IICTI Certified AI Security Specialist

Holders demonstrate that they can apply and evaluate aI threat modelling and adversarial ML taxonomy, prompt injection resilience and LLM application architecture, agentic AI and tool-use security and training data integrity and poisoning resilience, plus 8 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for AI Security Specialist.

Who it is for: Professionals working, or preparing to work, in security roles.

1. 01AI threat modelling and adversarial ML taxonomy6% of the exam

   • Analyse AI systems end to end and produce threat models that prioritise realistic attack paths and controls.
   • Scope: MITRE ATLAS, OWASP Top 10 for LLM Applications 2025, NIST AI 100-2 E2025 adversarial ML taxonomy, STRIDE adapted to ML pipelines, attack surface analysis across data, model, application and infrastructure layers.
2. 02Prompt injection resilience and LLM application architecture7% of the exam

   • Architect LLM applications that contain the impact of prompt injection through isolation and least privilege rather than filtering alone.
   • Scope: Direct and indirect prompt injection, system prompt leakage, insecure output handling, privilege separation and dual-LLM / CaMeL-style designs, trust boundaries for untrusted content, defence-in-depth evaluation.
3. 03Agentic AI and tool-use security8% of the exam

   • Design guardrails and authorisation models for autonomous agents that keep high-impact actions controlled and auditable.
   • Scope: Excessive agency and least-agency design, MCP and tool permission scoping, confused-deputy risks, sandboxed execution, human approval gates, OWASP Agentic AI threats and mitigations, agent identity and audit trails.
4. 04Training data integrity and poisoning resilience9% of the exam

   • Evaluate data pipelines for poisoning exposure and design provenance and validation controls proportionate to risk.
   • Scope: Data provenance and lineage, backdoor and poisoning threat models, fine-tuning and RAG corpus poisoning, dataset documentation, ingestion validation and anomaly detection, data integrity controls.
5. 05AI model supply chain security6% of the exam

   • Lead supply chain assurance for models and datasets from acquisition through deployment.
   • Scope: Serialisation risks (pickle) versus safetensors, OpenSSF model signing and Sigstore, AI-BOMs with CycloneDX ML-BOM and SPDX 3.0 AI profile, vetting third-party models, datasets and inference providers.
6. 06Privacy attacks and privacy-preserving machine learning10% of the exam

   • Evaluate privacy leakage risk in ML systems and select privacy-preserving techniques with justified utility trade-offs.
   • Scope: Membership inference, model inversion and training data extraction, memorisation measurement, differential privacy, federated learning, machine unlearning, GDPR and data protection impact assessment implications.
7. 07Adversarial robustness, evasion and model extraction defence6% of the exam

   • Assess model robustness and design defences against evasion and extraction appropriate to the deployment context.
   • Scope: Evasion attack classes, adversarial training and certified robustness, model extraction and stealing risks, query rate limiting and monitoring, output watermarking and fingerprinting.
8. 08RAG and vector store security5% of the exam

   • Architect retrieval-augmented systems that enforce source permissions and prevent cross-tenant or sensitive data leakage.
   • Scope: Access control propagation to retrieved content, multi-tenant index isolation, embedding inversion risk, retrieval filtering, sensitive data leakage through context windows, secure document ingestion.
9. 09AI red teaming and security evaluation programmes6% of the exam

   • Lead AI red teaming and evaluation programmes that produce reproducible, decision-ready findings.
   • Scope: Programme scoping and rules of engagement, threat-informed test planning, tooling such as PyRIT, garak and promptfoo, benchmark limitations, severity rating, reporting and regression evaluation in CI.
10. 10Runtime guardrails, monitoring and AI incident response8% of the exam

    • Design runtime monitoring and response capabilities that detect and contain AI misuse and failures in production.
    • Scope: Input and output classifiers, policy enforcement layers, OpenTelemetry GenAI semantic conventions, abuse and anomaly detection, model and prompt versioning, AI-specific incident playbooks and rollback.
11. 11Secure MLOps and AI infrastructure hardening11% of the exam

    • Architect ML platforms and pipelines with strong isolation, integrity and access control across the model lifecycle.
    • Scope: Model serving and inference endpoint hardening, GPU cluster and tenant isolation, secrets and credential management in pipelines, Kubeflow and KServe security, confidential computing for AI workloads.
12. 12AI governance, risk management and regulatory compliance18% of the exam

    • Lead AI security governance that maps technical controls to regulatory and management system requirements.
    • Scope: EU AI Act obligations for GPAI and high-risk systems, ISO/IEC 42001 AI management systems, ISO/IEC 23894, NIST AI RMF and Generative AI Profile (AI 600-1), conformity assessment and documentation.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner