitioners who are building the guardrails, gateways, and pipelines that sit around models in production.
- Security architects who threat-model AI systems and data pipelines, for example using an adversary knowledge base like MITRE ATLAS.
- GRC and risk professionals who own AI governance, risk, and compliance work and need to speak the technical language credibly.
- Experienced holders of Security+, CySA+, or PenTest+ who want to specialise as AI adoption accelerates across Australian organisations.
CompTIA recommends 3 to 4 years in IT, including 2 or more years of hands-on cybersecurity, before you sit the exam. There is no formal or hard prerequisite; nothing is checked or enforced when you book. The recommendation is a genuine signal about the depth of the questions rather than a marketing line, so if you are earlier in your career, build the fundamentals first with our free CompTIA SecAI+ practice test to see where the level actually sits.
The CY0-001 exam at a glance
Here are the confirmed facts about the current SecAI+ exam in one place.
| Attribute | CompTIA SecAI+ (CY0-001) |
|---|---|
| Exam code | CY0-001 (Version 1) |
| Launched | 17 February 2026 |
| Exam life | Around 3 years before the code is refreshed |
| Format | Multiple-choice and performance-based questions |
| Number of questions | Maximum 60 |
| Time limit | 60 minutes |
| Passing score | 600 on a scale of 100 to 900 |
| Languages | English and Japanese |
| Recommended experience | 3 to 4 years in IT, including 2 or more years hands-on cybersecurity |
| Renewal | 15 CEUs over the 3-year continuing-education cycle |
The headline numbers to internalise are the maximum of 60 questions in 60 minutes and the 600 passing score on a 100 to 900 scale. The passing score is scaled rather than a raw percentage, so there is no fixed "number correct" to aim for; you prepare against the objectives, not a magic number.
The four SecAI+ domains, and what they weight
CY0-001 draws from four domains with fixed weightings. Knowing the weightings tells you where to spend your study time, because they are far from even.
1. Basic AI concepts for cybersecurity (17%)
The foundation layer: how models are built and optimised, what techniques such as retrieval-augmented generation, fine-tuning, and quantization actually do, and the data properties that matter for security work like provenance and human-in-the-loop oversight. It is the smallest weighting, but it is the vocabulary the other three domains assume you already have.
2. Securing AI systems (40%)
This is the core of the exam, at 40% it is nearly half the marks and worth more than any other domain by a wide margin. It covers the AI attack taxonomy (prompt injection both direct and indirect, data and model poisoning, model inversion, membership inference, excessive agency, insecure output handling) and the controls that counter them, from guardrails and gateway rate limits to anonymisation and threat modelling with MITRE ATLAS. If you are weak here, you will not pass, so treat this domain as the centre of gravity for your preparation.
3. AI-assisted security (24%)
How defenders use AI to do the job, and how attackers use it against them. Expect anomaly detection in the SOC, AI-assisted code scanning in CI/CD pipelines, standardised tool connections such as Model Context Protocol, and the offensive side too: deepfake-enabled social engineering and AI-generated polymorphic malware that defeats signature-based detection.
4. AI governance, risk and compliance (19%)
The programme-level view: frameworks such as the NIST AI Risk Management Framework, responsible-AI principles like explainability, and named risks including shadow AI and model drift, plus the governance roles that own them. This is where the exam connects hands-on security to organisational accountability.
Is SecAI+ difficult to pass?
SecAI+ is a tight exam. A maximum of 60 questions in 60 minutes leaves you about a minute per item on average, and some of those items are performance-based, meaning they ask you to solve a problem rather than pick a definition. That pace punishes hesitation.
It is also an experience-driven exam. The recommended 3 to 4 years in IT with 2 or more years of hands-on security is not decoration; the questions expect you to apply judgement to realistic scenarios, not recite terminology. Domain 2 alone is 40% of the marks, so a candidate who is comfortable with general AI concepts but shaky on the AI attack taxonomy and its controls will struggle.
One thing worth stating plainly: SecAI+ is shorter than Security+ (which runs up to 90 questions in 90 minutes), but shorter is not easier. Fewer questions means each one carries more weight and less room to recover from a bad patch. The honest way to gauge readiness is to work fresh questions under time pressure; our free SecAI+ practice test is weighted to match the real domains so you can see where you stand before you book.
How much does the SecAI+ exam cost in Australia?
Mindset Cyber's official SecAI+ voucher is A$399 + GST (A$438.90 inc. GST) for a single exam, while CompTIA direct lists the same voucher at US$298, billed in USD. The comparison table below shows how the main Australian buying options line up.
| Where you buy | Single voucher | Voucher + retake | Notes |
|---|---|---|---|
| Mindset Cyber (CompTIA Authorised Partner) | A$399 + GST (A$438.90 inc. GST) | A$499 + GST (A$548.90 inc. GST) | Australian GST tax invoice, 12-month voucher, emailed within 24 hours, Pearson VUE or OnVUE. |
| CompTIA direct | US$298 (list) | Check the CompTIA Store for current USD bundle pricing | Billed in USD, and the same voucher is US$279 from Mindset Cyber. A card FX margin applies on top, and you get no Australian GST tax invoice. |
| IT Masters (another AU reseller) | Not listed separately | A$525 (as listed September 2026) | Voucher-with-retake bundle only; GST inclusion is not stated on their page. |
In every currency Mindset Cyber prices it, the voucher undercuts buying direct from CompTIA: the single voucher is A$399 + GST (A$438.90 inc. GST), which is US$279 for overseas buyers against CompTIA's US$298 list. Because CompTIA bills in US dollars, a card FX margin lands the real AUD cost higher, and you get no Australian GST tax invoice. IT Masters' cheapest listed SecAI+ option bundles a retake at A$525, so for a single voucher with a local tax invoice, Mindset Cyber is both the lowest-cost and the lowest-friction path.
For the full breakdown, including study-material budgets and tax-invoice notes, see our SecAI+ exam cost guide, or go straight to the CompTIA SecAI+ (CY0-001) voucher page.
SecAI+ vs Security+: what is the difference?
The two certifications solve different problems, so this is a "which first" question more than an "either or" one. The table sets the specifications side by side.
| Attribute | Security+ | SecAI+ |
|---|---|---|
| Exam code | SY0-701 | CY0-001 |
| Focus | Broad security foundation | Securing AI, and AI in security |
| Level | Foundational | Expansion (specialist) |
| Questions | Up to 90 | Maximum 60 |
| Time limit | 90 minutes | 60 minutes |
| Mindset Cyber single voucher | A$599 + GST (A$658.90 inc. GST) | A$399 + GST (A$438.90 inc. GST) |
| Renewal | 50 CEUs | 15 CEUs |
Security+ is the broad foundation that proves you understand core security concepts, and it is the credential most people earn first. SecAI+ is the AI specialist layer that assumes those fundamentals are already in place and adds securing AI systems and using AI in security work. Most candidates take Security+ (or gain equivalent hands-on experience) before SecAI+.
For a deeper side-by-side, read SecAI+ vs Security+. If you still need the foundation, the CompTIA Security+ (SY0-701) voucher is the place to start.
Is SecAI+ worth it in 2026?
There is a genuine early-mover case. SecAI+ launched in February 2026, so holding it now puts you among the first practitioners who can demonstrate AI security competence with a recognised, vendor-neutral credential, at exactly the moment Australian organisations are scrambling to deploy AI safely. Being early is a differentiator that fades as the field fills up.
It is also cheap to keep. SecAI+ renews on 15 CEUs over its 3-year continuing-education cycle, against 50 CEUs for Security+, which makes it the least expensive CompTIA security certification to maintain. That lowers the long-term cost of carrying the credential once you have it.
One boundary worth drawing: SecAI+ is a practitioner-level, hands-on certification, whereas organisation-level AI governance (building and certifying a formal AI management system) is ISO/IEC 42001 territory, which Mindset Cyber's PECB ISO/IEC 42001 Lead Implementer course (A$849 + GST) covers at the management-system level. If your role is defending AI systems day to day, SecAI+ is the fit; if you are standing up the governance programme, look at the PECB ISO/IEC 42001 Lead Implementer course instead.
How do you book the SecAI+ exam in Australia?
The path is short. You buy a voucher, then redeem it to schedule your exam:
- Buy an official CY0-001 voucher (from Mindset Cyber you get an Australian GST tax invoice and email delivery within 24 hours).
- Create or sign in to your Pearson VUE account and enter the voucher code.
- Choose your delivery method: sit at any Australian Pearson VUE testing centre, or take it online through OnVUE with a webcam and a clean workspace.
- Pick a date within the voucher's 12-month validity and confirm.
When you are ready, the CompTIA SecAI+ (CY0-001) voucher is on our CompTIA store page, with the single-voucher and Voucher plus Retake Assurance options side by side.
Frequently asked questions
Is CompTIA SecAI+ hard to pass?
SecAI+ is a tight, experience-driven exam: a maximum of 60 questions, including performance-based items, in 60 minutes, with a passing score of 600 on a scale of 100 to 900. It assumes you already have hands-on security experience, so it is not a beginner exam. It is shorter than Security+, but shorter does not mean easier, because every question expects applied AI security judgement rather than recall.
Do I need a certification before taking SecAI+?
No. There is no formal or hard prerequisite for CY0-001, and nothing is checked or enforced when you book. CompTIA recommends 3 to 4 years in IT, including 2 or more years of hands-on cybersecurity, and holding Security+, CySA+, or PenTest+ (or equivalent knowledge) as sensible groundwork before you sit it.
What languages is the SecAI+ exam available in?
The CY0-001 exam is currently available in English and Japanese. You sit it at any Pearson VUE testing centre or online through OnVUE, and a voucher redeemed with either delivery method works the same way.
How much does the CompTIA SecAI+ voucher cost?
Mindset Cyber's official single-user CompTIA SecAI+ voucher is A$399 + GST (A$438.90 inc. GST), which includes a 12-month voucher, an Australian GST tax invoice, and email delivery within 24 hours. CompTIA sells the same single voucher direct at US$298 list, billed in USD with no Australian tax invoice. The voucher pays for the exam only; no training is bundled.
Is there a retake option if I fail SecAI+?
Yes. If you do not pass on the first attempt you buy a new voucher, or you use the second voucher included in Mindset Cyber's Voucher plus Retake Assurance bundle at A$499 + GST (A$548.90 inc. GST). CompTIA imposes a mandatory 14-day waiting period before you retake the exam.
Ready to sit SecAI+?
Mindset Cyber is an Australian CompTIA Authorised Partner. Mindset Cyber's official single-user SecAI+ voucher is A$399 + GST (A$438.90 inc. GST), with an Australian GST tax invoice, no FX margin, and email delivery within 24 hours. The voucher covers the exam only; no training is bundled.
Still preparing? Test yourself with the free SecAI+ practice test, compare the pathway in SecAI+ vs Security+, or price it out in the SecAI+ exam cost guide.