CY0-001 basic AI concepts related to cybersecurity explained

Basic AI concepts related to cybersecurity is worth 17% of CY0-001 — around ten questions. It is the smallest domain and the one most people skim, which is a mistake, because everything in the other three domains is expressed in this vocabulary. Get it wrong here and you will misread questions elsewhere.

The lifecycle, and where attacks land

Learn the stages, then learn which threat belongs to which stage. That single mapping answers a surprising share of the exam.

If a question describes an attack, your first move is to identify the stage. An attack on the training set is not the same problem as an attack on the running endpoint, and the controls differ completely.

Why AI is not just more software

Four properties make AI systems behave unlike the applications you are used to securing:

Non-determinism. The same input can produce different output. Testing cannot enumerate behaviour, so you cannot prove correctness the way you would for a function.

Natural language is the attack surface. In a traditional application, input is data. In an instruction-following system, input can be instructions. That collapse of the data/instruction boundary is the single most important idea in the whole exam.

Behaviour comes from data, not code. You cannot read the source to find out why the model does something. Change the training data and you change the behaviour without touching a line of code.

Outputs can leak. A model can reproduce fragments of its training data or its own system instructions. The output channel is a disclosure risk, not just a delivery mechanism.

The failure modes to know by name

• Hallucination — confident output that is simply untrue. A reliability problem that becomes a security problem when something downstream trusts it.
• Prompt injection — untrusted input that the model treats as instruction. Indirect injection hides the instruction in content the model retrieves, such as a web page or a document.
• Data poisoning — corrupting training data so the resulting model misbehaves.
• Model extraction — reconstructing an approximation of a model through repeated queries.
• Model inversion — inferring properties of training data from model behaviour.
• Evasion — crafting input that a model misclassifies, the classic adversarial example.

RAG as a data security problem

Objective 1.2, on why data security matters for AI, names retrieval-augmented generation (RAG) together with vector storage and embeddings. SecAI+ does not ask you to build a RAG pipeline. It asks you to see what RAG does to your data, so read every RAG question as a data-handling question.

The pattern in one line: before the model answers, the application searches an index built from your own documents, then places the best-matching passages in the prompt so the answer is grounded in that material. The full RAG walkthrough covers chunking, retrieval and grounding in detail. For this exam, three consequences matter.

The index is a second copy of your data. Every document you ingest is copied, split into chunks and stored next to its vectors. Contracts, HR files and incident reports now live in a store that may not have the classification labels, retention rules or access controls of the original system. That is why the data processing terms from the same objective apply directly: data provenance (where did this document come from), data lineage (which source file produced this chunk), data verification and data integrity (has anyone changed it since).

Retrieval must respect permissions. If the assistant retrieves from the whole index regardless of who is asking, a user can read through the model what they could never open directly. Carry the source system’s access group into the chunk metadata and filter on it at query time.

Retrieved content is untrusted input. Anyone who can place a document in the index can place instructions in the prompt. That is indirect prompt injection (sample question 2 below), and it is why ingestion deserves the same scrutiny as training data. A planted or altered document skews answers without anyone touching the model.

Exam pitfall: when a scenario says an assistant shows staff information from documents they are not authorised to see, the tempting answers are fine-tuning the model or tightening the system prompt. Neither fixes it. The model only saw what retrieval gave it, so the fix belongs in access control on the retrieval step and on the vector store itself.

Embeddings and vector storage

An embedding is a list of numbers that an embedding model produces from a piece of text, arranged so that passages with similar meaning sit close together. A vector store holds those vectors with the original text and its metadata, and answers “which stored chunks are nearest to this question?” The embeddings and vector search guide explains similarity measures and search indexes. CY0-001 only needs the security view.

• Vectors are not anonymisation. An embedding is derived from the text it represents and normally sits next to that text in the store. Treat the vector store as holding the same sensitivity as its source documents: encrypt it at rest and in transit, label it, and restrict who can query or write to it.
• The store is an attack surface of its own. The OWASP Top 10 for LLM Applications (2025) has a dedicated entry for vector and embedding weaknesses, covering unauthorised access, cross-tenant leakage when several users or customers share one store, poisoned entries, and attacks that try to recover source text from embeddings.
• Write access is as sensitive as read access. Whoever can insert vectors decides what the model is told. Limit ingestion to known pipelines and log every change to the store, so a poisoned entry can be traced back to its source.
• Data minimisation applies. Index only the documents the assistant actually needs; every extra folder ingested widens what a retrieval mistake can expose.

Look for the exam’s vocabulary here: a shared vector database serving several customers is a data segregation question, and an unexplained change to stored entries is a data integrity question.

Securing AI versus AI-assisted security

Two of the four domains are mirror images, and the exam relies on you not confusing them:

• Securing AI systems — the model is the asset you protect.
• AI-assisted security — the model is the tool you defend with.

When you read a question, decide which side it sits on before looking at the options. Half the wrong answers in this exam are correct statements from the other side.

Sample questions

What to practise

Draw the lifecycle table from memory and place each named threat on the right stage. Then write one sentence for each failure mode in your own words. That sheet is the foundation for the other 83% of the exam, and it takes an evening.