IICTI Certified Application Security Engineer

Holders demonstrate that they can apply and evaluate threat modelling and secure design review, secure software development lifecycle and programme governance, authentication, session and authorisation architecture and vulnerability classes, root-cause analysis and secure coding patterns, plus 7 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Application Security Engineer.

Who it is for: Professionals working, or preparing to work, in security roles.

1. 01Threat modelling and secure design review11% of the exam

   • Lead threat modelling and design reviews that identify architectural weaknesses before implementation.
   • Scope: STRIDE, PASTA, LINDDUN and attack trees, data-flow diagrams, trust boundaries, abuse cases, threat modelling as code (pytm, Threat Dragon) and OWASP secure design principles.
2. 02Secure software development lifecycle and programme governance11% of the exam

   • Design and evaluate an application security programme aligned to maturity models and measurable outcomes.
   • Scope: OWASP SAMM, BSIMM, NIST SSDF (SP 800-218), security champions, security requirements from OWASP ASVS 5.0, risk-based gating, security debt management and AppSec metrics.
3. 03Authentication, session and authorisation architecture13% of the exam

   • Architect authentication and authorisation flows that resist token misuse and access-control failures.
   • Scope: OAuth 2.1, OpenID Connect, PKCE, token binding and DPoP, JWT pitfalls, FIDO2/passkeys, session management, RBAC/ABAC/ReBAC (OPA, Cedar, Zanzibar-style), broken access control patterns.
4. 04Vulnerability classes, root-cause analysis and secure coding patterns17% of the exam

   • Diagnose the root causes of vulnerability classes and design systemic, framework-level fixes.
   • Scope: OWASP Top 10 and CWE Top 25 root causes: injection, deserialization, SSRF, XXE, race conditions, memory safety, business-logic flaws; framework-level mitigations, safe-by-default libraries and secure code review heuristics.
5. 05API and microservice security5% of the exam

   • Evaluate and design security controls for API-centric and microservice architectures.
   • Scope: OWASP API Security Top 10 (2023), BOLA/BFLA, schema validation (OpenAPI, GraphQL depth/complexity limits), gRPC security, mTLS and service mesh identity, rate limiting, API gateways and inventory of shadow APIs.
6. 06Security testing strategy: SAST, DAST, IAST and fuzzing9% of the exam

   • Design a layered security testing strategy that maximises signal and fits developer workflows.
   • Scope: Tool selection and tuning (Semgrep, CodeQL, ZAP, Burp Suite), custom rules, coverage-guided fuzzing, triage and false-positive management, pipeline integration and test-orchestration at scale.
7. 07Software supply chain and dependency security9% of the exam

   • Evaluate third-party component risk and design supply-chain controls from dependency intake to release.
   • Scope: SCA and reachability analysis, SBOMs (CycloneDX, SPDX), VEX, SLSA provenance, Sigstore signing, dependency confusion and typosquatting risks, OpenSSF Scorecard and EU Cyber Resilience Act obligations.
8. 08Cryptography engineering and secrets management11% of the exam

   • Evaluate cryptographic implementations and design key and secret management that avoids common misuse.
   • Scope: Correct use of AEAD, key derivation and password hashing (Argon2id), TLS configuration, key and secret lifecycle (Vault, KMS), crypto agility and post-quantum migration (ML-KEM, ML-DSA).
9. 09Security of AI and LLM-integrated applications4% of the exam

   • Assess and design controls for applications that embed LLMs and autonomous agents.
   • Scope: OWASP Top 10 for LLM Applications, prompt injection and indirect injection, insecure output handling, excessive agency, data leakage, model and plugin supply chain, guardrails and AI red-team evaluation.
10. 10Vulnerability management, disclosure and incident response5% of the exam

    • Lead risk-based vulnerability remediation and coordinated disclosure processes across product teams.
    • Scope: CVSS 4.0 and EPSS-based prioritisation, KEV, remediation SLAs, coordinated vulnerability disclosure and bug bounty governance (ISO/IEC 29147/30111), security incident handling for applications and post-incident learning.
11. 11Penetration test governance, scoping and findings reporting5% of the exam

    • Evaluate application security assessment results and translate them into prioritised, actionable remediation.
    • Scope: Engagement scoping and rules of engagement, OWASP WSTG and ASVS-based verification, third-party test management, evidence quality, risk rating and executive and developer-facing reporting.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner