The AI topics in the draft Security+ SY0-801 objectives

If you are preparing for Security+ and wondering how much AI to study, this page lists exactly what the draft says, with a plain explanation of each term. The current exam is still SY0-701; the comparison of SY0-701 and the SY0-801 draft covers everything else that changes.

Objective 2.6: threats and vulnerabilities of AI usage

The draft title is “Summarize threats and vulnerabilities associated with artificial intelligence (AI) usage.” It lists 13 items. The names are CompTIA’s; the explanations are ours.

• Model manipulation. Changing how a model behaves or what it outputs, for example by tampering with its configuration, weights, or the data it relies on.
• Poisoning. Corrupting training or fine-tuning data so the model learns behavior the attacker wants.
• Prompt injection. Input crafted to override the instructions an application gave the model, either typed directly or hidden in content the model reads, such as a web page or document.
• Data loss. Sensitive data leaving through prompts, model outputs, logs, or data used for training.
• Bias. Outputs that are systematically skewed because of unrepresentative data or design choices.
• Explainability. How hard it is to understand why a model produced an output, which makes auditing and investigating decisions harder.
• Hallucinations. Confident output that is false. The risk grows when people or systems act on output without checking it.
• Jailbreaking. Techniques that get a model to ignore its own safety restrictions.
• Evasion. Input designed so a model misclassifies it, such as malware shaped to slip past a machine-learning detector.
• Privacy. Exposure of personal data that a model was trained on or processes.
• Ethical considerations. Questions of fairness, transparency, and accountability in how AI is used.
• Session hijacking. Taking over an authenticated session with an AI service, for example with a stolen token.
• Code execution. Model output or tool use leading to code running that should not, a real concern when an AI agent can run commands.

Study tip: “Summarize” is a recall-and-describe verb in CompTIA objectives. Be able to define each item, give one realistic example, and name a control that reduces the risk, such as input filtering and output validation for prompt injection, or data provenance checks for poisoning.

Objective 2.4: large language models as an attack surface

Objective 2.4, “Explain types of vulnerabilities and attack surfaces,” lists large language models (LLMs) in the same objective as Shadow IT, Identity providers, Public repositories, Public object storage. The framing matters: an LLM wired into an application is something an attacker can reach, not just a productivity tool.

Study tip: for any system in a scenario, ask what the LLM can see and what it can do. A model that can read internal documents or call tools widens the attack surface far more than a chatbot that only answers from public information.

Objective 4.6: AI in automation and orchestration

Objective 4.6, “Given a scenario, apply automation and orchestration solutions to secure operations,” lists these AI capabilities: Agentic, Chatbot, Predictive analysis, AI-augmented baselines. This is AI on the defender’s side, in the same objective as scripting and other automation.

Study tip: “Given a scenario” objectives tend to ask you to choose the right approach for a situation, so practice deciding when an AI-assisted capability helps and when a simple script or a human review is the safer choice.

Objective 2.5: deepfakes

Objective 2.5, “Given a scenario, analyze indicators of malicious activity,” includes deepfakes among its examples. Expect them in the context of impersonation and social engineering, such as a synthetic voice or video used to push an urgent payment or access request.

What this means for SY0-701 candidates

If you are sitting SY0-701, study to the SY0-701 objectives: that is the exam you will get. CompTIA’s Security+ page lists SY0-701 retirement for the English exam on June 11, 2027, as of September 15, 2026. For how AI training relates to government workforce requirements more broadly, see where AI stands with DoD 8140.

FAQ

Building your Security+ foundation now? The first module of our Security+ course, General Security Concepts, is free.