Brian Shand 打造的 CompTIA SecAI+ CY0-001 课程，紧扣4.0版大纲，122节4小时实战教学，覆盖AI威胁建模、提示词注入防御、SOC自动化及EU AI Act合规，含60题全真模拟考。
原始标题：CompTIA SecAI+ (CY0-001) Complete Course
由 Brian Shand 倾力打造的 2026年10月最新 中高级实战备考课，旨在帮助具备 Security+ 基础的网络安全人员攻克全新推出的 CompTIA SecAI+ 考试，并全面掌握保护企业 AI 系统与应用 AI 强化安全运营的核心技能。
该课程紧扣官方最新的 4.0 版大纲，通过长达 4 小时 15 分钟、共 122 节的系统教学，围绕一家虚构的跨国物流公司（Lakeshore Logistics）的 5 个真实 AI 应用（如 RAG 聊天机器人、SOC 助手等）展开贯穿始终的案例教学。学员将深入学习 AI 底层概念、基于 OWASP LLM Top 10 和 MITRE ATLAS 的威胁建模、防御提示词注入/数据投毒/过度授权等攻击的补偿控制手段、AI 自动化安全运营，以及遵循欧盟 AI 法案（EU AI Act）和 NIST AI RMF 的 AI 治理与合规体系。课程配有章节测验、混编场景题分析以及包含 60 道题的完整全真模拟考试，专为解决考试中重在分析日志、检测异常和选择最佳控制措施的“实战场景题”而设计，帮助考生信心百倍地通过认证。
Published 10/2026
Created by Brian Shand
MP4 | Video: h264, 1920×1080 | Audio: AAC, 44.1 KHz, 2 Ch
Level: Intermediate | Genre: eLearning | Language: English + subtitle | Duration: 122 Lectures ( 4h 15m ) | Size: 793.4 MB
Pass CY0-001: secure AI systems, stop AI attacks, use AI in the SOC, and govern AI, plus a full practice exam
What you’ll learn
⚡ Explain AI types, training techniques, prompt engineering, data security, and the AI lifecycle as tested in CY0-001 Domain 1
⚡ Threat model AI systems with the OWASP LLM and ML Top 10 lists, MITRE ATLAS, the MIT AI Risk Repository, STRIDE, PASTA, and LINDDUN
⚡ Apply model, gateway, access, data, and monitoring controls, from prompt firewalls and rate limits to encryption, masking, and log protection
⚡ Analyze evidence of attacks like prompt injection, poisoning, model theft, and excessive agency, and choose the right compensating control
⚡ Use AI-enabled tools and automation in security operations, and recognize AI-enabled attacks such as deepfakes and automated payloads
⚡ Explain AI governance, responsible AI, and compliance, including the EU AI Act, NIST AI RMF, ISO/IEC 42001, OECD principles, and data sovereignty
⚡ Answer CY0-001 scenario and multiple-select questions with confidence, backed by section quizzes and a full-length 60-question practice exam
Requirements
❗ Foundational security knowledge at about the CompTIA Security+ level, such as least privilege, encryption, SIEM, and incident response
❗ No data science or programming background is required. Every AI concept is explained before it’s used.
❗ CompTIA recommends three to four years of IT experience, including about two years of hands-on cybersecurity, but it isn’t required to follow this course
Description
This course contains the use of artificial intelligence.
Pass the CompTIA SecAI+ (CY0-001) exam and learn to secure the AI your organization already depends on.
Organizations adopted AI faster than they secured it. Customer chatbots answer from internal documents, machine learning models score fraud and predict deliveries, AI agents take actions in business systems, and developers ship code written with AI assistants. Each of these creates new attack paths: prompt injection, poisoned training data, stolen models, leaking retrieval systems, and agents with far too much access. At the same time, attackers are using AI for deepfakes, automated reconnaissance, and malware that rewrites itself.
CompTIA SecAI+ (CY0-001) certifies that you can handle both sides: secure AI systems, and use AI to strengthen security, while governing it responsibly. The exam rarely asks for a definition. It describes evidence, such as a log entry, a strange model behavior, or a cost spike, and asks which attack occurred and which control fits best. Several answers usually sound reasonable. To pass, you need to recognize the attack, know the difference between similar terms, and pick the control that actually breaks the attack path.
This course teaches exactly that, domain by domain, through one realistic company you’ll follow from start to finish.
Course at a glance
✨4 hours 16 minutes of video in 122 focused lectures, organized into 7 sections that follow the official exam domains and their weights
✨ Mapped to every objective in the official CY0-001 exam objectives (version 4.0)
✨ Exam-style scenario questions throughout, with the correct answer highlighted after you’ve had a chance to think
✨ A quiz at the end of every section
✨ Afull-length, 60-question practice exam that mirrors the real exam’s timing, with explanations for every option
✨ Closed captions on every lecture
One case study, start to finish: Lakeshore Logistics
Instead of disconnected examples, you’ll follow Lakeshore Logistics, a fictional freight and warehousing company with operations in the United States and the European Union. Lakeshore runs five AI systems: a customer chatbot built on retrieval-augmented generation, a delivery-time prediction model, an invoice fraud model, a SOC copilot, and a coding assistant used by sixty developers. You’ll meet its CISO, its ML engineer, its SOC lead, its privacy and governance lead, and its platform engineer, and watch them threat model these systems, investigate attacks, put AI to work in security operations, and build a governance program that satisfies auditors and EU customers. Every concept on the exam shows up in a decision this team has to make.
What you’ll learnSection 1: Welcome and orientation. The exam format, domains and weights, the Lakeshore case study, how to study, and a strategy for performance-based questions.
Section 2: Domain 1, Basic AI concepts related to cybersecurity (17%). Machine learning, deep learning, transformers, GANs, NLP, and large versus small language models. Supervised, unsupervised, reinforcement, and federated learning, plus fine-tuning, epochs, pruning, quantization, and model validation. Prompt engineering with system and user prompts, roles, templates, and zero-, one-, and multi-shot prompting. Data security for AI: cleansing, verification, lineage, provenance, integrity, augmentation, balancing, data types, watermarking, RAG, embeddings, and vector storage. And security across the AI lifecycle, from the business use case to monitoring, feedback, and human-centric design.
Sections 3 and 4: Domain 2, Securing AI systems (40%). The biggest domain gets two sections. You’ll use the OWASP Top 10 for LLM Applications, the OWASP Machine Learning Security Top 10, MITRE ATLAS, the MIT AI Risk Repository, and the CVE AI Working Group, along with STRIDE, PASTA, attack trees, and LINDDUN. You’ll implement model guardrails, prompt templates, prompt firewalls, rate and token limits, input quotas, modality limits, and endpoint access controls, and test guardrails properly. You’ll design access for models, data, agents, and APIs. You’ll protect data in transit, at rest, and in use, and apply anonymization, classification labels, redaction, masking, and minimization. You’ll monitor prompts, logs, confidence, rates, and cost, and audit for hallucinations, accuracy, bias, and access. Then you’ll analyze evidence of every attack in the objectives, including backdoors, trojans, prompt injection, data and model poisoning, jailbreaking, model inversion, model theft, membership inference, supply chain and transfer learning attacks, model skewing, insecure output handling, insecure plug-ins, excessive agency, and overreliance, and match each one to its compensating controls.
Section 5: Domain 3, AI-assisted security (24%). IDE, browser, and CLI plug-ins, chatbots, personal assistants, and MCP servers, and how to deploy them safely. Use cases from signature matching and anomaly detection to vulnerability analysis, automated penetration testing, fraud detection, translation, and summarization. How attackers use AI for deepfakes, misinformation and disinformation, adversarial networks, reconnaissance, social engineering, obfuscation, and automated attack generation. And how to automate security work with low-code and no-code tools, ticket and change management, AI agents, and CI/CD pipelines with code scanning, software composition analysis, and unit, regression, and model testing.
Section 6: Domain 4, AI governance, risk, and compliance (19%). AI Centers of Excellence, policies and procedures, and the ten AI-related roles. Responsible AI: fairness, reliability and safety, transparency, explainability, privacy, differential privacy, inclusiveness, accountability, consistency, and awareness training. Business risks such as bias, accidental data leakage, reputational loss, IP risks, autonomous systems, and shadow AI. And compliance: the EU AI Act, the OECD AI Principles, ISO/IEC AI standards, the NIST AI Risk Management Framework, corporate AI policies, third-party compliance evaluations, and data sovereignty.
Section 7: Final review. A fast pass through all four domains, the commonly confused term pairs, a worked performance-based question, seven sets of mixed exam-style scenarios, and exam-day strategy.
Why this course
✨Built from the official objectives. Every lecture maps to specific CY0-001 objectives, and the time spent on each domain follows the exam’s weights.
✨Scenario-first. The exam tests judgment, so the course does too. You’ll practice reading evidence and choosing the best control, not memorizing lists.
✨Clear distinctions. Lineage versus provenance, redaction versus masking, prompt injection versus jailbreaking, model inversion versus membership inference, human in the loop versus on the loop: the pairs that cost people points are taught side by side.
✨Realistic and current. Examples reflect how organizations actually deploy AI today, including RAG, agents, MCP, and AI gateways, and how regulations like the EU AI Act affect them.
The practice exam
The included practice exam has 60 questions and a 60-minute time limit, matching the real exam. About a third are multiple-select. Questions are weighted by domain the same way the exam is, use new scenarios and companies rather than repeating the lectures, and explain why each option is right or wrong, so you learn from every answer.
Who this course is for
⭐ Security analysts, engineers, and architects preparing for the CompTIA SecAI+ (CY0-001) exam
⭐ SOC teams who want to use AI tools safely and understand AI-enabled attacks
⭐ Governance, risk, compliance, and privacy professionals responsible for AI policy and regulation
⭐ Security+, CySA+, or PenTest+ holders looking for an AI security certification
此处内容需要权限查看
会员免费查看
