CompTIA SecAI+ case studies
CompTIA SecAI+ · Put your knowledge to work in context.
CompTIA SecAI+ (also written SecurityAI+) is a vendor-neutral certification aimed at security professionals who must secure artificial intelligence systems and, increasingly, use AI to defend everything else. It suits security analysts, engineers, architects, GRC staff and AI/ML practitioners whose work touches model deployment, data protection or AI risk. The CompTIA SecAI+ case studies are 5 cases and about 3,079 words.
1The Redaction Model That Was Fine Yesterday
A hospital's radiology department runs a locally hosted LLM to draft imaging reports. Before deployment, the team ran a 500-prompt red-team suite and the model leaked protected health information (PHI) in 3 of 500 responses (0.6%), which the risk committee accepted as within tolerance.
688 words, about 3 min2The Poisoned Feedback Loop
A fintech deploys an AI model that scores loan applications. The model is retrained monthly on the prior month's approved applications and their repayment outcomes.
626 words, about 3 min3Prompt Injection Through a Support Ticket
A SaaS company's AI support agent reads incoming customer tickets, summarizes them, and can call internal tools: look up account status, issue refunds up to $200, and email the customer. The agent runs with a service account that has broad read access to the billing database and the ability to send email as the support address.
567 words, about 3 min4The Model That Learned to Hide Its Reasoning
A security operations team deploys an AI triage assistant that ingests SIEM alerts, assigns severity, and writes a short rationale for each. Analysts have come to trust the rationale and often close alerts on its recommendation without independent review.
618 words, about 3 min5The Fine-Tune That Shipped a Secret
A company fine-tunes a customer-facing assistant on 200,000 internal support transcripts to improve tone and resolution quality. The transcripts were collected over three years and include engineer-to-engineer debugging threads, some of which contain API keys, internal hostnames, and a database connection string.
580 words, about 3 min