Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
What employees and their managers need to know about CertNexus CyberSAFE as of October 2026, built around the CBS-510 assessment that launched in October 2025. The four domains and their weights, the 25-question online format, what it costs, whether it counts as a certification, the roles that benefit most, and how CyberSAFE compares to ISC2 CC and Security+.
CyberSAFE is the CertNexus security awareness credential for everyday technology users: the people who open email, use cloud apps and work from home, not the people who run the firewall.
Nobody needs a technical background for it, and CertNexus runs no eligibility check and sells no separate exam voucher. You take a short course (CertNexus designs its official one as a half day), then sit a 25-question assessment online through the CertNexus CHOICE platform. Score 80 percent, which is 20 of 25, and you earn the CyberSAFE credential and a digital badge you can share.
The current assessment is CBS-510, launched in October 2025 under the title CyberSAFE: Cyber Safety in the Age of AI. It replaced CBS-410, which CertNexus said would retire in the first quarter of 2026. The biggest change is a new objective on using generative AI safely, covering hallucinated answers, voice-cloning scams and what never to paste into a prompt. CyberSAFE is issued and maintained by CertNexus.
Policies, laws, protecting personal data, reporting incidents and using generative AI safely. 20% of the assessment.
Phishing, smishing, vishing, impersonation, AI-powered scams and how to verify a request. 28% of the assessment.
Physical security, public Wi-Fi, passwords and MFA, protecting data and avoiding malware. 24% of the assessment.
Email, web browsing, social networks, cloud services and working remotely. 28% of the assessment.
Four things that set a scored credential apart from a completion-only awareness module.
A lot of awareness training ends when the video does. CyberSAFE ends with 25 multiple choice and multiple response questions and an 80 percent pass mark, so a manager gets an actual result for each person instead of a list of who pressed play. People who pass receive the CyberSAFE credential and a digital badge from CertNexus that they can show employers, clients and colleagues.
CBS-510 added an objective on using generative AI safely. It covers made-up answers from AI tools, scams that clone a voice, deepfakes, the legal and copyright risks of AI output, and keeping sensitive data out of prompts. The CBS-410 blueprint it replaced had none of this, which is why the new version carries the title Cyber Safety in the Age of AI.
CertNexus designs the official course as a half day and estimates the assessment at 20 to 45 minutes. There is no separate exam voucher to buy, and the blueprint lets candidates retake the assessment as many times as they need. That makes it realistic to put an entire department through it, not just the people who volunteer.
The CBS-510 blueprint names the high-value targets outright: C-suite officials, accounting, HR and IT personnel. Then it teaches the habits that stop the attacks aimed at them, such as confirming a payment request by calling the person back, checking the real address behind a sender’s display name, and reporting a lost laptop straight away.
Domain 1 also covers the rules staff work under, from HIPAA, SOX and GDPR to PCI DSS and the EU AI Act. CertNexus does not claim that CyberSAFE satisfies any particular regulation’s training requirement, so confirm that with your compliance team before you count it toward one. For background on the human side of breaches, see our guide to security awareness training for employees.
The credential, the assessment, and what CertNexus does and does not say about keeping it, all against the CBS-510 version CertNexus administers today.
Course key prices are CertNexus store list prices in USD as of October 2026 ($15.17 digital, $20.99 print and digital), and the assessment comes with the course access key. CyberSAFE is taken online in the CertNexus CHOICE platform, unlike CertNexus certifications such as CFR, which run through Pearson VUE.
Most employees stop at CyberSAFE, and that is fine. For the ones it gets interested in the subject, these are the sensible next moves, depending on where that interest points.
The step from awareness to a security career. CC is the ISC2 entry-level certification, with five domains, a $199 exam and no work experience requirement. Read what CC covers if security work starts to look like a job you want.
For people who already work in IT and want to move into security. Security+ is far more technical, with up to 90 questions including performance-based items and a $439 exam. Read what Security+ covers before you book it.
CertNexus’s own pointer for people who need technical depth. CFR is a certification in threat detection and incident response, and CertNexus describes it as ANAB-accredited and DoD 8140 approved. It is a long way past CyberSAFE. See the CFR details at CertNexus.
CyberSAFE sits at the very start, and for most people it is the whole journey. Nothing comes before it except everyday comfort with a computer, a phone and email.
All the assessment assumes
For every employee
Anyone can take CyberSAFE, so the first question is quick. The second matters more, especially if you are choosing it for a whole team: is it the right tool for what you need?
No experience or application fee needed.
CertNexus requires no application fee, no supporting documents and no eligibility verification for the CBS-510 assessment. The only expectation is that you already use a computer, a phone, a web browser and email in your daily work. CertNexus recommends taking the official CyberSAFE course before the assessment, and the whole thing is written for people with no technical background.
The assessment comes with the course.
You do not buy a separate exam voucher. Access comes through a CyberSAFE course access key, bought from the CertNexus store or supplied by a CertNexus authorized training partner, and you take it online in the CertNexus CHOICE platform or through e-learning. In the Training Camp class you sit the assessment at the end of the same day.
Nobody gets hired because of CyberSAFE. The point is to protect the people already in these roles, and the CBS-510 blueprint is unusually specific about which of them attackers go after first.
The CBS-510 blueprint lists C-suite officials first among high-value targets. Whaling emails, impersonation and AI voice cloning are built to look like they come from, or go to, the people who can approve anything. A leader who can spot one also sets the example the rest of the company follows.
Accounting staff are named targets because they move money. The habits CyberSAFE drills are the ones that stop payment fraud: verifying a request through a second channel, calling back before acting on an urgent email, and treating any request to update account or payment details as a warning sign.
HR holds personal data on every employee and opens attachments from strangers as part of the job. The blueprint names HR personnel as targets, and its compliance objective covers protecting PII and the rules, such as GDPR, that govern it.
Help desk staff are on the target list too. A caller posing as a locked-out employee is running exactly the pretexting or quid pro quo attack that Domain 2 describes. CyberSAFE gives support staff the same vocabulary as the users they help, though their own technical growth runs through credentials such as CC or Security+.
Objective 4.5 is written for people who work from home: using a VPN, letting the company manage a work device, collaboration platform settings for microphones, video and recording, keeping smart home devices off the work network, and updating router firmware.
Anyone who handles patient records, client files or visitors. The blueprint covers PHI and HIPAA, proper disposal of sensitive documents, and physical attacks such as tailgating and shoulder surfing that happen at a front desk rather than in an inbox.
CyberSAFE is an awareness credential rather than a hiring credential, so this page lists no salary figures. If it sparks an interest in security work, our CC guide covers the entry-level route into the field.
People mix these three up because all of them say security on the label. They are built for different people: one for every employee, one for career changers, and one for IT staff moving into security.
| CyberSAFE | CC | Security+ | |
|---|---|---|---|
| Issuer | CertNexus | ISC2 | CompTIA |
| Type | Awareness credential and badge | Entry-level certification | Baseline technical certification |
| Domains | 4 | 5 | 5 |
| Assessment Format | 25 items, about 20 to 45 min | Adaptive, 100 to 125 items, 2 hrs | Up to 90 items, 90 min |
| Delivery | Online via CHOICE | Pearson VUE test centers | Pearson VUE or online proctoring |
| Experience | None, basic computer use | None required | None required, 2 yrs IT recommended |
| Passing Score | 80% (20 of 25) | 700 / 1000 | 750 / 900 |
| Exam Cost | No separate voucher | $199 | $439 |
| Renewal | None published | 45 CPEs over 3 years | 50 CEUs over 3 years |
| Best For | Every employee who uses a computer | Career changers starting in security | IT staff moving into security |
Prices are U.S. list prices as of October 2026 and vary by region and tax. CyberSAFE has no separate exam voucher, and its assessment comes with a CertNexus course access key that starts at $15.17. Security+ figures reflect the current SY0-701 exam. Full details are in our CC guide and Security+ guide.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our CertNexus CyberSAFE Essentials boot camp covers all four CBS-510 domains in one day of live instruction, in person or online, using official CertNexus courseware and exam-style practice questions. You take the short online assessment at the end of class, exam assurance adds a full course retake, and 180 days of one-on-one coaching follow.
Phishing, identity theft, AI tools at work, and how to run awareness training that changes what people do.
The long-form companion to this page, written by someone who runs phishing simulations for a living. What awareness training should cover, from phishing and passwords to incident reporting, and why it has to be ongoing rather than a once-a-year slide deck.
Why most awareness programs fail to change behavior, and how to fix that with scenario-based content, microlearning, realistic simulations, a no-blame culture and results leadership will read.
Modern phishing pages carry valid certificates and copy the real brand down to the logo. The warning signs that still work, the fake site types you will actually see, and what to do if you already clicked.
How criminals steal identities through phishing, password reuse, infostealers and voice cloning, and the defenses that match the CyberSAFE device domain: password managers, MFA and a family code word for voice scams.
Every employee who opens a customer record or forwards a spreadsheet is making a privacy decision. The principles behind the privacy laws and what privacy training should actually teach your users.
A February 2026 federal ruling found that consumer AI chats are not privileged. Why that turns the CBS-510 rule about keeping sensitive data out of prompts into a legal question as well as a security one.
The objection every training budget runs into, answered with exit interview research and the real cost of an untrained team. Worth reading before you pitch workforce training to leadership.
The CBS-510 blueprint organizes CyberSAFE into four domains and 14 objectives, each domain with its own weight on the assessment. These are the domains and weights from blueprint version 1.0, issued October 10, 2025. Click any domain for what it covers.
Two objectives. The first is the rules you work under: security policies such as the acceptable use, password and internet-usage policies, laws such as HIPAA, SOX, GDPR and the EU AI Act, industry standards such as PCI DSS, NIST and ISO/IEC 27001, what happens when people ignore them, protecting PII and PHI, and reporting incidents. The second is new in CBS-510: using generative AI safely, from hallucinated answers and voice-cloning scams to deepfakes, intellectual property risk and checking a vendor’s terms of service.
Tied for the heaviest domain. Why attackers do it, how they get in, and who they aim at first, which the blueprint names as C-suite officials, accounting, HR and IT staff. Then the attack types: impersonation, hoaxes, quid pro quo, pretexting, phishing with its smishing, vishing, spear phishing and whaling variants, pharming, baiting, URL hijacking, shoulder surfing, dumpster diving and tailgating. The defense half covers verifying requests and sources, disposing of sensitive data and spotting AI-generated content.
Five objectives, the most practical domain on the assessment. Physical security, including BYOD rules, locking unattended devices, remote wipe and reporting a lost laptop. Wireless safety, including public Wi-Fi, rogue access points, evil twins and Bluetooth discovery. Authentication, from passwords and PINs to MFA and password managers. Data protection, including backups, app permissions and keeping sensitive data out of AI prompts. Malware types and where they come from.
Tied for the heaviest domain, also five objectives. Email: fake security alerts, risky attachment types such as .zip, .exe, .js and .docm, phishing tells, and calling back before acting. The web: reading a URL, what HTTPS does and does not prove, look-alike and shortened links. Social networks, cloud services and remote work, including VPNs, collaboration platform settings, separating work devices on a home network and updating router firmware.
Domains and weights reflect the CertNexus CyberSAFE Exam CBS-510 Blueprint, version 1.0, issued October 10, 2025, the version CertNexus administers today. It replaced the CBS-410 blueprint, so study material that lists Compliance, Social Engineering, Device and Data Protection, or Online Security and Remote Access as domain names was written for the older assessment.
The questions employees and managers ask most often when looking into the CertNexus CyberSAFE credential.
CyberSAFE is a security awareness credential from CertNexus for everyday technology users. The current version is titled CyberSAFE: Cyber Safety in the Age of AI and is earned by passing the CBS-510 assessment. It covers responsible technology use, social engineering, device security and safe internet use, and people who pass receive the credential and a digital badge.
CertNexus calls CyberSAFE a credential and digital badge, and neither its CyberSAFE page nor the CBS-510 blueprint calls it a certification. There is no eligibility check or test center, you can retake the assessment as many times as you need, and CyberSAFE sits outside the CertNexus continuing education program. That separates it from CertNexus certifications such as CyberSec First Responder, which CertNexus describes as ANAB-accredited and DoD 8140 approved.
CertNexus designs CyberSAFE for all users of computers, mobile devices, networks and the internet, whatever their technical ability. That means employees in every department, from the front desk to finance to the executive suite. CertNexus positions it for organization-wide awareness programs, onboarding, annual training, remote work readiness and AI safety initiatives. IT and security staff are better served by a technical certification.
The current assessment is CBS-510, which CertNexus launched in October 2025 with no sunset date set. It replaced CBS-410, which CertNexus said would retire in the first quarter of 2026, and CertNexus now asks anyone with a CBS-410 question to contact it directly. If a course or practice test still says CBS-410, it was built for the older blueprint.
CBS-510 has 25 multiple choice and multiple response questions, and CertNexus estimates it takes 20 to 45 minutes. You need 80 percent, which is 20 of 25 correct, to pass. It is taken online through the CertNexus CHOICE platform or through e-learning, not at a test center.
CertNexus charges no application fee and sells no separate exam voucher for CyberSAFE. The assessment comes with a CyberSAFE course access key, and as of October 2026 the CertNexus store lists the CBS-510 student digital course bundle at $15.17 and the print and digital bundle at $20.99. Instructor-led training from a training partner is priced separately.
No. There are no formal prerequisites and no experience requirement. CertNexus says successful candidates should already be comfortable with basic computing, meaning desktop, laptop or tablet computers, mobile phones, web browsing and email. If you do your job on a computer, you have the background the assessment assumes.
Under the CBS-510 blueprint the four domains are Use Technology Responsibly at 20 percent, Resist Social-Engineering Attacks at 28 percent, Secure Devices at 24 percent, and Use the Internet Securely at 28 percent. Social engineering and internet use carry the most weight, and together they make up more than half of the assessment.
Yes. CBS-510 added an objective called Use generative AI safely. It covers hallucinated output, AI-powered scams such as voice cloning, deepfakes and misinformation, legal and intellectual property risks, and checking an AI vendor’s terms of service. The device security domain adds a rule every employee should know, which is to keep sensitive data out of AI prompts.
CertNexus does not publish an expiration period or renewal rule for CyberSAFE. Its candidate handbook gives CertNexus certifications a three-year term, but CyberSAFE is a credential and is not among those listed in the CertNexus continuing education program. If your organization needs a refresh cycle, set one in your own training policy, and ask CertNexus if you need a firm answer for a specific badge.
You take it again. The CBS-510 blueprint says candidates may retake the assessment as many times as desired. If you train with Training Camp, exam assurance also includes a full course retake, so you can sit the class again before your next attempt.
They serve different people. CyberSAFE is a 25-question awareness credential for employees who are not in security and do not plan to be. ISC2 CC is an entry-level certification for people starting a security career, with an adaptive exam of 100 to 125 items, a $199 fee and continuing education to keep it. If you want a security job, take CC. If you want your whole staff to recognize phishing and handle data safely, CyberSAFE is the better fit.
Yes, if you want a short, low-cost way to give every employee the same security baseline and a scored result to show for it. Just do not mistake it for a full awareness program. Phishing simulations, refresher training and technical controls such as MFA still need to sit around it, so treat CyberSAFE as the common starting point for the whole workforce and build on it through the year.
Whether you are training one person, rolling awareness training out to a department, or planning onboarding for a whole company, tell us what you need and we will help you work out the right plan.