Reviews

ISC2 has been pushing a set of short, self-paced AI courses, and in May 2026 I bought six of them for $512. They are certificates of completion, not certifications – no proctored exam, no capstone, just watch the modules and answer the questions. The content is introductory across the board, the kind of survey you could assemble yourself from a weekend of reading. What you are paying for is the ISC2 name on a transcript and a structured reason to actually sit down and think about where AI is taking the field. As a signal that a security professional is paying attention, that is worth something. As technical education, it is thin. I reviewed each course on its own; this is the overview and the buying guide.

AI Security: Managing Overconfidence is one of six short AI courses I bought from ISC2 in May 2026, and it should have been the standout. The topic – automation bias and over-trust in AI output – is the one practitioners actually fall into, and the underlying principle is sound. What dragged it down to three stars was the opening case study: an Activision cybersecurity incident the course implies was caused by AI. The actual incident, in December 2022, was an SMS phishing attack against an HR employee – not an AI failure – which is what I remembered from the public coverage and what the public record still says. The course never explains whether its version is a fictionalized rendering or rests on details not in the public record, and a good portion of the rest of the material builds on that same case.

AI for Cybersecurity is one of six short AI courses I bought from ISC2 in May 2026, and at $96 it is the bundle’s best treatment of the threat model. The first third walks the AI development lifecycle in detail, with analogies to traditional software engineering methodologies – because fundamentally an AI project is still a software engineering project, with the same methodologies applied differently. The second half is the attacks-and-mitigations section, and it is the single most useful piece of content across the entire bundle: many attacks I had not seen before, others I had picked up only in pieces from following the field and now had explained properly, with pointers to live external resources that get updated as new attack surfaces emerge. Like the rest of the bundle, it predates the agentic wave and shows it. Even so, this is the one to take if you want a working threat model for AI systems.

Aligning with Global AI Regulations is one of six short AI courses I bought from ISC2 in May 2026, and at $64 it is the bundle’s wide-angle regulatory survey. Where The Evolving Cybersecurity Workforce touches the legal landscape lightly, this one walks across it: a stack of ISO standards (the 27000 information-security series including 27701 on privacy, 20000 on IT service management, and 42001 on AI management, alongside others in the ISO/AI family), NIST’s Cybersecurity Framework and AI Risk Management Framework, FedRAMP, the ENISA directives for AI cybersecurity, and the EU AI Act. Covering that many documents in a short course means none get treated exhaustively – which is the right trade for a survey, and the course is upfront about it.

Planning for Secure by Design AI is one of six short AI courses I bought from ISC2 in May 2026, and at $64 it is the bundle’s pass through the AI development lifecycle from the security side. It starts with traditional cybersecurity controls applied to AI use, moves through the legal and regulatory environment, spends real time on the data risks and dataset-protection problems that make AI a different shape of security target than a traditional system, and closes briefly on ethics and on AI applied to traditional cybersecurity work. Nothing in it is particularly surprising, and nothing in it is outright wrong.

Foundations of AI is one of six short AI courses I bought from ISC2 in May 2026, and at $128 it is the most expensive of the bundle. It is also the most dated – and that is not the criticism it sounds like. This is a history course. It walks the lineage of AI and its core branches, most of which have been around far longer than the current hype suggests: expert systems, fuzzy logic, computer vision, robotics, machine learning, natural language processing. As a backgrounder on each of those, it is genuinely good. As a survey of where the excitement is right now, it is a step behind.

The Evolving Cybersecurity Workforce is one of six short AI courses I bought from ISC2 in May 2026, and despite the title it is mostly about AI risk and governance, not careers. Running underneath it is a steady note of reassurance that AI is not going to take your security job. The content is non-technical: how to set AI policy, what the risks of AI tools are, how a company should respond, and which privacy regulations bear on AI use. None of it was new to me – I have worked with both AI and privacy regulation in a compliance role – but as a survey of the legal and governance terrain, it holds up.