EC-Council certification has meant one fairly simple idea for 25 years: hackers need to think like hackers, so security professionals should train the same way. That idea still anchors Certified Ethical Hacker, the credential most people associate with the EC-Council name. But on February 10, 2026, the organization did something it had never done before. It launched four brand new AI-focused certifications and rewrote its top executive credential on the same day, calling it the largest single expansion of its portfolio in the company’s history.<\/p>\n
That’s not marketing language you can just take at face value, so it’s worth actually digging into what changed, what any of it costs, and which parts of it you can actually sit down and study for today.<\/p>\n
Jay Bavisi, EC-Council’s Group President, framed the launch bluntly in EC-Council’s own announcement<\/a>: “AI is moving from experimentation to infrastructure, and the workforce has to move with it.” That’s a different message than most vendors send when they bolt one new exam onto an existing lineup. EC-Council didn’t add a single AI exam. It built an entire second track that sits alongside its existing penetration testing, forensics, and network defense certifications, and gave that new track its own naming convention and its own scoring framework.<\/p>\n The timing lines up with what’s actually happening in hiring. Security teams are being handed AI systems to defend, generative tools to govern, and in plenty of cases, AI-powered attacks to fend off, often without a credential that maps cleanly to any of those three jobs. EC-Council’s bet is that a single certification body can own all three lanes at once, from the analyst testing a model for prompt injection flaws to the executive signing off on an AI governance policy.<\/p>\n It also isn’t happening in isolation. CompTIA rolled out its own AI-focused security certification, SecAI+, earlier this year<\/a>, and ISACA and ISC2 both moved on similar timelines, covered further down. EC-Council’s expansion is the broadest of the bunch so far, both in headcount of new exams and in how far up the org chart it reaches.<\/p>\n Rather than releasing four unrelated exams, EC-Council organized the new lineup around what it calls the Adopt, Defend, Govern (ADG) framework. Adopt covers deploying AI responsibly in the first place. Defend covers securing AI systems once they’re running. Govern covers the policy and accountability layer sitting on top of both. Each new credential maps to one part of that chain.<\/p>\n The entry point of the group. AIE is meant to establish baseline AI literacy for anyone touching AI tools at work, not just security specialists, which makes it the one credential in this launch that isn’t really a security exam at all.<\/p>\n Aimed at professionals responsible for turning AI strategy into an actual delivery plan, with real accountability attached to whether an AI initiative ships on time and within its stated governance boundaries.<\/p>\n Built for security practitioners who test AI systems directly, including prompt injection, model exploitation, and data poisoning attacks. This one assumes you already know offensive security and are extending that skill set to AI-specific attack surfaces, not starting from zero.<\/p>\n Focused on enterprise AI governance mapped to frameworks like the NIST AI Risk Management Framework and ISO\/IEC 42001. This is the credential for people writing policy, not writing code.<\/p>\n Notice the range across all four. AIE assumes almost nothing walking in the door. COASP assumes real hands-on security experience already. That’s a wider entry-to-expert spread than EC-Council has ever tried to cover with a single coordinated launch.<\/p>\n The second half of the February announcement got less press coverage but arguably matters more for anyone already deep into the EC-Council ecosystem. Certified CISO (CCISO), exam code 712-50, was rebuilt as version 4, specifically to address AI-driven risk at the executive level. EC-Council’s own framing is that security leaders are now accountable for systems that learn and adapt on their own, and the old CCISO curriculum simply didn’t address that.<\/p>\n CCISO v4 keeps the certification’s five core domains intact, but folds AI-driven governance and what EC-Council calls “executive war games” directly into that structure rather than treating AI as a bolt-on module:<\/p>\n The eligibility bar hasn’t changed. Candidates still need five verified years of experience across each of those five domains to sit the exam without going through EC-Council’s official training track first.<\/p>\n That’s a meaningfully different audience than the four new AI credentials above. CCISO was never an entry point, and v4 doesn’t change that. It’s a statement that AI accountability now belongs on the CISO’s desk specifically, not just on a security engineer’s task list.<\/p>\n Here’s where a lot of the coverage of this launch stops short. A press release announcing four new exam codes doesn’t automatically mean every training and practice-test vendor, DirectCertify included, has caught up yet. Checking DirectCertify’s own EC-Council catalog directly shows a mixed picture as of this month:<\/p>\nFour New Credentials, Built Around One Framework<\/h2>\n
Artificial Intelligence Essentials (AIE), Exam Code 112-59<\/h3>\n
Certified AI Program Manager (CAIPM), Exam Code 312-41<\/h3>\n
Certified Offensive AI Security Professional (COASP), Exam Code 312-52<\/h3>\n
Certified Responsible AI Governance and Ethics (C|RAGE), Exam Code 612-51<\/h3>\n
Certified CISO Gets Its Biggest Rewrite Since Launch<\/h2>\n
\n
What’s Actually Available to Study For Right Now<\/h2>\n