ISC2 CC Exam Now Fully Updated, an AI Security Cert Is Coming, and How to Study for a CAT Exam

The ISC2 Certified in Cybersecurity (CC) exam rolled out its first major content refresh since 2022 on September 1st. If you're eyeing the CC as a starting point, there are meaningful changes to understand before you sit — and a few study strategies that work especially well for the adaptive format the CC now uses.

News ISC2 CC exam outline updated September 1, 2026 — first major refresh since the cert launched. The revised exam now integrates foundational AI security concepts across all five domains, places stronger emphasis on GRC (governance, risk, and compliance) topics (which now carry 17.3% of the exam weight), and gives more coverage to IAM, Zero Trust, cloud security, and incident response. If you've been studying from pre-September materials, it's worth checking whether your resources reflect the new outline. (Source: ISC2 — What's New for Entry-Level Cybersecurity, Certcy — ISC2 CC Exam Changes 2026) The CC now uses Computerized Adaptive Testing (CAT). The new format delivers 100–125 items in two hours, adapting the difficulty of each question to your demonstrated ability as you go. This is the same approach ISC2 uses for CISSP, CCSP, and SSCP — so CC candidates are now getting experience with a format they'll encounter again as they advance. (Source: ISC2 — Computerized Adaptive Testing, CBT Nuggets — ISC2 CAT Exam Update) ISC2 is building a new AI security certification — pilot expected late 2026. Confirmed in July, the credential will be vendor-neutral and focused specifically on AI security concepts. No name or exam outline has been published yet, but a pilot exam is expected before the year ends. Given the pace at which AI skills gaps are widening (ISC2's workforce study puts AI as the #1 skills gap at 34% of organizations), this cert is likely to get attention quickly. (Source: CertCrush — ISC2 AI Security Certification 2026) The U.S. cybersecurity job market: 514,000+ open listings, with AI skills increasingly required. CyberSeek's latest data shows over half a million active cybersecurity job listings in the U.S., with approximately 10% explicitly requiring AI skills — a share that has grown substantially over the past two years. Entry-level roles remain frustratingly hard to break into despite the overall demand, but the data continues to show that certified candidates have a measurable advantage in the hiring funnel. (Source: StationX — Cybersecurity Job Market Statistics 2026, Spectraforce — Cybersecurity Hiring Trends 2026) Cloud security and AI remain the top two skills gaps inside security teams. ISC2's Cybersecurity Workforce Study identifies AI (34%) and cloud security (30%) as the skills organizations are most short on. That gap is directly relevant to certification choices: CompTIA Security+, CySA+, and CASP+ all include substantial cloud and AI content, and CCSP is dedicated to cloud. If you're thinking about which cert to pursue next, these two domains are worth prioritizing. (Source: DestCert — Cybersecurity Job Demand 2026) Study & Passing Tips

Understand how CAT exams work — the format changes your test-day strategy. In a Computerized Adaptive Test, the exam adjusts the difficulty of each question based on your previous answers. A correct answer on a hard question is strong evidence of competency; a wrong answer on an easy question is a significant negative signal. You cannot go back and change previous answers in a true CAT format. What this means practically: commit fully to each answer before moving on. Second-guessing yourself mid-exam is more costly in CAT than in a traditional linear exam.

Don't over-weight questions that feel unexpectedly hard or easy. Because the CAT adapts to you, you may get a string of very difficult questions — that can actually be a sign the exam thinks you're performing well, not that you're failing. Conversely, suddenly easier questions don't necessarily mean you've recovered a stumble. Stay focused on each question individually rather than trying to read the tea leaves from perceived difficulty shifts.

Build your GRC foundation before drilling practice questions. The CC's updated outline gives governance, risk, and compliance a dedicated 17.3% weight. GRC content can feel abstract compared to hands-on security topics, but it rewards a clear mental model more than rote memorization. Spend time understanding the why behind frameworks like NIST CSF and the relationships between risk appetite, risk tolerance, and risk treatment before you work through practice questions in that domain. Conceptual clarity will carry you through the scenario-based GRC questions better than flashcards alone.

Use spaced repetition for terminology-heavy domains. Governance, IAM, and legal/regulatory content on the CC (and CISSP) are vocabulary-dense. Spaced repetition — reviewing material at increasing intervals based on how well you know it — is significantly more effective for locking in definitions than re-reading notes the night before. Even a basic flashcard system that surfaces your weaker cards more frequently will help.

How Test Prep Lite Can Help

The ISC2 CC is one of the certifications fully covered in Test Prep Lite, with practice questions aligned to the current exam domains — including the updated GRC and AI-adjacent content. If you're working through the new outline and want to see where you actually stand across all five domains, the app tracks your performance at the domain level so you know where to focus your time rather than reviewing everything uniformly. For anyone prepping for the CC, CISSP, CCSP, or any CompTIA or ISACA cert, it's worth checking out: https://app.testpreplite.com

Also Worth Knowing

ISC2's own CC exam outline page has the September 2026 exam outline available as a PDF. If you're actively studying, downloading the current outline and mapping your study resources to it is one of the highest-value 30 minutes you can spend before diving into content.