ISC2 Building AI Strategy Certificate

AI helps both sides. You compare traditional threats with AI-specific ones such as prompt injection, data poisoning and model theft, see how attackers use generative tools, and judge where AI improves detection and where established methods still do better.

• Traditional attacks compared with AI-specific attacks
• Prompt injection, poisoning and model extraction
• How attackers use generative AI
• AI in threat detection, triage and investigation
• Where rules and classical analytics still win
• Mitigations that match each AI risk

You build A threat and mitigation table for one AI-enabled application.

A confident answer is not a correct one. You learn why people over-trust automated output, design human oversight that still works at volume, and decide which actions a model may take on its own and which need a person to approve.

• Automation bias and why people over-trust models
• Hallucination and unverified output as a security risk
• Human-in-the-loop designs that hold up under load
• Setting autonomy levels by consequence
• Validating AI results before they drive action
• Auditing AI-assisted decisions

You build An oversight design for an AI-assisted security workflow, with approval points and checks.

Secure AI is planned at the start and maintained after launch. You apply security principles and governance to each stage, from data collection and training to deployment, monitoring and retirement, and assign owners to each control.

• AI lifecycle stages and their risks
• Governing training data and its provenance
• Securing the model, its pipeline and its endpoints
• Monitoring for drift, misuse and degradation
• Roles and accountability for AI systems
• Retiring models and the data behind them

You build A lifecycle security plan for one AI system, with controls and owners per stage.

Rules for AI are arriving from several directions at once. You compare AI risk and management frameworks with the security principles you already use, read how major regulations classify AI systems, and map duties to a real deployment.

• NIST AI Risk Management Framework in outline
• ISO/IEC 42001 and AI management systems
• The EU AI Act and its risk-based approach
• OWASP and MITRE resources for AI threats
• Mapping AI frameworks to security and privacy controls
• Handling overlap and conflict between regimes

You build A mapping of one AI deployment to the frameworks and regulations that apply to it.

AI changes the tasks people do before it changes the number of people doing them. You assess how roles, skills and training must shift, plan how to bring teams along, and set ethical guardrails for AI use inside the security function.

• Which tasks change and which stay human
• Skills security teams need to work alongside AI
• Training plans and learning paths
• Leading change and managing concern in a team
• Ethics and acceptable use of AI inside security
• Measuring whether AI is helping the team

You build A workforce transition plan for a security team adopting AI tools.

Combine everything into a strategy a leadership team can adopt. You assess where AI is used and planned, rank the risks, choose controls and oversight, align the plan with regulation, and describe how people and process will adapt.

• Inventorying current and planned AI use
• Assessing risk and choosing controls
• Setting oversight and accountability
• Aligning with regulation and standards
• Planning workforce and process changes
• Presenting the strategy to leadership

You build An AI security strategy document for a sample organization, with a phased plan.