“Who will keep watch over the watchmen when the watchmen are machines?” That question, once a thought experiment, has become urgent as organizations rush to adopt generative AI and other advanced models. The push for speed has outpaced many firms’ ability to govern those systems safely. ISACA, the global association for IT governance, risk, and cybersecurity professionals, has responded with a new credential — the Associate Certified AI Security Manager (AAISM) — designed to equip security leaders with practical AI risk management skills.
The AAISM credential addresses a widening gap: enterprises are deploying powerful AI systems without enough personnel who understand the intersection of security, governance, ethics, and the distinct failure modes of machine learning. ISACA says the program aims to create a cadre of professionals who can evaluate, monitor, and mitigate AI-related risks across the development and operational lifecycle. That aim is timely—AI introduces dynamics that traditional security frameworks don’t fully cover: model drift, biased training data, opaque explainability, and adversarial vulnerabilities, to name a few.
AI risk management: why ISACA’s new certification matters
Organizations have spent decades building mature frameworks for cybersecurity, privacy, and compliance. Those domains benefit from well-understood controls, metrics, and playbooks for incident response. AI changes the risk profile: models evolve over time in unpredictable ways, datasets can encode discriminatory patterns, and attackers can exploit gaps that don’t exist in conventional IT systems. Regulators in the United States, European Union, and other jurisdictions are moving toward rules that will require demonstrable governance of AI systems. Business leaders see the potential for productivity gains and competitive advantage, but many admit they lack the in-house expertise to manage those gains safely.
ISACA’s AAISM is positioned to translate AI-specific hazards into governance and operational controls. By codifying a body of knowledge, it aims to create a common language that helps boards, engineers, and compliance teams align on acceptable risk and remediation strategies. That alignment is critical: mismanaged AI systems can produce harms at scale, including discriminatory outcomes, automated disinformation, and flawed automated decisions in areas such as hiring, lending, and criminal justice. These are not hypothetical risks — they carry legal, financial, and reputational consequences.
Who benefits from a certification like AAISM? Different stakeholders will view it through different lenses:
– Technologists: For engineers and data scientists, AAISM promises to bridge model-building practices with enterprise risk frameworks. It can make security conversations concrete by offering controls for model lifecycle management, logging, monitoring, and incident readiness.
– Policymakers and regulators: Standardized credentials help regulators assess whether organizations possess internal competency when evaluating compliance with emerging AI legislation. Certifications provide signals to auditors and third parties that governance structures are in place.
– Users and customers: Demonstrable governance by credentialed professionals can boost trust. Consumers are increasingly cautious about AI-driven decisions; visible expertise may help restore confidence.
– Adversaries: Formalizing AI security practices raises the bar for attackers, but it also creates focal points attackers might study — certified processes, vendor relationships, and commonly shared best practices.
The certification’s real-world value will depend on key factors: the rigor of the exam, the balance between theory and hands-on training, industry recognition, and pathways for continuous learning. Certifications risk becoming checkbox exercises if organizations treat them as substitutes for cultural change, effective funding, or structural accountability. Training alone won’t close the gap if certified staff lack the authority to enforce controls. Moreover, the rapid pace of AI innovation means curricula must be refreshed regularly to remain relevant.
For practitioners evaluating AAISM, practical questions matter: Does the curriculum cover model validation, monitoring, incident response for AI-specific failures, and vendor risk management? Are there labs or real-world scenarios that teach how to detect model drift or respond to data poisoning? How is ongoing competence demonstrated as new attack vectors and governance expectations emerge? Answers to these questions will determine whether the certification is a meaningful addition to a professional’s toolkit or another line on a resume.
ISACA’s move also mirrors a broader trend: professional bodies across cybersecurity, privacy, and ethics are expanding their curricula to include AI governance. This trend signals a maturing ecosystem in which AI governance is treated as a cross-disciplinary competency rather than a niche specialty — a necessary shift if enterprises want to align AI deployments with strategic goals and societal norms.
Ultimately, the AAISM certification offers an institutional response to a technical and managerial challenge: how to translate AI’s potential into systems that are secure, auditable, and aligned with organizational values. Whether AAISM becomes an industry standard or one credential among many remains to be seen. What is clear is that the question of who will supply and empower credentialed expertise is no longer theoretical. Effective AI risk management requires not just certified individuals but empowered governance, continual learning, and organizational commitment to treating AI safety as a strategic priority.
