CY0-001 prerequisites: what you need first
CompTIA SecAI+ CY0-001 has no formal prerequisites, but it is not an entry-level exam. CompTIA recommends 3 to 4 years in IT with 2 or more years of hands-on cybersecurity, and holding Security+, CySA+, PenTest+ or an equivalent. None of this is checked at booking. This page explains what it means before you open the study plan.
What CompTIA says
CompTIA’s SecAI+ page lists no formal prerequisites. Under recommended experience it gives “3-4 years in IT and 2+ years hands-on cybersecurity”, and it recommends a certification such as Security+, CySA+ or PenTest+, or equivalent knowledge. It does not say you need AI or machine learning experience, and I found no official statement about data science or programming background.
The background that helps
Security fundamentals
The exam applies security thinking to new assets. You need to know least privilege, defence in depth, segmentation, encryption, access control and the main attack types. Security+ covers most of this. The CY0-001 vs Security+ comparison shows how the exams relate.
Security operations
AI-assisted security means automation in detection and response, so knowing what logs, alerts, SIEM tools and incident response involve gives context. CySA+ level knowledge helps here.
Governance and risk
Risk assessment, policies, compliance and third-party risk appear in the governance domain. If you have taken part in a risk review or audit, you have an advantage.
Basic AI awareness
You do not need to build models, but you should have used a generative AI tool and understand in general terms that models are trained on data and produce outputs from prompts. The AI concepts guide starts from this level.
IT and cloud basics
Networks, APIs, cloud services and data pipelines are what AI systems run on, and the securing AI systems domain assumes them.
What you do not need
| You do not need | Why |
|---|---|
| Machine learning engineering | Not listed by CompTIA; the exam is about security, not building models |
| A specific certification | Security+, CySA+, PenTest+ or equivalent knowledge is recommended |
| Programming skills | Not mentioned as required |
| A data science degree | Not mentioned officially |
| AI vendor experience | The exam is vendor-neutral |
A short self-check
- What is the principle of least privilege, and how would it apply to a data store?
- What is the difference between a threat and a vulnerability?
- Name two risks of putting sensitive data into a public AI service.
- What is the purpose of a risk assessment?
- What does a SIEM do?
If these are easy, you have the foundation. If several are new, take Security+ first. Is CY0-001 hard? explains why background counts.
Where it leads
Next the exam format and then the study plan. If you are still building the base, start with Security+ SY0-801 or Network+ N10-009.