CY0-001 AI-assisted security explained
AI-assisted security is worth 24% of CY0-001 — around fourteen questions. This is the mirror image of the securing domain: here the model is the tool you defend with, not the asset you defend. The domain also covers the other side of that coin, which is attackers using the same technology against you.
Keep the direction straight. A question about protecting a model belongs to securing AI systems; a question about a model protecting something else belongs here.
Where AI genuinely helps defenders
The exam expects a realistic view, not enthusiasm. AI earns its place where volume and pattern-matching beat human attention:
- Detection at scale. Spotting anomalies across volumes of telemetry no analyst could read.
- Alert triage. Ranking, grouping and de-duplicating so humans see fewer, better alerts.
- Correlation. Linking events across sources that look unrelated in isolation.
- Summarisation. Turning a sprawling incident into something a responder can absorb quickly.
- Assisting the analyst. Drafting queries, explaining artefacts, suggesting next steps.
Notice the common thread: every one of these narrows work for a human. That is the shape of a correct answer in this domain.
Where it does not help
- Anywhere a false negative is unacceptable without review.
- Anywhere the output must be certain rather than probable.
- Any decision with legal or safety consequences taken without a person.
- Anywhere you cannot explain the reasoning afterwards.
AI-driven threats
The attacker gets the same tools, and the exam names the consequences:
Automated and personalised phishing. Generative models remove the traditional tells — bad grammar, generic wording — and make targeted messages cheap at scale. The defensive implication matters: “look for spelling mistakes” is no longer viable user training.
Polymorphic and adaptive malware. Code that varies its own form to defeat signature matching, pushing detection toward behaviour rather than signatures.
Adversarial machine learning. Attacks aimed at defensive models themselves — evasion inputs designed to slip past an AI-based detector, and poisoning aimed at a model that learns from live traffic.
Deepfakes and impersonation. Synthetic voice and video against processes that rely on recognising a person, which is why callback verification and out-of-band confirmation keep appearing as correct answers.
Lowered barriers. Less skilled attackers can now do more, which increases volume even where sophistication is unchanged.
The recurring failure: over-trust
The most testable risk in this domain is not technical. It is an organisation that lets an AI system make decisions without oversight, then discovers months later that something was wrongly dismissed. When a scenario describes automation acting alone on consequential decisions, the weakness being tested is almost always the missing human.
Related failures worth knowing: alert fatigue that gets relocated rather than solved, analysts who lose the skill to work without the tool, and adversaries who tune their behaviour once they know what your AI looks for.
CI/CD and automated deployment
Objective 3.3, using AI to automate security tasks, lists CI/CD with six items: code scanning, software composition analysis, unit testing, regression testing, model testing and automated deployment/rollback. Next to it sits change management with AI-assisted approvals. The exam treats the pipeline as the place where security checks run on every change without anyone remembering to run them. The CI/CD guide explains stages, approvals and gates; here is what each item means in SecAI+ terms.
| Pipeline item | What it checks | Where AI helps |
|---|---|---|
| Code scanning | Your own source code for insecure patterns | Explaining findings, suggesting fixes, filtering noise |
| Software composition analysis (SCA) | Third-party and open-source components and their known vulnerabilities | Prioritising which vulnerable dependency actually matters |
| Unit testing | Individual functions behave as intended | Generating test cases |
| Regression testing | A change has not broken what worked before | Selecting which tests a change affects |
| Model testing | A model or its guardrails still meet accuracy, safety and bias criteria | Running evaluation sets automatically |
| Automated deployment/rollback | Releases ship, and revert when checks or monitoring fail | Spotting anomalies after release that trigger a rollback |
Two items deserve attention. Model testing is the AI-specific one: when the pipeline ships a model, a new prompt template or a guardrail change, it should re-run the evaluations and guardrail tests from the securing domain, because a model can regress on safety while every unit test still passes. SCA covers what you did not write. Downloaded models, libraries and plug-ins are part of the AI supply chain, and SCA is the pipeline control that inventories them.
Automated rollback is the counterpart to automated deployment. Speed is only safe when a failed release can be reversed quickly, so a scenario that adds automatic deployment without a rollback path is describing a weakness.
Exam pitfall: do not swap code scanning and SCA. A finding in a vulnerable open-source package you import is an SCA result; a SQL injection in code your team wrote is a code scanning result. The second trap is the same over-trust theme as above: AI-assisted approvals can speed up routine changes, but a scenario where the AI approves and deploys a high-risk change with no human sign-off is pointing at the missing person.
Sample questions
Question 1. A finance team receives a voice call that sounds exactly like the CFO authorising an urgent payment. Which control most directly addresses this threat?
- A. Stronger email filtering
- B. Endpoint detection and response on finance workstations
- C. Out-of-band callback verification through a separately known channel
- D. Training staff to listen for unnatural-sounding speech
Show answer
Answer: C
Synthetic voice defeats recognition, so the control must not rely on recognising the person: out-of-band verification through a known channel does exactly that. Stronger email filtering does not apply to a phone call, endpoint protection does not either, and training staff to listen for unnatural speech fails as the technology improves.
Want more questions like this? Full CY0-001 practice tests →
Question 2. Which task is the most appropriate use of AI within a security operations centre?
- A. Automatically closing alerts it judges benign, with no review
- B. Summarising and correlating telemetry to prioritise analyst attention
- C. Automatically blocking any user account it finds unusual
- D. Deciding independently whether a breach is legally reportable
Show answer
Answer: B
Summarising and correlating large volumes of telemetry so analysts see fewer, better-ordered alerts plays to what the technology does well and keeps a person in the decision. Automatically closing alerts, auto-blocking production accounts and deciding legal reportability all remove human judgement from consequential decisions.
Want more questions like this? Full CY0-001 practice tests →
Question 3. Your organisation deploys an AI-based detection model that retrains continuously on live network traffic. What additional risk does the continuous retraining introduce?
- A. Higher licensing cost
- B. Increased storage consumption
- C. Slower inference at peak times
- D. An attacker can gradually poison the model by shaping the traffic it learns from
Show answer
Answer: D
A model that learns from live traffic can be taught by an attacker who shapes that traffic, which is poisoning of the defensive model itself. Higher licensing cost and more storage are operational concerns rather than security risks, and slower inference is a performance matter.
Want more questions like this? Full CY0-001 practice tests →
Question 4. A team adds an open-source tokenizer library to the CI/CD pipeline of its chatbot. A week later a critical vulnerability is published for the version they use. Which pipeline control is designed to flag this on the next build?
- A. Software composition analysis
- B. Code scanning of the team’s source code
- C. Regression testing
- D. Model testing
Show answer
Answer: A
Software composition analysis inventories third-party and open-source components and matches them against known vulnerabilities. Code scanning analyses the team’s own source code, regression testing checks that existing behaviour still works, and model testing evaluates the model’s accuracy and safety rather than its dependencies.
Want more questions like this? Full CY0-001 practice tests →
What to practise
For each of the five AI-driven threats above, write down the defensive control that does not depend on a human spotting something. Those controls — verification through a second channel, behaviour-based detection, human review of consequential decisions — are the answers this domain keeps asking for.