ISC2

ISC2 has been pushing a set of short, self-paced AI courses, and in May 2026 I bought six of them for $512. They are certificates of completion, not certifications – no proctored exam, no capstone, just watch the modules and answer the questions. The content is introductory across the board, the kind of survey you could assemble yourself from a weekend of reading. What you are paying for is the ISC2 name on a transcript and a structured reason to actually sit down and think about where AI is taking the field. As a signal that a security professional is paying attention, that is worth something. As technical education, it is thin. I reviewed each course on its own; this is the overview and the buying guide.

AI Security: Managing Overconfidence is one of six short AI courses I bought from ISC2 in May 2026, and it should have been the standout. The topic – automation bias and over-trust in AI output – is the one practitioners actually fall into, and the underlying principle is sound. What dragged it down to three stars was the opening case study: an Activision cybersecurity incident the course implies was caused by AI. The actual incident, in December 2022, was an SMS phishing attack against an HR employee – not an AI failure – which is what I remembered from the public coverage and what the public record still says. The course never explains whether its version is a fictionalized rendering or rests on details not in the public record, and a good portion of the rest of the material builds on that same case.

AI for Cybersecurity is one of six short AI courses I bought from ISC2 in May 2026, and at $96 it is the bundle’s best treatment of the threat model. The first third walks the AI development lifecycle in detail, with analogies to traditional software engineering methodologies – because fundamentally an AI project is still a software engineering project, with the same methodologies applied differently. The second half is the attacks-and-mitigations section, and it is the single most useful piece of content across the entire bundle: many attacks I had not seen before, others I had picked up only in pieces from following the field and now had explained properly, with pointers to live external resources that get updated as new attack surfaces emerge. Like the rest of the bundle, it predates the agentic wave and shows it. Even so, this is the one to take if you want a working threat model for AI systems.

Aligning with Global AI Regulations is one of six short AI courses I bought from ISC2 in May 2026, and at $64 it is the bundle’s wide-angle regulatory survey. Where The Evolving Cybersecurity Workforce touches the legal landscape lightly, this one walks across it: a stack of ISO standards (the 27000 information-security series including 27701 on privacy, 20000 on IT service management, and 42001 on AI management, alongside others in the ISO/AI family), NIST’s Cybersecurity Framework and AI Risk Management Framework, FedRAMP, the ENISA directives for AI cybersecurity, and the EU AI Act. Covering that many documents in a short course means none get treated exhaustively – which is the right trade for a survey, and the course is upfront about it.

Planning for Secure by Design AI is one of six short AI courses I bought from ISC2 in May 2026, and at $64 it is the bundle’s pass through the AI development lifecycle from the security side. It starts with traditional cybersecurity controls applied to AI use, moves through the legal and regulatory environment, spends real time on the data risks and dataset-protection problems that make AI a different shape of security target than a traditional system, and closes briefly on ethics and on AI applied to traditional cybersecurity work. Nothing in it is particularly surprising, and nothing in it is outright wrong.

Foundations of AI is one of six short AI courses I bought from ISC2 in May 2026, and at $128 it is the most expensive of the bundle. It is also the most dated – and that is not the criticism it sounds like. This is a history course. It walks the lineage of AI and its core branches, most of which have been around far longer than the current hype suggests: expert systems, fuzzy logic, computer vision, robotics, machine learning, natural language processing. As a backgrounder on each of those, it is genuinely good. As a survey of where the excitement is right now, it is a step behind.

The Evolving Cybersecurity Workforce is one of six short AI courses I bought from ISC2 in May 2026, and despite the title it is mostly about AI risk and governance, not careers. Running underneath it is a steady note of reassurance that AI is not going to take your security job. The content is non-technical: how to set AI policy, what the risks of AI tools are, how a company should respond, and which privacy regulations bear on AI use. None of it was new to me – I have worked with both AI and privacy regulation in a compliance role – but as a survey of the legal and governance terrain, it holds up.

This eight-week CyberLeadership program from the CyberLeadership Institute guides experienced security professionals to operate at executive level, ending with a practical board‑facing capstone project that simulates the presentation of a 2-year plan by an incoming CISO to the board. Each week focuses on a distinct leadership domain, and includes practical action items and templates to be incorporated into the capstone. The course offers 40 CPE towards renewing my CISSP .

Week 1 – The role of a CISO

Week 1 orients participants to the program and the cyber resilience mindset, and introduces the CISO role through lived experience and practical lessons. Participants explore the many variants of the CISO position, clarify their ideal role, and begin building a personal brand and interview readiness. The week covers essential first‑100‑day priorities, ways to engage the C‑suite, and personal resilience practices.

I recently took and passed the ISC2 CISSP . The certification covered a broad range of topics, most of which I was already familiar with from experience as a software engineer. Those areas I was less familiar with included legal and procedural requirements around risk assessment, physical security, and the theory behind encryption and permissions management.