CompTIA SecAI+, CCSP Goes Adaptive, and the Study Habit That Actually Mirrors How Exams Are Scored

The last week in September brings a cleaner view of the certification landscape as it stands heading into Q4: CompTIA's AI security certification is live, ISC2's CCSP is now a fundamentally different exam format, the A+ has new codes and updated content, and the CISM countdown clock is ticking louder. Here's what's real, what's changing, and a few study approaches that work better than just re-reading the same material.

News CompTIA SecAI+ is now a live, available certification — not a future roadmap item. CompTIA officially launched SecAI+, a credential positioned at the direct intersection of AI systems and cybersecurity. The exam covers topics like securing AI/ML pipelines, adversarial machine learning threats, AI governance, and defending against AI-enabled attacks. It sits alongside Security+ rather than replacing it — Security+ remains the foundational security credential, while SecAI+ targets those specifically working with AI systems in a security context. If your work involves AI infrastructure, model deployment, or defending against AI-driven threats, this is worth evaluating. (Source: CompTIA — Introducing CompTIA SecAI+, Network World — CompTIA Launches SecAI+ Certification) ISC2 moved the CCSP to Computer Adaptive Testing (CAT) format effective August 1, 2026 — the exam experience is now shorter and adaptive. Unlike a fixed-length exam where everyone gets the same 125 questions, CAT dynamically adjusts question difficulty based on how you're performing. The CCSP now uses 75–125 questions, and the exam ends when the algorithm has determined your proficiency level with sufficient confidence — which can mean finishing in under two hours if you're performing clearly above the passing threshold. ISC2 applied the same format to the CC and SSCP exams simultaneously. Candidates who've prepared using traditional timed-question strategies should understand that this format rewards demonstrated competency differently than raw question volume. (Source: CBT Nuggets — ISC2 Brings CAT to CC, SSCP & CCSP, ISC2 — CCSP Exam Going CAT) CompTIA's A+ is now on its 220-1201 and 220-1202 exam codes, with updated content that reflects where the IT support role actually is in 2026. The new A+ gives more weight to virtualization, cloud infrastructure management, and AI-assisted troubleshooting — reflecting the reality that help desk and support technicians increasingly work in hybrid and cloud-first environments. If you're using older 220-1101/1102 study materials, they won't align with the live exam. The older exam codes were retired; 220-1201 (Core 1) and 220-1202 (Core 2) are the current versions. (Source: Infosec Institute — CompTIA A+ 220-1201/1202 Changes, Ascend Education — The New CompTIA A+ Exam) The ISACA CISM exam content outline update takes effect November 3, 2026 — now five weeks out. If you're mid-prep for the CISM and planning to sit before the change, your existing materials are still valid for that window. After November 3, the domain weights shift significantly: Information Security Program (Domain 3) moves to 33% of the exam, up from 27%, while Governance (Domain 1) drops to 18%. That's a meaningful rebalance — if you're sitting after November 3, your study time allocation should reflect it. (Source: ISACA — CISM Job Practice Update 2026) Cybersecurity salaries are rising fastest in cloud security, identity, and GRC specializations in 2026. Robert Half's 2026 technology salary guide and industry reporting from Spectraforce both indicate that professionals with certifications in cloud security (CCSP, AWS Security) and identity/access management are seeing the sharpest compensation increases — in some cases 12–18% above the prior year for mid-level roles. GRC analysts with CISM or CRISC credentials are in particularly high demand as regulatory pressure (SEC cybersecurity disclosure rules, EU AI Act compliance) drives hiring. (Source: Robert Half — Hiring and Salary Trends in Cybersecurity, Spectraforce — Cybersecurity Hiring Trends 2026) Study & Passing Tips

Allocate your study time proportionally to domain weights — not equally. This sounds obvious, but most candidates don't actually do it. If Security+ Domain 2 (Threats, Vulnerabilities, and Mitigations) represents 22% of the exam and Domain 5 (Security Program Management) represents 20%, those domains should get roughly 10% more of your study hours than a domain at 12%. Most study books and courses don't teach in proportion to exam weight — they teach in narrative order. Before building your study schedule, map out the domain weights from the official exam outline and work out how many hours each domain deserves. You'll almost certainly find you've been over-preparing for some areas and under-preparing for others.

Use active recall, not passive review. There's a meaningful difference between reading a concept and being able to retrieve it under exam conditions. Passive review — rereading notes, watching video lectures, highlighting — feels productive but produces weak long-term retention. Active recall — closing the book and trying to answer "what are the five phases of incident response?" from memory, or writing out a concept before checking whether you got it right — is harder and more uncomfortable, which is exactly why it works better. After you cover a section, put the material away and try to retrieve the key points. The struggle to remember something is itself the learning mechanism.

Understand the why behind each control, not just the definition. IT certification exams, especially at the intermediate and advanced levels (Security+, CySA+, CISSP), are increasingly scenario-based. Memorizing that "AES-256 is symmetric encryption" won't help you answer a question asking which solution is most appropriate for encrypting data in transit between two microservices with specific latency requirements. What helps is understanding why a control exists, what threat it addresses, what its tradeoffs are, and when you'd choose it over alternatives. When you study a concept, ask yourself: what problem does this solve? When would I use it? When would I not use it? Those questions are the shape of the actual exam questions.

Don't skip the performance-based questions (PBQs) in practice — they're high-leverage. CompTIA exams typically front-load performance-based questions — simulations and drag-and-drop tasks — at the start of the exam. Many candidates don't practice these specifically and are caught off-guard by the format. Worse, if you skip them to answer multiple-choice first, you may run out of time and leave high-point PBQs blank. Practice PBQ-format questions in your study materials specifically, and when you see them on exam day, take them methodically rather than panicking and skipping.

How Test Prep Lite Can Help

Test Prep Lite covers all the certifications discussed here — Security+, CCSP, CISM, A+, CySA+, CISSP, and more — with practice questions that reflect current exam content and track your performance by domain. That domain-level tracking makes it straightforward to see where you're actually at, rather than guessing, so you can direct your study time to the areas that will move your score the most. If you're studying for any of the certifications covered here, it's worth checking out at https://app.testpreplite.com.

Also Worth Knowing

If you're evaluating the new CompTIA A+ 220-1201/1202 versus the older 1101/1102 materials sitting on your bookshelf: the older exam codes were retired, so those prep materials no longer match the live exam. CompTIA's official A+ Certification page lists the current objectives, which you can download for free — worth pulling before purchasing any new study materials to confirm they reference the 1201/1202 objectives specifically.