AI in the CISSP Exam 2026: How ISC2 Tests It in Every Domain

First, the facts. On 2 April 2026, ISC2 published its Exam Guidance for Artificial Intelligence, mapping AI content across all nine of its certifications: more than 50 exam domains and around 200 tasks. A 1 September update added detail for the entry-level Certified in Cybersecurity (CC) credential. The CISSP Exam Outline itself hasn't changed since 15 April 2024.

Let me be straight with you. This isn't really an article about artificial intelligence. It's about an exam that now puts models, agents and algorithms in front of you. You could read a machine learning textbook and learn exactly how a neural network works. Wonderful. You'd still struggle with the AI questions, because ISC2 isn't checking whether you can build a model. It's checking whether you can govern, protect and defend one.

I've spent 29 years in cybersecurity, twenty of them in the Indian Air Force, and when this guidance came out I wrote a full field guide on it for my students. This is the part of that book I'd want every candidate to read first.

Short on time? Read the answer above, then the four-question frame and the eight exam traps further down. That's the core method in about ten minutes.

What Changed for AI in the CISSP Exam in 2026?

There is no AI domain, and that tells you how to answer

Almost every candidate I speak to assumes AI arrived as a new chunk of syllabus. It didn't. The ISC2 Exam Guidance for Artificial Intelligence adds no ninth domain, and the CISSP Exam Outline page explains why: AI was deliberately kept out of a silo and spread through all eight domains instead.

So data poisoning shows up as an integrity problem that happens to involve a model, model inversion as a confidentiality problem, and an AI agent as a subject that needs least privilege. We've been here before. Cloud looked like a whole new discipline until the profession realised it was the same security with a different ownership boundary. With AI, you're adding a new kind of asset to things you already know, like risk management, identity and access management (IAM) and incident response.

The questions are written by working security professionals and are vendor-neutral. Concepts such as explainable AI, model drift, Shadow AI and prompt injection are fair game, but product names aren't, so there's no point chasing AI news for the exam.

How much of the exam is AI?

ISC2 doesn't publish a percentage, and because AI sits inside the existing domains, it has no weighting of its own. What you'll notice is the shape of the questions. You'll rarely get "What is model inversion?" You're far more likely to see: "A third-party vendor's model is producing outputs that appear to reveal characteristics of individuals in its training set. What should the security manager do FIRST?"

My answer would be to invoke the incident response process and bring the vendor in under the contract, because personal data may be leaking through a supplier you're still accountable for. Retraining or switching vendors comes later, if at all. It's third-party risk in an AI costume, and once you learn the costumes, very little looks unfamiliar.

How Should You Answer CISSP AI Questions?

When an AI question appears and you feel that half-second of panic, don't go hunting for a definition. Ask one thing instead: what role is the AI playing here? Almost all CISSP AI questions fit one of four roles, which is why I call this the four-question frame. You run four quick checks: is the AI the asset, the attacker, the defender or the decision-maker? Whichever answer is yes points you to a domain whose principles you already know.

The four roles at a glance

An AI system as the asset points to Domain 2, as the attacker to Domain 1 (with Domain 7), as the defender to Domain 7 (with Domains 5 and 6), and as the decision-maker to Domain 1 (with Domain 3).

Two cases don't sit neatly in those boxes. An AI agent acting inside your systems, reading files and calling application programming interfaces (APIs), is examined as an identity, so think Domain 5. A coding assistant is a supplier inside your development pipeline, so think Domain 8.

When AI is the attacker or the defender

When AI is the attacker, the right answer is almost never a brand-new control. Phishing is still phishing. It's just faster, bigger and more believable, so you adjust training, verification and detection. As I tell my students, if someone invents a faster car, you don't build a new kind of road. You lower the speed limit and train the drivers.

Here's a real case. In January 2024 a finance employee at Arup's Hong Kong office joined a video call with what looked and sounded like the company's chief financial officer and several colleagues. All of them were deepfakes. The call was how he'd reassured himself about a suspicious email, and he went on to make 15 transfers totalling HK$200 million, about US$25.6 million. Arup confirmed to CNN that fake voices and images were used and that none of its internal systems were compromised. No firewall failed. The verification procedure did. That's why the exam answer is a callback to a number you already hold, plus dual authorisation for payments. Both hold up however convincing the face on the screen looks.

When AI is the defender inside your security operations centre (SOC), it's a real force multiplier, but it should never have the final say. If a scenario shows it taking a consequential action with no human review, that gap is usually what's being tested.

Working the frame on a real-looking question

A retail bank uses a third-party model to pre-screen small business loans. Audit finds that applicants from one region are declined far more often than policy predicts, the vendor won't share the model's logic, and applicants are complaining to the regulator.

Nobody's stealing the model, there's no adversary, and it isn't detecting anything. But it is deciding things about people, with a regulator involved, so this is a Domain 1 question about ethics, bias and third-party accountability. Don't start by demanding source code or retraining. Start a formal bias assessment through third-party risk management and escalate, because your organisation carries the regulatory obligation whatever the contract says.

Exam note: when two roles apply. Take "our AI-driven SOC tool was compromised and is now suppressing alerts". The tool is an attacked asset and also your defender. Go with the role that carries the bigger business impact. Here that's the defender, because with alerts suppressed, attacks anywhere in the estate can go unseen. Restore visibility through fallback monitoring first, then investigate the tool.

Which AI Attacks Should You Know for the CISSP?

I've lost count of the candidates who read about data poisoning and three weeks later can't tell me whether it attacks confidentiality or integrity. That link is what the question turns on. For each term, learn what it is, a picture that makes it stick, and which part of the CIA triad (confidentiality, integrity or availability) it breaks.

Four attacks against a model

Data poisoning corrupts training data so the model learns what the attacker wants. Picture a new security guard being shown who belongs in the building, while an insider points at a stranger three times and says, "He's fine, he works here." Months later the guard waves that stranger straight through, doing exactly what he was taught. Poisoning attacks integrity before the model is ever deployed.

Evasion, or an adversarial attack, uses a crafted input to fool a model that's already running. In 2020, researchers at McAfee put a two-inch strip of black tape on the "3" of a 35 mph sign. The camera system on 2016 Tesla Model S and Model X cars read it as 85, and the cruise control began accelerating towards that speed. Poisoning corrupts a model while it learns; evasion fools it while it works.

Model inversion reconstructs sensitive training data, often personal data, from what the model outputs. You can't see the chef's recipe, but order the dish two hundred times and you'll work out what's in it. Model extraction builds a working copy of the model by querying it over and over. Inversion steals the recipe. Extraction steals the chef.

The mix-up I see most is inversion versus extraction. Personal data or privacy in the stem points to inversion. Intellectual property, a competitor or a copy of the model points to extraction, and stronger encryption at rest won't stop it.

Failures nobody is doing to you

• Model drift means accuracy falls because the world has moved on, like a forecaster trained in one climate working in another. Continuous monitoring catches it; a one-off scan won't.
• Concept drift is when the pattern itself changes. Fraud today doesn't look like fraud two years ago.
• Hallucination is confident, fluent, made-up output, like the colleague who never says "I don't know".
• Algorithmic bias is what you get when you train a hiring model on twenty years of skewed decisions. Governance and audit fix it, not a technical control alone.

When a question asks what BEST mitigates an AI risk, look for explainable AI (XAI) when decisions can't be explained, differential privacy against inversion, machine unlearning for erasure requests, homomorphic encryption for data being processed, trusted execution environments to protect model weights, or micro-segmentation to contain a compromised endpoint.

How Is AI Tested in Each CISSP Domain?

Keep your CISSP domain summaries open for this part. For each domain you'll get the core idea and the trap examiners like to set. Very little of it is new security. What's new is what the security is applied to.

Domain 1: Security and Risk Management

If you could prepare only one domain for AI, I'd pick Domain 1. It covers the widest spread of AI topics, and they land where leadership judgement matters most.

• One risk framework, not two. Machine learning (ML) models and large language models (LLMs) belong in your existing risk framework, registered as assets with a named owner.
• Third-party AI. ISC2 wants you to assess how open a provider is about its data sources and how resilient its managed models are.
• Shadow AI. Fix it with policy, then culture, then technology, meaning an acceptable use policy, training, an approved alternative and data loss prevention (DLP) as the backstop.
• Automated decisions. Algorithms that decide things about people must meet your legal, regulatory and privacy obligations.

Exam trap: "Block all AI tools at the proxy" sounds decisive, but it pushes the behaviour onto personal devices you can't see.

From my classroom. I say this in almost every batch. Accountability doesn't transfer. You can outsource the model, the infrastructure and the maintenance, but never the accountability. When the regulator comes, they come to your reception desk, not your vendor's.

Domain 2: Asset Security

Here's the question I put to every batch. You've classified your databases and file shares, so where on that inventory does the model sit? I mean the weights that took months to produce, which a competitor could copy through your public API.

ISC2 names three AI assets (training datasets, pre-trained models and model weights) and asks you to treat ML models as high-value intellectual property, classified separately from their data. Poisoning is prevented here with controls you already know, such as dataset provenance, hashing, separation of duties and validation of incoming data. Privacy is harder, because a trained model has absorbed an impression of the personal data it saw.

Exam trap: Deleting the source record doesn't finish an erasure request. The model's retained influence has to be dealt with too, through unlearning, retraining or a documented, risk-accepted limitation.

Domain 3: Security Architecture and Engineering

ISC2 treats explainable AI as an engineering requirement, because you have to be able to verify AI-driven controls. As I put it in class, if you can't verify a control, you're relying on hope.

• Assume the interface gets hit. The inference endpoint, where the model takes input and returns output, is exposed by design, so isolate sensitive workloads in secure enclaves and segment the network.
• Prompt injection is injection. Instructions and data arrive as the same text, and natural language has no equivalent of parameterised queries. The defence is layered, with input sanitisation, least privilege on what the model can invoke, output validation and human review.
• The AI-as-a-Service boundary. The provider owns the model infrastructure, and you own your configuration and data.

Exam trap: An option offers a keyword filter or firewall rule as the fix for prompt injection. It helps, but limiting what the model can do is stronger, because it reduces the damage however the injection gets in.

Domain 4: Communication and Network Security

In the mapping I did for the book, this domain has the fewest AI topics, and I'd rather say so than pad it. Think of a hospital. The public walks into reception freely, and that's your inference endpoint, but nobody reaches the operating theatre from there. Your training cluster is the operating theatre, which is why ISC2 calls for micro-segmentation and Zero Trust.

AI-driven network detection and response (NDR) catches anomalies that signatures miss, but a baseline that keeps learning can be slowly taught that malicious traffic is normal. Training data moving between nodes stays encrypted even when that slows the job, and data crossing borders raises sovereignty questions too.

Exam trap: "Encryption between nodes was disabled because training was slow" is the problem you've found. Don't pick it as the solution.

Domain 5: Identity and Access Management

The question here is who the AI is. The moment an agent can read a file or call an API, it's a subject. ISC2 frames this part of Domain 5 around non-human identities, meaning AI agents and automated service accounts working under least privilege, with no privilege escalation while they learn or run. I think it's the most likely AI concept to turn up in your exam.

Agents go through the same lifecycle as people, from provisioning to access review and deprovisioning, and they also need a named human owner. A service account never complains about too much access and never resigns, so it sits there over-privileged for years unless its review is scheduled.

Exam trap: An agent under prompt injection misuses its access, and an option offers stronger authentication. The agent logged in perfectly well. Its entitlements were the problem, so reduce them.

Domain 6: Security Assessment and Testing

A model may give different outputs for the same input, so you test that its behaviour stays within an acceptable range. ISC2 calls for red teaming models against evasion and extraction, and for auditing what a model produces as well as its code, because a bug-free model can still be exploitable. And since models drift and get retrained, assessment has to be continuous.

Exam trap: The vendor won't explain how its model works, and an option says to declare the audit complete anyway. Document the scope limitation and compensate with output testing, contractual assurances and the provider's certifications.

Domain 7: Security Operations

Here AI can be your best analyst and your newest target in the same shift. My rule is simple. Automate the response, never the accountability.

• SOC automation. AI in security orchestration, automation and response (SOAR) platforms eases alert fatigue, but irreversible actions still need a human decision.
• Drift is a security signal. A fraud model can lose accuracy for months while every dashboard stays green, and drift can look identical to an attack, so investigate unexplained deviation.
• Evidence and change. Chain of custody covers model logs, prompt histories and weights, and weight updates go through change management.

Exam trap: An option offers "retrain the model" as the recovery plan. Retraining can take days or weeks, so it won't meet a four-hour recovery time objective (RTO). Versioned backups with tested rollback are the answer.

Domain 8: Software Development Security

AI gets into your software in three ways.

1. It writes your code. Coding assistants sometimes suggest packages that don't exist, and attackers register those names with malicious code that your build then pulls in.
2. It ships inside your product, bringing prompt injection, inference attacks and model hijacking with it.
3. It arrives through the supply chain as ML libraries and pre-trained models you didn't build and can't inspect.

Treat AI-generated code as untrusted input, with human review, static and dynamic application security testing (SAST and DAST) and dependency checks. Validate model output before your application acts on it, extend your software bill of materials (SBOM) into an AI bill of materials (AI-BOM), and add a gate in your continuous integration and delivery (CI/CD) pipeline that stops the build when bias or hallucination passes an agreed threshold.

Exam trap: An option treats AI-generated code as safe because it came from an approved assistant. Where the code came from doesn't matter. It still gets reviewed and scanned.

Which AI Frameworks and Laws Come Up on the CISSP?

Every time frameworks come up in class, someone asks me, with a slightly worried face, whether they have to memorise the whole thing. They don't. The CISSP is framework-aware rather than framework-deep, so learn what each one is for and the one feature that sets it apart.

• The NIST AI Risk Management Framework, from the US National Institute of Standards and Technology, is voluntary. You use it to structure AI risk management through its four functions, Govern, Map, Measure and Manage.
• ISO/IEC 42001 is certifiable, so a vendor's certificate doubles as independent third-party assurance.
• The EU AI Act has four risk tiers (unacceptable, high, limited and minimal) that attach to how a model is used.
• Article 22 of the EU's General Data Protection Regulation (GDPR) gives people the right not to be subject to solely automated decisions that significantly affect them, and where such decisions are allowed, the right to human intervention and to contest them. That's why human-in-the-loop answers often win.
• The OWASP Top 10 for LLM Applications, from the Open Worldwide Application Security Project, puts prompt injection first. Remember excessive agency, which is least privilege in OWASP's language.
• The ISC2 Code of Ethics resolves conflicts in canon order, so a client's commercial interest never outranks harm to the public.

For a deeper dive on several of these frameworks, see our AI governance guide to NIST AI RMF, ISO 42001 and the EU AI Act.

Try a Real Exam-Style Question

The CISSP uses Computerized Adaptive Testing (CAT): 100 to 150 items in up to three hours, each chosen based on your earlier answers. Treat this one like the real thing and pick your option before you open the reveal.

The fraud queue that went quiet

Domains 1 and 7, difficulty ★★★★★

An organisation uses a third-party AI service that classifies inbound customer messages and routes high-risk items to a fraud review queue. Over one weekend, the number of items reaching the queue drops by 70%. Monitoring shows the service is available and responding normally, and the organisation made no configuration changes. The vendor confirms it deployed a routine model update on Friday evening. Which finding BEST describes the underlying control weakness?

A. The organisation lacks volume-based alerting on the fraud review queue and should implement it without delay.

B. The vendor shipped the update without adequate testing, and the organisation should demand its test evidence.

C. The organisation never secured contractual rights to advance notice and testing of vendor model changes.

D. The organisation cannot roll back the hosted model and should retain a local copy of the previous version.

Eight AI exam traps on one page

Free, before you buy anything. Want this in a form you can print and pin up? A free, printable AI in the CISSP Exam revision sheet — with the four roles, the four attacks and all eight traps — is coming soon. For more practice, our free CISSP resources include domain summaries and practice questions.

Exam Next Week? A Seven-Day AI Catch-Up Plan

If your exam is close, take a breath. Almost all of this builds on what you already know, and 30 to 50 minutes a day is enough.

Don't add to the plan, do the practice on the day it's listed, and write things out rather than highlighting. Anything new the day before the exam tends to push out something you'd already secured.

Think Like a Manager, Not Like a Machine

Look back at what this article asked of you. Classify the asset, give it an owner, apply least privilege, verify the output and keep a human accountable. All of that was in your syllabus before AI came along, which is why AI in the CISSP exam is more manageable than it first looks. I'll be honest, though. The profession hasn't worked AI out yet, and that includes the vendors, the regulators and me. Prompt injection isn't solved. Machine unlearning isn't solved. Anyone telling you otherwise is selling something. ISC2 isn't asking you to solve these problems, only to recognise them and still make a sound decision.

When you meet an AI question you've never seen

You will, probably more than once. It's an adaptive exam, and feeling stretched usually means it's working. When it happens:

1. Don't search your memory for a definition.
2. Ask what role the AI is playing.
3. Ask which principle is really being tested. It'll be one you know.
4. Ask what a senior security manager could defend in front of the board and a regulator.

That last question has settled more difficult items for my students than any piece of technical knowledge. A model can recall every definition in this article in a second. It can't sit in a room where a regulator has written to the board, weigh commercial pressure against a public obligation and take responsibility for the call. That judgement is what the CISSP certifies. It's the reasoning I teach in CISSP Code Breaker, and you'll see it in our CISSP success stories.

If you remember three sentences, make it these: AI is a new asset, not a new discipline. AI is a new subject, not a new access model. AI is a new attack surface, not a new attack theory. And when you've passed, come back and tell us. I mean that.

Want the full field guide? The complete book, AI in the CISSP Exam, has the full 22-term vocabulary, a mind map for every domain and 50 CAT-style questions with every option explained. It comes with the Cybernous CISSP Success Toolkit, alongside a 100-day study plan, 60+ hours of live practice sessions, 5500+ practice questions, 15 full-length mock tests and one-to-one mentorship with me. Cybernous reports a 98.3% first-attempt pass rate, with 2,000+ professionals certified through its CISSP and CISM programmes.

Not sure where AI fits into your preparation? Book a free consultation and we'll map it to your exam date.

About the author

Manoj Sharma founded Cybernous and is a Professor of Practice at REVA University. He has 29 years in cybersecurity, twenty of them in the Indian Air Force leading information warfare work, and serves as a virtual chief information security officer (vCISO) for consumer goods and banking firms. He holds the CISSP (#557313), CISM, CCSP, CRISC and ISO 27001 Lead Auditor credentials, has coached candidates across 170+ training batches, and has signed 425+ ISC2 endorsements, the formal vouching step ISC2 uses when it certifies new members. He wrote CISSP Code Breaker and AI in the CISSP Exam. Read his full profile.

Cybernous is an independent training provider and isn't affiliated with or endorsed by ISC2. CISSP is a registered mark of ISC2, Inc.