Use ISC2's Outline to Claim AI Security Skills
A practical gap-check for non-engineers who want to position governance, risk, privacy, or incident-response skills toward AI security.
If you can evidence governance, risk, compliance, data privacy, or incident response, you can claim AI security skills without becoming an engineer. ISC2 released the outline for its new AI security certification at Security Congress in Denver on 26 October 2026. Use the outline as a map for a one-week gap-check.
ISC2 intends to choose around 3,000 qualified volunteers for the AI security pilot, with test dates from mid-December to late January. The pilot is without charge, English-language, face-to-face, and limited to a 160-question, 180-minute, linear, no-skip format at ISC2-authorised Pearson Professional Centres. ISC2 says the AI security credential will go live in 2027 if the pilot performs well.
The outline turns a vague career question into a checklist. You do not need to write code to be useful in AI security. You need to show that you can control risk, protect data, and respond when something breaks.
The outline is a career filter, not a coding test
Many professionals outside core security already own pieces of the skill set. Governance and data privacy are the easiest places for non-engineers to start. A privacy analyst can speak to data minimization. A risk manager can speak to controls. An operations lead can speak to escalation. The gap is naming those pieces in AI terms.
The experience requirement shows who the credential targets. To qualify for ISC2's AI security credential, a candidate needs at least four years of paid full-time work in cybersecurity or AI-related areas, with two of those years in cybersecurity and one year covering at least two exam domains. Holding an active CISSP, ISSAP, ISSEP, ISSMP, CCSP, or CSSLP can waive the full experience requirement for the ISC2 AI security credential.
The strongest non-engineer claims are usually about control, not code. You can say you helped define acceptable use, review model outputs, protect training data, or respond to a data leak. You cannot say you secured the model unless you can show the control you owned.
Run the six-domain gap-check before buying a course
Use the areas below as a quick test. If you can evidence an item, put it on your AI security watchlist. If you cannot, mark it as the gap to close first.
- AI concepts: Can you explain what a model, prompt, and hallucination are in plain language? If yes, basic AI literacy is ready to add to your watchlist.
- Governance, ethics, and risk: Can you point to a policy, risk register, or control you have helped write or enforce? If yes, AI governance readiness is on the table.
- Data, privacy, and model security: Can you describe how you handle personal data, access reviews, or data minimization? If yes, data privacy for AI is a defensible claim.
- Architecture and identity: Can you explain how users, services, or APIs are authenticated and authorized? If yes, identity and access awareness is worth naming.
- Operations and incident response: Can you describe a response plan, escalation path, or post-incident review you have used? If yes, AI incident response readiness is a strong watchlist item.
- Threats and testing: Can you name a threat, red-team exercise, or test case you have helped run or review? If yes, AI threat awareness is ready to add to your watchlist.
Do not try to claim all of them. Pick the one that matches your current job and the one that is closest to the next role you want. That choice becomes your watchlist entry.
Turn one transferable skill into a claim this week
If you are planning a certification push, the pilot gives you a way to try the credential before you commit to a course. The deadline to express interest in the ISC2 AI security pilot is 4 November 2026. Write the claim in a way a hiring manager can verify. Name the system, the control, and the outcome. If you handled personal data, say how you limited access. If you ran incident response, say what you escalated and what you documented. That evidence makes AI security feel real on a resume.
Before the end of this week, write one transferable skill from your current role onto your AI security watchlist. Name it in one sentence: what you have done, what it protects, and how it applies to AI.