AI security is not a specialisation people drift into by accident. Two years ago it was a developing interest for a handful of researchers and red teamers. Today it is a hiring category with its own job titles, frameworks and interview questions. The AI Workforce Consortium found that between October 2025 and March 2026, the share of G7 cybersecurity postings requiring AI skills increased to 28.5 percent, up from 14.2 percent a year earlier. This change is a market reorganising itself in real time.
The most challenging question experienced professionals are asking is not whether to move into this space, but where to start without wasting a year on the wrong material.
What AI Security Actually Covers
The term is applied broadly, and separating its two components clarifies where a career can be built.
The first component is the usage of AI within security operations: assisted triage, detection engineering, log analysis, and reporting. This is skill acquisition. The threat model has not changed, only the throughput has.
The second is securing the AI systems an organisation has deployed, including LLM applications, retrieval pipelines, agents with tool access, and models informing production decisions. This is a different discipline, and it is where most hiring demand sits.
Most career confusion comes from treating these things as one. They require their distinct training.
The Entry Point Depends on Where You Are
There is no single starting line. If you come from security operations, your advantage is incident handling and detection logic. Your gap is understanding how a model actually works. If you come from AppSec or DevSecOps, your advantage is pipeline and code security. Your gap is adversarial machine learning. If you come from GRC, your advantage is framework literacy. Your gap is the technical vocabulary you need to ask useful questions.
Identify that gap before choosing training. Most people pick the course matching what they already know, which feels productive and teaches very little.
The Skills That Matter First
Four areas carry the most weight with hiring managers right now.
AI literacy. How models are trained, fine-tuned, retrieved from and deployed. Not model building. Without this, everything else stays theoretical.
AI-specific threats. Prompt injection, jailbreaking, data poisoning, model extraction and inversion, membership inference, and memory or tool poisoning in agentic systems. Prompt injection holds the top position on the OWASP Top 10 for LLM Applications, 2025 edition, and MITRE ATLAS is the standard reference for adversarial techniques against AI systems.
Secure AI engineering. Guardrails, AI gateways, hardened retrieval design, model integrity verification, supply chain checks on weights and datasets, and incident response built for AI failure modes.
AI governance. NIST’s AI Risk Management Framework, ISO/IEC 42001, EU AI Act risk tiers, impact assessments and model inventories.
Certifications Worth the Time
The credential landscape matured quickly, and each option serves a different direction.
CompTIA SecAI+ (exam CY0-001) is the vendor-neutral technical validation for professionals who already hold cybersecurity experience. ISACA’s AAISM sits on the management side and requires an active CISM or CISSP, making it a progression credential rather than an entry point. ISACA AAIA covers AI auditing and requires an existing audit credential such as CISA. IAPP AIGP suits privacy and regulatory work, covering the EU AI Act and its intersection with existing data protection law. ISO/IEC 42001 Lead Implementer and Lead Auditor split between building an AI management system and auditing one.
Choose based on the role you want, not the most recognisable acronym.
The Roadmap
Build AI fluency first. Then learn the attack surface: what breaks, and how. Then learn the controls: what stops it, and where they sit in an architecture. Then add the framework layer if your role touches governance or audit. Certification comes last as a validation of work that is already done, not as a substitute for it.
Skipping the initial stage is the common mistake. Advanced material assumes you already understand transformers, embeddings and retrieval, and does not stop to explain them.
Where Structured Training Fits
Self-study works but knowledge about AI security is scattered across research papers, vendor documentation and framework specifications that assume one has a prior vocabulary. This fragmentation is what makes the timeline unpredictable and difficult.
The Cybersecurity AI Foundation Program is built for the first stage. It runs 40 hours across three parts: AI fundamentals including machine learning, Python for AI frameworks, generative AI, RAG and agentic AI; then attacking, securing and governing AI systems, with poisoning, prompt injection, guardrails and mapping to NIST AI RMF and ISO 42001; then applying AI to offensive and defensive security work. It expects fundamental security knowledge only, with no coding or AI background required, and splits time evenly between theory and labs.
From there, the wider Artificial Intelligence and GenAI programmes cover the specialised tracks: AI security engineering, AI penetration testing, governance certifications and management-level credentials.
Summary
AI security is a field you enter by understanding and implementing instead of reading about. It rewards people who can describe how a system fails, reproduce that failure, and design the control that prevents it. The advantage available right now is timing. The demand is established, the frameworks are published, and the talent pool is still thin. That gap will close. Building the capability while it is still open is considerably easier than competing for it later.
