The 2027 Security Skill Stack: Use AI, Govern It, and Secure It

Key Takeaways

• Fundamentals still matter: AI amplifies the judgment behind it, so gaps surface faster
• AI in the SOC: analysts verify AI output and make decisions
• Governance needs an owner: a security manager can lead while partnering across the organization
• Secure AI systems: control who an agent acts as and what data it can reach
• Train by gap: match each role to the training that closes its gap

During a budget review, a CIO asks a security manager a question: "We've rolled out the AI tooling. Who on your team is trained to use it, and who's watching what it touches?" A training spreadsheet sits open on the manager's laptop, sorted by certification and level. It has no column for either half of that question.

AI is already part of security work, so the question is fair. The World Economic Forum's May 2026 report found that 94% of cyber leaders call AI the defining force in cybersecurity, and 77% of organizations already use it in their cyber operations. A plan that tracks only certification levels won't show where the gaps are.

Attackers and defenders both rely on AI, which changes a security team's work in three places. Teams use it in daily defense, govern how it's used, and secure the systems built on it and everything those systems can access. Fundamentals sit underneath all three. Certification roundups often rank by level, an ordering that says little about the lane a course serves.

The useful planning question is specific: where does AI change your team's work, and which training fits each gap? Both answers start with the base all three lanes share.

Which Security Fundamentals Prepare Your Team for AI?

Using AI well in security work starts with core security judgment, including networking basics, threat awareness, and an attacker's view of your own systems. Automation amplifies whatever judgment it's given, so foundational gaps show up faster once AI joins the workflow. Managers can start by spotting who on the team has one.

Gaps show up in everyday work. An analyst with thin fundamentals may accept an AI-generated alert summary at face value, and an admin may approve a suggested setting without knowing what it changes. The people best placed to catch AI's mistakes are the ones who know what normal looks like.

Three courses address those gaps.

• Security+: for team members building core knowledge, with the next version (SY0-801) expected on or around November 17, 2026, and adding AI-related risks
• TCM Security Ethical Hacker Bootcamp: a live course in hands-on offensive skills, for analysts and admins
• EC-Council CEH (Certified Ethical Hacker): a certification path to the attacker's view, with v13 adding AI-assisted techniques

With Security+, anyone with a gap can start on the current version or plan around the new one. The two ethical hacking courses overlap in purpose, so the better fit depends on the role, the learning format, and the credential each person needs.

Individual practitioners can run a quick self-check. If you can't explain how a phishing email becomes a compromised account, start here. Foundational gaps close with focused training.

With the base in place, the first lane is the security operations center (SOC), where analysts work through alerts and logs and increasingly rely on AI in their workflows. The next challenge is training them to use it without handing over their judgment.

Train SOC Analysts to Work with AI

Analysts get the most from AI when they treat its output as a starting point to verify. Training should build that habit alongside tool skills.

AI changes the front of the analyst workflow first. Tools can summarize alerts, pull related signals together, and suggest next steps in an investigation, freeing time for harder questions. The analyst still owns the harder questions, such as whether an alert fits how this environment normally behaves and when to escalate.

Training needs differ by analyst experience.

• New to the SOC: core monitoring, triage, and investigation skills
• Working alerts daily: AI-assisted triage and checking its output
• Ready for senior work: incident response and threat hunting
• On a Microsoft-based stack: tool-specific training for the platform the team runs

Specific courses map to those stages. TCM Security's Security Operations learning path builds from IT support fundamentals through associate-level SOC skills up to professional-level work, and its entry-level courses list networking and foundational security concepts as prerequisites.

• TCM Security Operations (SOC) 101: an on-demand course of 30-plus hours for analysts new to the SOC
• TCM SOC Level 1: a live class covering fundamentals for Tier 1 and Tier 2 SOC roles
• TCM SOC Level 2: a live class in incident response and threat hunting

Microsoft's Security Copilot course is a separate, tool-specific option. Microsoft lists working knowledge of security operations, incident response, and Microsoft security products as prerequisites for that course.

• SC-5006: a Microsoft Security Copilot course covering prompts, plugins, and custom promptbooks

Individual analysts can run a quick self-check. If you can triage an alert without AI, you're ready to learn to work with it, and if you can't yet, build that skill first.

AI can speed parts of triage and investigation when analysts know how to verify its output. Daily use also raises questions that no single analyst should settle alone, such as which data the tools can see, who approves new uses, and when output gets a second review. Naming the person who owns those answers is the next step.

Who Should Lead AI Governance on Your Team?

On the security side, a security manager is often the natural owner of AI governance, depending on organizational structure. Ownership covers AI-use policy, risk assessment of what the tools can reach, and oversight of daily practice. The owner also works with privacy, legal, risk, and technology leaders on broader organizational governance.

The 2026 SANS | GIAC Cybersecurity Workforce Research Report found that 54% of organizations have AI governance policies, while only 38% provide comprehensive AI security training. SANS Chief AI Officer Rob T. Lee told RSAC 2026 attendees that "policy without practice is just paper," and an owner connects the two.

Governance training builds in two layers: a management foundation and an AI-specific layer, and the second depends on the first.

• CISM (Certified Information Security Manager): ISACA's management credential, with an update effective November 3, 2026, adding architecture content and a stronger strategy focus
• CISSP (Certified Information Systems Security Professional): ISC2's credential for designing, implementing, and managing a security program, and an alternative route to the same foundation
• AAISM (Advanced in AI Security Management): ISACA's AI-specific credential covering AI governance, risk management, and controls, for active CISM or CISSP holders

An owner with the right training gives the team a clear voice on policy, risk, and oversight. Engineers who build and secure the systems, identities, and data AI can reach put those rules into practice.

How Can Engineers Secure AI Systems and Agents?

Engineers already know how to secure systems that hold access, and AI builds on that skill set. The work comes down to controlling who an AI system acts as, which tools it can use, and what data it can reach.

AI adds new ways for each control to fail. The Open Worldwide Application Security Project (OWASP) names goal hijacking, tool misuse, and identity and privilege abuse as risks for agents in its Top 10 for Agentic Applications. Its Top 10 for large language model applications adds sensitive information disclosure and supply chain weaknesses.

Training fits four gaps.

• AI threat modeling: how AI systems fail and how attackers target them
• Agent identity and access: limiting what an agent can act as and reach
• Cloud workload security: protecting the platforms AI runs on
• Endpoint policy: governing AI tools and agents on managed devices

Specific courses fit each gap. CompTIA's SecAI+ offers a vendor-neutral starting point, and Microsoft-centered teams have role-specific options for cloud, identity, and devices. Microsoft uses Intune, alongside Defender, to discover and manage AI agents on managed Windows devices, though some of those features are still in preview.

• CompTIA SecAI+: vendor-neutral coverage of technical controls for AI systems, AI-assisted security work, and governance, risk, and compliance
• SC-500T00: Microsoft's cloud security course, successor to AZ-500T00, extended to cover AI workloads and agents
• SC-5009: a course on securing AI workloads with Microsoft Defender for Cloud and Microsoft Entra
• Intune 55399: a foundation in device management and endpoint security with Microsoft Intune
• MD-4011: an Intune extension that adds Microsoft Security Copilot, for teams already familiar with Intune

Individual practitioners can find their next step by asking which part of the stack they already run, whether devices, cloud workloads, or identity, and starting with that gap.

Securing AI requires engineers, analysts, managers, and endpoint admins to work from the same picture of what AI can reach. With each lane mapped, the remaining step is deciding who on your team trains for which gap.

Map Your Team's Next 12 Months of Training

Deciding who trains for which gap starts with seeing how the roles depend on one another. An analyst uses AI in an investigation while the manager sets acceptable use and oversight. Engineers control agent identity and access, endpoint admins control device posture, and incident response knows what to log, escalate, and contain.

Training these roles together can help a team build a shared operating language and better coverage across roles. The 2026 SANS | GIAC Cybersecurity Workforce Research Report found that 27% of organizations have experienced breaches tied directly to workforce capability gaps, which makes each role's gap a team-level concern.

Matching training to each gap, in parallel lanes, lets a team build coverage across roles at the same time, improve handoffs, and reduce reliance on isolated expertise. A role-by-gap map shows where each person can start.

Core security judgment	Developing analyst or admin	Security+, TCM Ethical Hacker Bootcamp, TCM SOC Level 1
AI-assisted defense	SOC analyst or manager	SC-5006, TCM Security Operations path and SOC Level 2, CySA+ where appropriate
AI security breadth	Experienced practitioner	SecAI+
AI governance	Security manager	CISM or CISSP, then AAISM
AI workload and agent security	Security or cloud engineer	SC-500T00, SC-5009
AI-aware endpoint operations	Endpoint admin or analyst	Intune 55399, then MD-4011

Some roles span more than one row. A SOC analyst can sit under both AI-assisted defense and endpoint operations, and a manager under both AI-assisted defense and governance. Overlaps like these mark people whose roles already span more than one lane, and the map turns a long course list into a plan the team can pace by need and budget.

How Will You Answer the CIO's Question?

A plan like this changes how a manager answers the CIO's question. The training spreadsheet now has a column for each half: analysts who use AI without handing over their judgment, an owner for governance, and engineers who control what AI systems can reach.

The most useful question for 2027 is where AI changes your team's work, whether in using it, governing it, or securing what it can reach, and which training fits that gap. Fundamentals support every lane, and any lane without an owner shows a team exactly where to start.

New Horizons and TCM Security help organizations build coverage across every lane, from hands-on security fundamentals and SOC training to AI governance and securing cloud, endpoint, and AI systems. Training can match each person's gaps, so every role builds the skills its work requires.

If your CIO asked today who is trained to use AI and who is watching what it touches, could your team answer for every lane?

Explore team training from New Horizons and TCM Security, including private group training, and start with the gap that matters most to your team.