Why Your Next Certification Should Sit on Top of the One You Already Have
October 1, 2026
Jillian, CMO— AI-assisted and reviewed prior to publication.
The safest career move in security right now isn't collecting a new acronym. It's proving you can operate the AI tools already inside your stack while defending them, and doing it in a way an employer can verify. That verification increasingly comes from a certification built to sit on top of the one you already hold, not replace it.
Why is "AI skills" no longer enough on a resume?
Because everyone claims them and almost nobody can prove them. Hiring managers have learned to discount a bare bullet point that says "AI-proficient" the same way they long ago discounted "detail-oriented." What changes their read is a credential that names a specific, testable capability and ties it to a certification they already trust.
That's the design logic behind CompTIA's newest credential. CompTIA SecAI+, covered in detail by Network World's launch report, launched as a certification focused on securing AI systems and applying AI tools inside cybersecurity work, and it was built as the first entry in what CompTIA calls its Expansion Series, meaning it builds on foundational credentials like Security+, CySA+, and PenTest+ rather than standing alone. CompTIA's own announcement frames it as validating AI risk, governance, and defensive knowledge without tying those skills to any single vendor platform. The message to employers is direct: this person already has the baseline job-role skills, and now they've added a verified layer of AI-specific judgment on top of it.
ISACA took the same approach from the management side. Its Advanced in AI Security Management (AAISM) credential is not open to everyone. Candidates must already hold an active CISM or CISSP to sit for it, which turns AAISM into a forced second rung on a ladder rather than a standalone badge. If you want to manage AI risk at the enterprise level, the credentialing body has decided you prove your security management fundamentals first, then layer AI governance on top of that foundation.
What are employers actually rewarding, AI skills or AI judgment?
Judgment, specifically the ability to decide when an AI recommendation is trustworthy and when it isn't. Raw tool familiarity is becoming table stakes, not a differentiator, because the tools themselves are spreading faster than anyone's ability to govern them well.
Gartner's October 2025 survey found that 54 percent of infrastructure and operations leaders are already adopting AI to cut costs, with integration difficulty and budget cited as the top barriers to doing it well. That gap between adoption speed and integration maturity is exactly where a credentialed professional earns visibility. Anyone can turn on an AI feature. Fewer people can explain why its output should or shouldn't be trusted for a given decision, or document that reasoning well enough to survive an audit.
Security operations centers show the stakes clearly. Alert volume has outpaced analyst capacity for years, and Elastic's research on SOC burnout found that 71 percent of SOC personnel report feeling overwhelmed by alert volume, with accuracy dropping sharply after extended shifts. AI triage tools are the proposed fix, but a tool that quietly mis-scores incidents doesn't reduce risk, it hides it until the wrong alert gets closed without review. The person who can audit that scoring, not just click through it, is the one a manager wants on the team when something goes wrong.
The stacking pattern shows up in the workforce data too
ISACA's own research backs this up from the employer side. Its State of Cybersecurity 2025 global report found that AI is now used in day-to-day security operations for threat detection (32 percent), endpoint security (30 percent), and routine task automation (28 percent), even as 65 percent of teams report unfilled cybersecurity positions and 55 percent describe their teams as understaffed. AI adoption and staffing shortages are running in parallel, which means the professionals already on the team are the ones absorbing AI oversight duties whether or not it's written into their job description.
The same report found a drop in employers training non-security staff into security roles, down to 29 percent from 41 percent the prior year, even though nearly half of respondents said more than half of their current staff originally transitioned in from other fields. Read together, those numbers describe a workforce being asked to do more AI-adjacent work with less structured pathway support from above. A certification stack is one of the few ways an individual professional can build that pathway for themselves instead of waiting for an employer program that isn't coming.
How do you actually build a stack that a hiring manager notices
Start with the foundation you're missing, then add the AI-specific layer once that base is solid, rather than chasing the newest AI credential first and leaving gaps underneath it. A hiring manager can tell the difference between someone who understands security operations and picked up AI oversight on top of it, and someone who only knows the AI layer and nothing underneath.
The pairing looks different depending on which track you're already on:
| Your current track | Foundation certification | AI-specific layer to add |
|---|---|---|
| Security operations / analyst | CySA+ or Security+ | SecAI+ |
| Offensive security | PenTest+ | SecAI+ |
| Security management / leadership | CISM or CISSP | AAISM |
If you're not sure which foundation certification actually fits your day-to-day work, a curriculum overview that maps roles to exam objectives is worth reading before you commit study hours, and Forge University keeps one in its certification resources hub. Guessing at the wrong starting cert costs months you don't get back, and it delays the point where an AI-specific credential would even be available to you.
Where this shows up on paper, not just in interviews
A stacked credential reads differently on a resume or a LinkedIn profile than a single AI buzzword ever will. Instead of "familiar with AI security tools," the line becomes something closer to "CompTIA Security+, added SecAI+ in 2025," which names a testing body, a prerequisite, and a date. That specificity is what a recruiter's keyword search and a hiring manager's gut check both respond to.
It also changes how you talk about yourself in the room. When you can point to CompTIA's own framing of SecAI+ as validating AI risk and governance knowledge on top of a core role certification, you're not making a claim about yourself, you're citing a standard someone else built and tested you against. That distinction matters more than it used to, because so much AI-related self-description right now is unverifiable.
What this means for visibility, not just competence
Competence gets you through a project. Visibility gets you considered for the next one, and visibility now runs through what a hiring system or a manager can see on paper. A stacked credential is legible in a way that a year of informal tool use is not, because it names a body that tested you and a prerequisite you had to clear to get there.
That legibility matters most at the moment budgets tighten and headcount doesn't grow. When a team can't add people, the professionals already inside it who can demonstrate verified AI oversight skills are the ones pulled into the higher-visibility work, the audits, the vendor evaluations, the incident postmortems where an AI-assisted tool played a role. If you want a study plan built around closing your specific foundation-certification gap before you add an AI layer on top, you can start training whenever you're ready.
This isn't only a senior-track story. Someone earlier in a security career can build the same pattern on a smaller scale, pairing a foundational credential with a lighter AI-literacy layer once the fundamentals are solid, rather than skipping straight to an AI-only credential with no operational base behind it. The order matters more than the speed. A stack built in the right sequence, even slowly, reads as more credible than two unrelated credentials earned in a rush.
None of this means chasing every new AI credential that appears. It means being deliberate about the order, keeping your foundation cert current, and picking the one AI-specific layer that maps to how your role actually uses these tools day to day. The professionals who get noticed over the next two years won't be the ones with the longest list of certifications. They'll be the ones whose two or three credentials visibly build on each other.