Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
A plain reference to EC-Council’s AI red teaming certification as of October 2026. It covers the 312-52 exam and its five hands-on practical questions, the five blueprint domains and their weights, the 10 course modules, eligibility, cost, renewal, career paths, and how COASP compares to CEH and CompTIA SecAI+.
COASP is EC-Council’s certification for AI red teaming. Announced in February 2026 and styled C|OASP by EC-Council, it is tested through exam 312-52.
It validates that you can attack AI systems the way an adversary would, through prompt injection, jailbreaking, data poisoning, model extraction and agent hijacking, and then build the controls that stop those attacks. The course maps to the OWASP Top 10 for LLM Applications (2025) and MITRE ATLAS.
The exam pairs 65 multiple-choice questions with five hands-on practical tasks over six hours, and EC-Council expects three years of cybersecurity experience before you take the course. COASP is issued and maintained by EC-Council, the certification body behind CEH, CND and CCISO.
Map the AI architecture, enumerate exposed endpoints and inference APIs, and profile the training pipeline.
Run prompt injection, jailbreaks, data poisoning and model extraction to prove the weakness is real.
Add guardrails, detection and incident response procedures so the same attack fails next time.
Four things separate COASP from general ethical hacking certifications and from the other AI security credentials that arrived in early 2026.
EC-Council calls COASP the first credential built specifically for AI red teamers. Model building and AI program management stay out of scope. The course and exam stick to attacking LLMs, agents, training pipelines and AI infrastructure, then proving the defenses hold.
Five of the 70 questions are hands-on practical tasks worth seven marks each, against one mark for a multiple-choice question. Together they carry 35 of the exam’s 100 marks.
The course works through more than 20 tools, including Garak, PyRIT, Burp Suite, the Adversarial Robustness Toolbox, TextAttack and Promptfoo, across 30 lab exercises.
EC-Council announced COASP on February 10, 2026 with three other AI credentials under its Adopt, Defend, Govern (ADG) framework: Artificial Intelligence Essentials (AI|E) for baseline literacy, Certified AI Program Manager (C|AIPM) for adoption, and Certified Responsible AI Governance and Ethics (C|RAGE) for governance. COASP is the Defend credential and the only offensive one of the four.
For government work, EC-Council says the labs map to DoD and NICE DCWF knowledge, skills and abilities, and the curriculum aligns with the DoD AI Test and Evaluation Specialist (672) work role. It does not claim a DoD 8140 listing, so check the current matrix at the DoD Cyber Exchange before you count on it for a cyber-coded position.
The certification, the 312-52 exam, and what it takes to keep COASP active, as of October 2026.
COASP is already an advanced credential, so the next step depends on whether you want to go deeper on offense, move toward running AI security, or end up owning AI governance. These are three common directions.
EC-Council’s Certified Penetration Testing Professional, its hands-on pen testing credential. A sensible next step for COASP holders whose engagements still cover networks, infrastructure and applications alongside the AI targets.
ISACA’s Advanced in AI Security Management requires an active CISM or CISSP. It suits COASP holders who move from testing AI systems to running the AI security program. Read the AAISM guide.
IAPP’s AI Governance Professional has no prerequisites and is built for the people who own AI risk and policy. EC-Council’s own Govern credential, C|RAGE, covers related ground inside the ADG suite. Read the AIGP guide.
COASP is not a starting point. EC-Council expects three years of security experience before the course, so it usually follows an offensive security credential and leads into deeper offense, AI security leadership, or defense.
Learn to attack first
Attack AI systems
Two questions to answer before you commit: can you take the exam, and should you take COASP specifically. Here’s a straight answer to both.
You can apply to sit the exam directly.
Submit EC-Council’s exam eligibility application with your work history and pay the non-refundable $100 application fee. Processing usually takes 5 to 10 working days once your verifiers respond, and an approved application stays valid for three months. Then buy the 312-52 voucher from the EC-Council store, which lists it at $650 as of October 2026.
Training replaces the separate application.
Candidates in official training don’t file the eligibility form. EC-Council collects their details through the training evaluation form, and the $100 fee is included in the training price. Training Camp’s COASP boot camp uses official EC-Council courseware and includes the 312-52 voucher. Keep in mind that EC-Council still lists three years of cybersecurity experience as the course prerequisite.
EC-Council names more than a dozen roles for COASP holders. These six track the course content most closely, and most of them are jobs people grow into from pen testing, red team, SOC or AppSec work.
Plans and runs authorized attacks against LLM applications, agents and ML models, from prompt injection and jailbreaks to model extraction, then writes up what broke and how to fix it.
Builds the tooling a red team uses against AI systems, such as automated jailbreak orchestration, fuzzers for model interfaces, and scanners like Garak and PyRIT.
Studies how attackers go after models and training pipelines, maps what they find to MITRE ATLAS techniques, and turns it into detection logic and threat reports.
Investigates incidents that involve AI systems, collects logs, telemetry and other evidence from AI environments, and runs the root cause analysis afterward.
Designs AI deployments that hold up when someone attacks them, with locked-down system prompts, sandboxed tool calls, least privilege for agents and monitoring for model drift.
Plans structured security testing for AI systems before release, makes the go/no-go call with evidence, and reports risk in terms leadership can act on. EC-Council aligns COASP with the DoD work role of this name (DCWF 672).
People usually weigh COASP against two certifications: EC-Council’s own CEH, which covers traditional ethical hacking, and CompTIA SecAI+, which approaches AI security from the defensive side.
| COASP | CEH | CompTIA SecAI+ | |
|---|---|---|---|
| Issuer | EC-Council | EC-Council | CompTIA |
| Exam Format | 65 multiple-choice + 5 practical, 6 hours | 125 multiple-choice over 4 hours | Up to 60 multiple-choice and performance-based, 60 min |
| Level | Advanced | Intermediate | Specialty (mid-level) |
| Focus | Attacking and hardening AI systems | Broad methodology and tool coverage | Securing AI systems and AI-assisted security |
| Prerequisites | 2 yrs infosec or official training (3 yrs expected for the course) | 2 yrs infosec or official training | None required |
| Renewal | 120 ECE credits over 3 years | 120 ECE credits over 3 years | CE renewal every 3 years |
| DoD 8140 Approved | No listing claimed | Yes | Not listed |
| Best For | Pen testers and red teamers adding AI targets | Broad credential recognition, career entry into offensive security | Practitioners defending and governing AI systems |
CEH and SecAI+ details come from our CEH guide and SecAI+ guide. COASP is the only one of the three built entirely around attacking AI systems, and CEH plus COASP is a natural pairing for a pen tester moving into AI work.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our official EC-Council COASP boot camp covers all 10 modules in five days (40 hours of instructor-led training), live online or on-site, with official courseware, EC-Council iLabs, the mobile app, your 312-52 exam voucher and a free retake included.
EC-Council’s AI suite, the wider AI certification field, the agentic risks COASP tests, and the pen testing basics underneath it.
How EC-Council’s February 2026 Enterprise AI Credential Suite splits into AIE, CAIPM, COASP and CRAGE under the Adopt, Defend, Govern model, and which job each of the four is built for.
A cert-by-cert map of the AI credentials employers are asking about in 2026, including where COASP sits next to the governance, cloud and vendor AI certifications.
The ten agentic AI risks, ASI01 through ASI10, that OWASP published in December 2025. Useful background for the COASP module on agentic AI and model-to-model attacks.
Why institutional backing, regulatory pressure and employer demand decide which new AI credentials last, and which ones are pulling ahead of the field this year.
A straight look at CompTIA’s defensive AI security certification and whether the job market has caught up with it yet. Worth reading if you are choosing between SecAI+ and COASP.
The phases, methods and tools of a standard pen test. COASP assumes you already know this material and points it at AI systems instead of networks and servers.
An AI model turned up a 27-year-old flaw in OpenBSD that decades of human audits missed. What that April 2026 announcement means for vulnerability management and security jobs.
EC-Council’s COASP Exam Blueprint v1 splits exam 312-52 into five domains and 11 sub-domains. The badge shows each domain’s share of the exam, and the color shows which phase of the Recon, Exploit, Defend methodology it mostly sits in. Every domain carries one of the five practical questions. Click any domain for what it covers.
Made up of Introduction and Evolution of Offensive AI Security (5%) and Foundations of LLMs and Agent Architectures (6%). Covers AI attack surfaces, input attacks, plugin and extension risks, security frameworks for AI, DoD AI ethical principles and assurance case methodology, then LLM internals such as prompts, embeddings, fine-tuning and context windows, the inference pipeline, RAG and tool invocation, and hosted versus self-hosted attack surfaces. One practical question and four multiple-choice questions.
Made up of Reconnaissance and Threat Mapping of AI Systems (12%) and Prompt Injection and Context Exploitation (10%). Expect enumeration, endpoint fingerprinting, model probing, system prompt extraction and identifying plugins and context limits, plus prompt injection attacks, context overflow exploits and documenting the attack chain. One practical question and 15 multiple-choice questions.
The largest domain, made up of Output Exploitation and Memory Manipulation (8%), Agent Hijacking and Unsafe Tool Integrations (8%), and Supply Chain, Plugin, and Ecosystem Attacks (15%). Covers trust boundaries for LLM output, output exploits such as XSS, SSRF and RCE, agent memory attacks, task flow manipulation, excessive autonomy, privilege escalation and human-in-the-loop weaknesses, then malicious plugins, typosquatting, version downgrade and shadowing attacks, and compromised dependencies. One practical question and 24 multiple-choice questions.
Made up of Training-time and Lifecycle Attacks (12%) and Model Theft, Extraction, and Evasion Attacks (8%). Covers targeted and broad data poisoning campaigns, poisoned embeddings in RAG pipelines, adversarial input perturbations and lifecycle threats in MLOps, then query-based model extraction, model fingerprinting, jailbreaking and guardrail evasion, surrogate models, and the detection strategies that catch them. One practical question and 13 multiple-choice questions.
Made up of Governance, Risk, and Compliance (8%) and Defensive Engineering and Mitigation Strategies (8%). Covers AI-specific test and evaluation planning, go/no-go decision frameworks, safety standards such as MIL-STD 882E, DO-178C and ISO 26262, and professional report writing, then input and output filtering, sandboxing and least privilege, monitoring AI behavior drift, blue team responses to AI incidents, and securing RAG pipelines. One practical question and nine multiple-choice questions.
The official five-day course is organized as 10 modules. They don’t line up one to one with the blueprint domains, so use the domains to plan study time and the modules to follow the course. Each badge shows the module’s phase.
AI and machine learning fundamentals from an attacker’s point of view, AI attack surfaces and adversary techniques aligned to MITRE ATLAS, attack taxonomies, offensive scoping, and a mapping of the OWASP LLM and ML Top 10 (2025).
OSINT for AI assets, intelligence from data sources and training pipelines, enumerating AI endpoints, services, APIs and exposed parameters, and analyzing models and vector stores as an attacker would.
Vulnerability assessment for AI systems, scanning tools for models, pipelines and deployments, fuzzing methods built for model interfaces, and folding both into a security workflow.
Prompt injection and jailbreaking in real LLM applications, sensitive information disclosure and system prompt leakage, improper output handling, and secure LLM application design.
Adversarial ML attack classes, adversarial inputs across data types, privacy, inference and model extraction attacks, and defenses for model privacy and resilience.
Training pipeline architecture and threat surfaces, practical data poisoning, backdoor and trojan insertion during training, and the controls that protect data and pipelines.
Agentic AI attack surfaces, excessive agency and autonomy exploits, cross-LLM attack vectors, denial-of-wallet and unbounded resource consumption, and attacks on orchestration layers.
AI infrastructure and integration architecture, flaws in AI frameworks and deployment pipelines, abuse of tools, plugins and APIs, and a closer look at AI supply chain and dependency risk.
Structured AI security testing and evaluation, red team frameworks for offensive AI assessment, validating and reporting AI vulnerabilities, and hardening practices for AI systems.
Detecting and responding to AI-specific incidents, collecting AI logs, telemetry and digital evidence, and root cause analysis, ending with hands-on AI red team activity.
Domains and weights reflect EC-Council’s COASP Exam Blueprint v1 for exam 312-52, and the modules reflect the version 1 course, both current as of October 2026. COASP is a new program, so confirm the blueprint on cert.eccouncil.org before you test.
The questions candidates ask most often when researching the Certified Offensive AI Security Professional certification.
COASP, the Certified Offensive AI Security Professional (styled C|OASP), is EC-Council’s certification for AI red teaming. It tests whether you can attack AI systems the way an adversary would, through prompt injection, jailbreaking, data poisoning, model extraction and agent hijacking, and then harden them. The exam code is 312-52.
EC-Council announced COASP on February 10, 2026, as one of four credentials in its new Enterprise AI Credential Suite, alongside Certified CISO v4. Its program page lists March 15, 2026 as the program launch date. The current release is version 1, tested against Exam Blueprint v1.
EC-Council’s certification site lists COASP as a beta exam, with an Apply for Beta Exam option, as of October 2026. EC-Council has not published a date for the beta to end. Confirm the current status with EC-Council when you apply.
EC-Council lists three years of cybersecurity experience as the prerequisite for the COASP course and says it is not a beginner course. To sit exam 312-52 you either complete official EC-Council training or apply directly with at least two years of information security work experience and a non-refundable $100 application fee.
Exam 312-52 runs 6 hours (360 minutes) and has 70 questions in two sections: 65 multiple-choice questions worth one mark each, then 5 hands-on practical questions worth seven marks each. It is delivered through the ECC Exam Portal with remote proctoring, and it is not open book. EC-Council sets the cut score per exam form, and its COASP brochure lists a passing score of 70 to 80 percent.
Exam Blueprint v1 has five domains: Foundations of Offensive AI Security (11%), AI Reconnaissance and Threat Profiling (22%), AI System Exploitation Techniques (31%), AI Model and Lifecycle Attacks (20%), and Governance and Defensive Engineering (16%). Each domain carries one of the five practical questions. The supply chain, plugin and ecosystem sub-domain inside AI System Exploitation Techniques is worth 15% on its own, more than any other sub-domain.
The official course has 10 modules: offensive AI methodology, AI reconnaissance and attack surface mapping, vulnerability scanning and fuzzing, prompt injection and LLM application attacks, adversarial machine learning and model privacy attacks, data and training pipeline attacks, agentic AI and model-to-model attacks, AI infrastructure and supply chain attacks, AI security testing and hardening, and AI incident response and forensics. EC-Council says it includes 30 lab exercises and more than 20 tools, among them Garak, PyRIT and the Adversarial Robustness Toolbox.
As of October 2026, the EC-Council store lists the remotely proctored COASP exam voucher at $650 USD, and the voucher is valid for one year. Candidates who skip official training also pay the $100 application fee. Training Camp’s COASP boot camp includes the 312-52 voucher in the course price.
COASP is part of EC-Council’s Continuing Education (ECE) scheme. You need 120 ECE credits across each three-year cycle plus an annual continuing education fee of $80. Credits come from activities such as conferences, webinars, writing research papers, teaching and volunteering, as listed in the ECE policy.
Both come from EC-Council, but they aim at different targets. CEH covers the traditional attack lifecycle across networks, systems, web applications, wireless and cloud in 20 modules and a 125-question, 4-hour multiple-choice exam. COASP turns the same attacker mindset on LLMs, agents, training pipelines and AI infrastructure, and its 6-hour exam adds five hands-on practical questions. CEH is the usual groundwork, and COASP is the AI specialization built on top of it.
They come at AI security from opposite sides. CompTIA SecAI+ (CY0-001) is a defensive exam of up to 60 questions in 60 minutes covering AI concepts, securing AI systems, AI-assisted security and AI governance, with no formal prerequisites. COASP is an offensive exam built around attacking AI systems, with 70 questions over 6 hours, five hands-on practical questions, and three years of security experience expected before the course.
EC-Council does not claim a DoD 8140 listing for COASP. It does say the course labs map to DoD and NICE DCWF knowledge, skills and abilities, and that the curriculum aligns with the DoD AI Test and Evaluation Specialist (672) work role. If you need a credential for a cyber-coded position, check the current qualification matrix on the DoD Cyber Exchange first. See the full DoD 8140 work role paths.
EC-Council lists roles such as AI red team specialist, offensive security engineer with an AI and LLM focus, adversarial AI security analyst, AI threat hunter, AI incident response engineer, AI test and evaluation specialist, and secure AI engineer or AI security architect. In practice it fits people who already work in pen testing, red teaming, a SOC or application security and now have AI systems in scope.
The official course runs five days, and EC-Council’s package gives you six months of lab access and a year with the e-book and video modules. Working pen testers usually spend most of their prep on the AI-specific material, such as adversarial machine learning and model extraction, and on hands-on practice for the five practical questions, which carry 35 of the exam’s 100 marks.
For pen testers, red teamers and security engineers whose scope now includes LLM applications and AI agents, it is a strong fit. EC-Council bills it as the first credential built specifically for AI red teamers, and the practical questions test skill rather than recall. The tradeoff is age. COASP was announced in February 2026, so employers are still learning what it means, and it carries no DoD 8140 listing. Earn it for the skills and let the resume value build over time.
Tell us where you are with COASP, from weighing the certification to funding it or training a whole red team, and we’ll help you plan the path.