Is the AAISM worth it? What ISACA publishes

Whether the AAISM is worth it depends on one thing more than any other: whether your work is turning into AI security decisions. ISACA built the credential for security managers who already hold a CISM or CISSP and are being asked to govern, secure and answer for the AI their organizations adopt. What ISACA does not publish is the kind of number most articles on this question lead with: there is no AAISM salary figure, no count of AAISM holders and no pass rate. What it does publish is who the credential is for, what it covers, what it costs to earn and keep, and a large survey of where organizations stand on AI security. This guide sets those out, says plainly what is missing, and ends with the questions that decide the answer for you.

The short answer

• It is worth it if AI security is becoming your job. ISACA describes the AAISM as a credential "designed to supplement certified security managers with the ability to identify, assess, monitor and mitigate risk associated with enterprise AI solutions."
• You must already hold an active CISM or CISSP, and keep it, so the AAISM adds to a security management credential rather than replacing one.
• No AAISM salary is published. ISACA prints a salary figure for the CISM, not for the AAISM, and no job count for either.
• ISACA's own 2026 survey shows the gap the credential aims at: only 38 percent of organizations have a formal, comprehensive AI policy, and 56 percent of respondents do not know how long it would take to halt an AI system after a security incident.
• Its exam costs less than the CISM's. The AAISM exam is US$459 for ISACA members and US$599 for nonmembers, against US$575 and US$760 for the CISM; keeping the AAISM costs US$20 or US$35 a year and 10 CPE hours.
• It is new. ISACA launched it in August 2025, so it has a short track record with employers.

What is the AAISM certification?

The AAISM, ISACA's Advanced in AI Security Management credential, is an advanced certification in securing AI across an enterprise. ISACA's AAISM page calls it the first and only AI-centric security management certification, "designed to help experienced IT professionals reinforce the enterprise's security posture and protect against AI-specific threats." The page goes on: "You'll be able to manage the evolving security risk related to AI, implement policy, and ensure its responsible and effective use across the organization."

It is examined in three domains: AI Governance and Program Management (31%), AI Risk and Opportunity Management (31%) and AI Technologies and Controls (38%). The exam is "2.5 hours (150 minutes); 90 multiple-choice questions", and it is a management exam, not a hands-on one: the questions describe a situation and ask what a security manager should do. The AAISM exam content outline explained goes through the 13 topics.

Who is the AAISM for?

ISACA answers in its candidate guide: the credential is "Designed for IT security professionals with a CISM or CISSP certification looking to gain recognition for their expertise in securing enterprise AI solutions and leveraging AI to improve security operations." Holding one of the two is a condition, not a suggestion: "AAISM candidates must hold an active CISM or CISSP certification."

ISACA's launch announcement adds experience to the picture. The AAISM "builds upon existing security management best practices found in CISM and CISSP and focuses on the associated threat landscape", which makes it, in ISACA's words, "a strong fit for those with proven experience in security or advisory roles, and professionals with some expertise assessing, implementing and maintaining AI systems."

In practice, that describes three kinds of people: security managers whose organizations are adopting AI and who are expected to set the rules for it; consultants and advisors who are asked about AI security by clients; and security leaders who will answer to a board or a regulator when an AI system fails. If none of those is you yet, the AAISM is a credential for later, not now.

Is the ISACA AAISM certification worth it?

Weigh it on four questions.

Will it change what you can do at work? The AAISM's tasks are the work of an AI security program: one asks you to "Establish and maintain AI-specific security policies and procedures to inform the development and implementation of AI standards and guidelines", another to "Design and implement security architecture specifically for AI", another to "Embed, monitor, and verify AI security requirements when utilizing vendor AI-enabled solutions." If those are, or are about to be, your responsibilities, the preparation itself is useful, credential or not.

Will it be recognized where you work? ISACA is the body behind the CISM, and the AAISM sits on top of it, so the name will mean something to anyone who knows ISACA's credentials. But the AAISM launched in August 2025, and ISACA publishes no count of holders, so many employers will not yet look for it by name. Check how AI security roles in your market are described before you count on it opening doors by itself.

Is it the right AI credential for your role? The AAISM is about security management. ISACA has separate AI credentials for audit and for risk: its 2026 survey release lists "three new credentials: Advanced in AI Audit (AAIA), Advanced in AI Security Management (AAISM) and Advanced in AI Risk (AAIR)". An auditor or a risk professional may be better served by one of the others; a hands-on engineer may want a technical credential instead of a management one. AAISM vs AAIA vs AAIR compares ISACA's AI credentials, and best AI security certifications in 2026 the wider field.

What does it cost you, in money and time? Less than most advanced credentials, as the section on cost below shows, but it ties you to two maintenance cycles: the AAISM's own and that of the CISM or CISSP you must keep active.

If the answers are yes, yes, yes and acceptable, it is worth it. If your work is not yet touching AI security decisions, the content is still worth learning, but the credential can wait.

What does ISACA's research say about demand?

ISACA's case for the AAISM rests on its AI Pulse Poll, a survey of digital trust professionals. Its launch announcement opened with the 2025 poll: "Ninety-five percent of digital trust professionals are worried that generative AI will be exploited by bad actors". It presented the AAISM as a response to AI "increasing the demand for skilled security professionals who can effectively manage and protect AI systems".

The 2026 poll, with responses from more than 3,400 professionals, is more specific about the gap. From ISACA's May 5, 2026 release:

• Only "38 percent of organizations have a formal, comprehensive AI policy", up from 28 percent in 2025.
• "78 percent saying AI skills are very or extremely important to their profession", up from 72 percent.
• "36 percent say their organization will increase AI-related jobs in the next 12 months, up from 31 percent in 2025".
• Over half, 56 percent, "do not know how long it would take to halt an AI system due to a security incident", and "39 percent say they do not know whether they have a documented process for shutting down or overriding AI systems if things go wrong."

ISACA's preview of the same poll, on March 23, 2026, adds that less than half, 43 percent, have high confidence in their organization's ability to investigate and explain a serious incident with an AI system to leadership or regulators, and that only "36 percent of respondents saying humans approve most AI-generated actions before execution". Asked who is responsible when an AI system causes harm, "13 percent assign the responsibility to their CISO" and "20 percent admit that they do not know where the responsibility would lie."

Read as a job description, those numbers are the AAISM's outline: policies that do not exist yet, incident processes that cannot stop an AI system, oversight of AI actions, and accountability nobody has assigned. Remember who is speaking: ISACA designed the survey and sells the credential. But the figures come from a survey of more than 3,400 people, and they describe work that has to be done whether or not anyone certifies it.

What is the AAISM salary?

Not published. ISACA's AAISM page, its candidate guide and its launch announcement contain no salary figure for the AAISM, and none for a role that requires it. Any AAISM salary you see quoted is someone's estimate, often taken from general AI or security job listings.

The nearest figure ISACA does publish is for a different credential. Its CISM page states an average annual salary of US$149K+ for the CISM, with no date or method beside it. That figure is about the CISM, not the AAISM, but it is a reminder of the position many AAISM candidates start from: the credential is added to a security management career that is already established, rather than starting one.

Are there AAISM jobs?

ISACA publishes no count of jobs that ask for the AAISM, and because the credential is new, few postings will name it yet. What ISACA's 2026 survey does show is growth in the work: 36 percent of respondents say their organization will increase AI-related jobs in the next 12 months. The jobs to look for are the ones that own AI security decisions, wherever they sit and whatever they are called: the outline's tasks, from AI security policy to incident handling for AI, describe that work better than any title. If postings in your market ask for experience with AI governance, AI risk or AI security architecture, the AAISM is evidence for that experience; if they never mention AI, it will matter less for now.

What the AAISM costs to earn and keep

ISACA's figures, from the candidate guide and its AAISM pages:

• The exam: US$459 for ISACA members, US$599 for nonmembers, paid again in full for each attempt.
• The application: "Pay the US$50 application processing fee" once you pass, and "Candidates have five years from passing the exam to apply for AAISM certification."
• Every year after: "The cost of the annual maintenance fee is US$20 for ISACA members, US$35 for non-members." ISACA adds that this one fee covers all of a holder's ISACA Advanced certifications.
• Continuing education: "Maintaining your AAISM™ requires earning a minimum of 10 CPEs annually and a total of 30 CPEs over a 3-year period."
• The prerequisite, kept: "Maintenance requires that AAISM-certified professionals submit proof of their active CISM or CISSP certification."

On top of those sit your study costs, which are your choice. Every fee, with a timeline of when each is due, is in what the AAISM costs.

The time cost is the other half. ISACA publishes no study hours; our course's estimate is about 76 hours, or 8 weeks at about 9.5 hours a week, and once you register you have six months to take the exam. How to study for the AAISM lays out the weeks.

Questions to answer before you register

1. Do you hold an active CISM or CISSP? If not, the AAISM is not open to you yet, and the first decision is which of the two to earn.
2. Is AI security part of your job now, or will it be within a year? The credential is most useful when it certifies work you are doing.
3. Is security management the right lens? If your AI work is mostly audit or risk, compare ISACA's AAIA and AAIR first.
4. Will your employer pay? Ask before you register; the case is easier to make when the AI policy, incident and oversight gaps in ISACA's survey are gaps in your organization too.
5. Can you keep two credentials active? The AAISM's 10 CPE hours a year can overlap with the CISM's when the activity serves both, but the CISSP or CISM must stay current.

Where to start

The cheapest way to test whether the AAISM suits you is to try its content before you pay for anything. A free account opens the first topic, AI governance and regulation, in full: its 147 questions with rationales, its lessons and its flashcards, plus a short diagnostic and a study plan. How hard is the AAISM exam? sets out what makes the exam difficult, and the AAISM exam guide shows every topic. When you decide to go ahead, full access to all 63 lessons and 1,717 questions is a single payment, with nothing to renew.