PECB Certified AI Security Professional (CAISP): Why It's a Must for Anyone Entering AI Security
The PECB Certified AI Security Professional (CAISP) is a five-day course and open-book exam on how AI systems are attacked, defended and governed. See the five exam domains, who it suits, and how the Provisional credential lets you start without experience.
The PECB Certified Artificial Intelligence Security Professional (CAISP) is a five-day training course and exam on how AI systems are attacked, defended and governed. It is worth taking if you are moving into AI security, because it gives you a structured map of the field: five exam domains, MITRE ATLAS and the OWASP Top 10 for LLM Applications as working frameworks, and lab work in prompt injection testing and AI red teaming. The Provisional credential needs no professional experience, so you can start before you have the hours.
Enroll online and your course access is provided the same day you enroll. Want to talk it through first? Ask a PECB certified trainer directly.
Key takeaways
- CAISP runs five days: four days of training, then the exam on day five.
- The exam has 80 multiple-choice questions and a 70% pass mark. It is open-book, using your course materials and notes.
- Foundations carry the most weight. Domain 1 is 37.5% of the exam, while attack techniques and AI-enhanced threat intelligence are 12.5% each.
- The Provisional credential needs no professional experience. The full credential needs five years (two in information or cybersecurity) and 300 hours of project activity.
- CAISP covers securing the AI system itself. ISO/IEC 42001 training covers the management system around it, so the two pair well.
- If you already work in AI governance or cybersecurity, CAISP adds the layer that connects the two: testing and defending the AI system your policies describe.
Table of contents
- What is the PECB Certified AI Security Professional certification?
- Why AI security is a different job from traditional cybersecurity
- Why CAISP matters if you already work in AI governance or cybersecurity
- What the five days cover
- How the CAISP exam works
- Who benefits most from CAISP
- Provisional or full credential: what you can claim and when
- How CAISP fits with ISO/IEC 42001, the NIST AI RMF and the EU AI Act
- What CAISP will not do for you
- Should you take it?
- Frequently asked questions
What is the PECB Certified AI Security Professional certification?
PECB defines AI security as the practice of protecting AI systems, models, data, algorithms and supporting infrastructure across their life cycle. The CAISP course turns that definition into a five-day program. It also covers the other direction: using AI as a defensive tool for security monitoring, threat hunting and threat intelligence.
The certification scheme follows ISO/IEC 17024, according to the PECB candidate handbook (version 1.5). The course comes with more than 320 pages of material, and completing it earns an attestation worth 31 CPD credits. PECB lists a separate AI Professional course and its ISO/IEC 42001 courses elsewhere in its catalogue. CAISP is the security-specific one, and at the time of writing it is the only course on PECB's Artificial Intelligence Security page.
Why AI security is a different job from traditional cybersecurity
Inputs become the attack surface▼
In a conventional application you validate input and keep it separate from code. In an LLM application the instructions and the data arrive through the same channel. That is why the handbook treats prompt injection, indirect prompt injection and jailbreaking as their own attack class, and why input validation and output filtering appear throughout the domains. Indirect injection is the one that catches teams out: the malicious instruction sits in a document or web page the model retrieves, not in anything the user typed.
Training data can be poisoned▼
Data poisoning, label poisoning and backdoor attacks aim at the same result: changing what the model learns so it misbehaves later in a way that looks like normal operation. A model that quietly scores certain inputs lower than it should raises no alert by itself. Catching that takes data integrity controls and monitoring for drift and performance degradation, which Domain 3 covers.
The supply chain includes models▼
Models, datasets, LoRA adapters and libraries all come from somewhere. The handbook names malicious model files, poisoned LoRA adapters, compromised dependencies and untrusted model repositories as supply chain threats. It lists model provenance, model signing, SBOM and AI Bill of Materials (AIBOM) among the controls. If your team pulls a model from a public repository the way it used to pull a package, this part of the course is for you.
Agents widen the blast radius▼
Plugins, agents and retrieval mechanisms are listed as attack surfaces next to training environments, inference endpoints and APIs. An agent with broad permissions turns a successful injection into an action, not just a bad answer. That is why Domain 5 applies Zero Trust principles to AI data, models, pipelines and inference environments.
Extraction and privacy leakage▼
Model extraction, model inversion and membership inference are the attacks that go after the model and its training data. An attacker who cannot steal your model may still copy its behaviour through large volumes of automated queries, or recover details about the data it learned from.
Why CAISP matters if you already work in AI governance or cybersecurity
AI governance and cybersecurity are usually separate teams with separate vocabularies. CAISP sits where they meet, which is why it suits people who already hold one side. These are the gains I would expect for each role.
If you work in AI governance, risk or compliance▼
A policy says a control must exist. It does not tell you whether the control works on a real model, pipeline or inference endpoint. CAISP Domain 5 covers governance, AI risk across the life cycle, threat modeling with STRIDE, DREAD and MITRE ATLAS, incident readiness and secure architecture, and Domain 3 covers monitoring, logging and judging whether controls are effective. After the course you can ask better questions in a review: where is the model sourced and signed, what does the AI Bill of Materials show, what telemetry would reveal a poisoned dataset, who can the agent act as. That is what makes governance evidence credible to a security team and to an auditor.
If you work in security operations or threat intelligence▼
You already know detection and response. The gap is what normal and abnormal look like for an AI system. Domain 3 covers AI-specific telemetry, drift and performance degradation as signals, indicators of compromise for AI and ML systems, and SIEM and SOAR integration. Domain 4 covers the other direction, using AI for threat intelligence collection, correlation, enrichment and hunting, and, just as important, assessing where AI-generated analysis is unreliable. Both skills matter in a SOC that is about to get AI tools and AI workloads in the same quarter.
If you do offensive security or red teaming▼
Your methodology transfers, but the targets change. PECB lists prompt injection testing and AI red teaming among the labs, and the handbook names conducting or supporting AI red team engagements as qualifying project activity for the full credential. MITRE ATLAS and the OWASP Top 10 for LLM Applications give you a shared language for findings, so a report on an LLM agent lands with the same weight as a report on a web application.
If you hold ISO/IEC 27001 or ISO/IEC 42001 credentials▼
Management system credentials show you can build and audit a system of controls. CAISP shows you can reason about attacks on the model underneath it. I see the combination as strong for implementers and auditors, because you can ask what an AI-specific control should evidence, not only whether a control is documented. It also helps you scope AI risk honestly when an organisation asks what its ISMS or AI management system does and does not cover.
What the full credential asks of someone already in the field▼
The full credential needs five years of experience, two of them in information or cybersecurity, and 300 hours of project activity such as assessing the security posture of AI systems, supporting incident response with SIEM integration and AI-specific telemetry, or supporting AI red team engagements. If you already have the years, the work is to find and log AI-specific hours, and some of your current security work may already fit the activity list. Check each activity against PECB's wording before you count it. The Provisional credential is there while you build that log.
What the five days cover
PECB structures the course as four training days and an exam day.
| Day | Focus |
|---|---|
| Day 1 | AI, ML, and deep learning fundamentals |
| Day 2 | LLM architecture, training workflows, and attack tactics |
| Day 3 | AI security controls and mitigation strategies |
| Day 4 | Detection, response, and secure deployment |
| Day 5 | Certification exam |
The labs are the part I would look at first when comparing courses. PECB lists prompt injection testing, AI red teaming, threat intelligence workflows and malware analysis with AI-assisted reverse engineering tools. I came up through red and blue team work, and I would rather see a candidate break an LLM application once than read about it ten times. The quizzes inside the course follow the structure of the exam, which takes some of the surprise out of exam day.
CAISP connects governance decisions to the technical controls that make them real. Enroll online and get access the same day.
How the CAISP exam works
The exam has 80 multiple-choice questions, each with three options, and the pass mark is 70%. It is open-book: you can use the course materials and your own training notes, either through the PECB Exams app or printed. Questions come as stand-alone items and as scenario sets, where one scenario is followed by five questions. Half the questions test comprehension, application and analysis. The other half test evaluation.
Open-book is less of a gift than it sounds. With scenario sets and half the paper at evaluation level, you cannot look up a judgement call. Notes help with terminology, not with thinking.
| Competency domain | Questions | Share of exam |
|---|---|---|
| 1. Security foundations for AI and ML | 30 | 37.5% |
| 2. AI attack techniques and adversarial threats | 10 | 12.5% |
| 3. AI security controls and defensive operations | 15 | 18.75% |
| 4. AI enhanced security analysis and threat intelligence | 10 | 12.5% |
| 5. AI governance, risk management, and secure architecture | 15 | 18.75% |
| Total | 80 | 100% |
The weighting changes how I would study. Domain 1 alone is 30 of the 80 questions, so the AI and ML fundamentals, the data life cycle, bias, explainability and the difference between traditional and AI-specific threats matter more than the attack techniques people get excited about. Domains 2 and 4 are ten questions each.
For online multiple-choice exams, results are instant. There is no limit on retakes, though PECB sets minimum gaps between attempts. The fee for a course delivered by a PECB Partner includes the first exam attempt, one free retake, the certification application fee and the first year of the annual maintenance fee, as long as you complete the cycle within 12 months (from course completion for instructor-led training, from purchase date for eLearning and self-study).
reconn runs dedicated enterprise batches, live online or in a classroom, taught by a PECB certified trainer who works in the field. Tell us your team size and timeline.
Who benefits most from CAISP
Security operations and threat intelligence analysts▼
Domains 3 and 4 are written for you. They cover logging and telemetry for AI systems, SIEM and SOAR integration, indicators of compromise specific to AI, and using AI to enrich and prioritise threat intelligence. Domain 4 also asks you to judge when AI-generated analysis cannot be trusted, a skill I would want in every SOC.
Engineers who build and deploy models▼
PECB names AI and ML engineers and data scientists in the target audience. The gain for you is a security vocabulary and a threat model for systems you already understand. STRIDE, DREAD and MITRE ATLAS give you a way to talk to your security team without a translator.
Architects, risk and compliance professionals▼
Domain 5 covers AI governance, risk across the life cycle, threat modeling, incident readiness, secure architecture, and the EU AI Act, ISO/IEC 42001 and the NIST AI RMF. If you review AI systems rather than build them, this domain is the core of the course for you.
People starting out in AI security▼
The Provisional credential asks for no experience, but the course prerequisites are more demanding than the credential. PECB expects a working grasp of core security concepts such as threat modeling, access control, incident response and monitoring, plus a basic understanding of model training, data pipelines and API-based services. If you have one half of that and not the other, spend a few weeks on the missing half before you enroll.
Provisional or full credential: what you can claim and when
| Credential | Exam | Professional experience | Project experience |
|---|---|---|---|
| PECB Certified Provisional Artificial Intelligence Security Professional | CAISP exam or equivalent | None | None |
| PECB Certified Artificial Intelligence Security Professional | CAISP exam or equivalent | 5 years (2 in information or cybersecurity) | 300 hours |
The Provisional credential also requires you to sign the PECB Code of Ethics. For the full credential, the 300 project hours must follow best practices and include assessing the security posture of AI and ML systems (including LLM applications, agents and automated pipelines), analyzing adversarial threats, implementing controls such as input validation and output filtering, supporting incident response with SIEM integration and AI-specific telemetry, and conducting or supporting AI red team engagements.
That list works as a self-check. If you cannot point to where you would log red team hours in your current job, you have found what to go and look for. You also need two professional references, people who have worked with you and are not your direct reports or relatives.
Apply within 12 months of finishing the course (or of purchase, for eLearning and self-study). Certifications last three years. Keeping one active means meeting the CPD requirement and paying the annual maintenance fee, and missing both leads to a 12-month suspension period.
How CAISP fits with ISO/IEC 42001, the NIST AI RMF and the EU AI Act
The fifth CAISP domain names all three, and they do different jobs. ISO/IEC 42001 is a management system standard: it describes how an organisation runs AI responsibly, and PECB's Lead Implementer and Lead Auditor courses train people to build and audit that system. The NIST AI Risk Management Framework organises risk work into four functions, Govern, Map, Measure and Manage, and it is voluntary guidance. The EU AI Act is law with its own obligations, and a training credential does not discharge them.
CAISP sits underneath all of that. It trains the person who has to make the controls work on an actual model, pipeline or inference endpoint. In practice I see the two courses as complementary. A governance lead with no security depth writes policies nobody can test, and a security engineer with no governance context fixes the wrong things first.
What CAISP will not do for you
A certificate does not replace practice. The exam is open-book, the labs in a five-day course are short, and the full credential asks for 300 hours of real project work for a reason. The frameworks also move: MITRE ATLAS and the OWASP LLM list change, which is part of why PECB ties renewal to CPD.
Treat the course as the structured start, then build a small lab of your own. Stand up an LLM application with retrieval, attack it, add input validation and output filtering, and look at what your logs actually record. That exercise teaches more than another week of reading.
Should you take it?
If you work in security and AI systems are arriving in your estate, yes. If you build or deploy models, yes, and expect to learn the threat vocabulary your security team already uses. If your work is mainly governance and audit, consider ISO/IEC 42001 first and CAISP second, so you can test the controls you write about.
The title calls it a must for anyone entering AI security. More precisely, it is the most direct structured route PECB offers into the field, and the Provisional credential means you do not need years of experience to begin. The experience requirement for the full credential is what keeps it meaningful.
Further reading
Frequently asked questions
Is CAISP worth it if I already work in AI governance or cybersecurity?▼
Yes, if AI systems are part of what you govern or defend. Governance professionals gain the ability to test whether controls work on a real model or pipeline. Cybersecurity professionals gain AI-specific threat knowledge, telemetry and incident response skills. The course covers both sides, so each group fills the gap the other usually has.
How quickly can I start the CAISP course after enrolling through reconn?▼
Course access is provided the same day you enroll. Enroll through the CAISP page on reconn.io, and contact reconn on WhatsApp if you want to speak to a PECB certified trainer first.
Can my organisation train a team on AI security?▼
Yes. reconn runs dedicated enterprise batches, live online or in a classroom. Send your team size and timeline to hello@reconn.io or message reconn on WhatsApp to request corporate training.
What is the PECB Certified Artificial Intelligence Security Professional certification?▼
It is a PECB certification that validates your ability to identify and manage security risks in AI systems. The course covers AI-specific threats, security controls, detection and response, AI-assisted threat intelligence, and AI governance and secure architecture.
How long is the CAISP course?▼
The course runs five days. Days 1 to 4 are training, covering AI and ML fundamentals, LLM architecture and attack tactics, security controls and mitigation, and detection, response and secure deployment. Day 5 is the certification exam.
How many questions are on the CAISP exam and what is the pass mark?▼
The exam has 80 multiple-choice questions with three options each. The pass mark is 70%. The exam is open-book, and you can use your course materials and personal training notes.
Do I need experience to take the CAISP course?▼
PECB expects a solid foundation in core cybersecurity concepts and a basic understanding of how machine learning systems work. For the Provisional credential, no professional or project experience is required. The full credential needs five years of experience, two of them in information or cybersecurity, and 300 hours of project activity.
Which domains does the CAISP exam cover?▼
The exam covers five domains: security foundations for AI and ML (37.5%), AI attack techniques and adversarial threats (12.5%), AI security controls and defensive operations (18.75%), AI enhanced security analysis and threat intelligence (12.5%), and AI governance, risk management and secure architecture (18.75%).
Which frameworks does the CAISP course use?▼
The handbook names MITRE ATLAS, the OWASP Top 10 for LLM Applications, MITRE ATT&CK, STRIDE and DREAD for threat analysis and modeling. For governance and regulation it names the EU AI Act, ISO/IEC 42001 and the NIST AI Risk Management Framework.
What does the training fee include?▼
For courses delivered by a PECB Partner, the fee includes the first exam attempt, one free retake, the certification application fee and the first year of the annual maintenance fee. The cycle must be completed within 12 months of course completion for instructor-led training, or of purchase for eLearning and self-study.
How long is the certification valid and how is it renewed?▼
PECB certifications are valid for three years. To keep one active you need to complete the required CPD hours and pay the annual maintenance fee. Missing both leads to a 12-month suspension period.
Is CAISP the same as PECB's AI Professional certification?▼
No. PECB lists AI Professional as a separate course in its Artificial Intelligence category. CAISP is the course on PECB's Artificial Intelligence Security page and focuses on attacking, defending and governing AI systems.
Who should take the CAISP course?▼
PECB lists AI and ML engineers, cybersecurity and information security professionals, SOC analysts and threat intelligence professionals, IT security architects and consultants, risk and compliance professionals working with AI governance, data scientists and AI developers, and technology managers responsible for AI security strategy.
