Sean Martin asks ISC2 Chief Operating Officer Casey Marks what happens when employers send people to learn AI but will not let them build with it. Marks calls that learning superficial and points to ISC2's new AI certification.
Employers send people to conferences and through certification exams, then limit what they can do with the result. With AI, that can mean staff may use it for certain tasks but are not allowed to code, build agents or connect systems.
Sean Martin raises that gap with Casey Marks, Chief Operating Officer at ISC2, at ISC2 Security Congress in Denver. Marks says there is a superficiality in learning something you cannot apply, and calls it a fundamental question for the individual and the environment they work in.
The conversation moves to why certification exists. Marks describes it as scalable opportunity for people who cannot spend 20 years in formal education, and says most ISC2 certifications require work experience, with the Certified in Cybersecurity (CC) as the exception.
Sean describes having access to tools and a supportive company earlier in his career, and wonders about people without that access now. Marks says he wishes he had better answers and that "I think that opportunity is gate kept," a matter of genuine concern and of economics. Sean adds that tokens cost money too. Marks offers a conjecture: given the risks, environments will have to move toward permissive ones, and those that do not "probably won't be around."
They close on the AI security certification ISC2 announced that day. Marks describes it as AI first, not AI added to the CISSP domains, and says the beta test is expected for candidates globally in December. His participation figures are his own.
For security leaders, the conversation asks whether the people you train can practice what they learn.
Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=certified-to-learn-ai-not-allowed-to-use-it-the-access-gap
ISC2 Releases AI Security Certification Pilot Exam Outline | https://www.isc2.org/Insights/2026/10/isc2-releases-ai-security-certification-pilot-exam-outline
Code of Professional Conduct in Practice (ISC2 Express Course) | https://www.isc2.org/Insights/2026/08/new-isc2-express-course
Certified in Cybersecurity Certification Exam Outline | https://www.isc2.org/certifications/cc/cc-certification-exam-outline
Casey Marks By Marco
Recorded 2026-11-05
With Casey Marks, Chief Operating Officer at ISC2; Sean Martin, Co-Founder & CTO (his own site and Studio C60 profile). Podcast bios say 'Co-Founder, ITSPmagazine & Studio C60 | Host, Redefining CyberSecurity Podcast & Music Evolves Podcast' at ITSPmagazine (not confirmed online); Marco Ciappelli, Co-Founder (ITSPmagazine and Studio C60). Older sources also show CMO and Creative Director at ITSPmagazine (not confirmed online)
Times are in the published episode: the conversation starts at 00:00:55, after the front bumper.
[00:00:55] Casey Marks: I think that folks should know, what shouldn't folks know at this point in time. wide you know, the way that I'd say it is I think that we are in a place self-serving with the velocity and sheer volume of information that is all sides now, but the signals coming from some time, you know, big data fears and all these things that have been. been. of third party attestation validation is so much more important having trusted sources of information as best as you can get, is so much more critical that has ever been
[00:01:41] Sean Martin: Casey Marks? C-O-O-ISC2? You've been doing ISC2? stuff for few days now, think.
[00:01:51] Casey Marks: Yes. Just a Few
[00:01:52] Sean Martin: One of the one of the long term folks, if I'm not
[00:01:55] Casey Marks: yes. yes. A little entering my, 11th at ISC2 I'm very happy to say And started. Back in 2015 as the director of Examinations principally responsible for taking the CISSP from a. hour examination to a, Computerized Adaptive Testing.
[00:02:24] Sean Martin: come
[00:02:24] Casey Marks: on. I like the six
[00:02:25] Sean Martin: hour.
[00:02:26] Casey Marks: is not an indication I know people like to exert on the that come after them, but it, is, was genuinely unnecessary.
[00:02:38] Sean Martin: Hours. chill. I forget even where I took it. traveled somewhere for it. But anyway.
[00:02:45] Casey Marks: The trauma.
[00:02:46] Sean Martin: trauma. Exactly. All right. 11 changed profession. for technology, obviously. Talk about continued education. stay current, stay relevant, stay interested, to stay connected, what matters you, society, whatever it moves you. We, I believe humans, we need continue to learn, important as professionals do customers they serve. This thought's been rolling around my head first day we're live Denver, by the it's two sides of the individual keep their skills remain relevant in the workforce, things in a way or learn things matter the business so they can contribute effectively their program to bottom line. and potentially the business is making some investment in the, in individual do what I'm thinking is one thing to send somebody get, extra education, go Congress to attend sessions. maybe even sit for three hours get the exam. pass the exam certification. It's another to actually embrace the learnings the benefit of business. So, and the, thing that I'm struggling and why I wanna thoughts on is
[00:04:32] Casey Marks: Sure.
[00:04:33] Sean Martin: take AI for example. Mm-hmm. I know companies are opening up the use of AI for certain But people aren't allowed to code or they're not allowed to build agents, they're not allowed to connect systems,
[00:04:49] Casey Marks: right,
[00:04:50] Sean Martin: but only do small certain things, they're kind of not really enabled to take all the learning they have and continue to learn, help the business learn as well, So I feel there's some. Some muddiness there
[00:05:07] Casey Marks: there's a certain super superficiality in terms of if you can't actually apply. what you learned, right. to put it in the real world and to do than deploy you learn, but be able to create knowledge beyond And I, think you know, question pretty fundamental. to the an individual and the environments that they work in who they're responsible to ultimately, know, immediately and I think that, you know, in ISC2, you know, we know, embrace that there's, there's lots of different ways that individuals, you know, come their profession. prepared, Right. I mean, formal education, there's certificates, there's certifications, there's ongoing learning, there's on job training, there's, you know, apprenticeships and mentorships all of that, to that that development knowledge and the ability impart it. There are a couple of things unique, you know, about. the certification mission that, you know, it only comes about because it's It's it's scalable. It's an opportunity. not that, know, it would be wonderful if everybody could learn at the Master's for 20 years. right? It's just not, feasible. it's just not possible And not everyone has that opportunity in life. Some people are very lucky to, be able to do that. but for Those who aren't. they need opportunity. You know, The classic conundrum of, you know, how do you get experience without a job, How do you get a job without experience, you know, these types of things, like you have to start somewhere. And so certification is a, is a very clear indicator of how serious you are about, you a robust environment terms at ISC2, all of our certifications do require work experience except, except for the CC, which is level foundational first level certification in cyber. But for everything else, you know, you need to have demonstrated some genuine have to, get to that point. You hope that once you're recognized and specialty of your discipline, you want to be able to have that professional responsibility to utilize, you know, your knowledge, skills, and abilities and deploy them effectively and efficiently and pass it on. I mean, this is we're here at congress and this is one of these great networking events, right? People have formal learning opportunities to learn the latest and greatest happening here. But you. all and you find out you find out the differences. And I know that there is a deep seated, and I've heard this many times during the course the last couple days. The willingness to give back and to be able to provide what an individual learns back to someone who's just or who hasn't had the opportunity the otherwise. So I think it is fundamental. I think it is, it is a challenge. It will always be a challenge in a. In environments where Genuine risks to the health wealth and the safety and welfare. of it's an ongoing challenge, but you would hope that the demonstrated ability to have gone through a process, and very rigorous process like certification would lead to employer individual
[00:08:24] Sean Martin: So back in the day me, it security, security, application engineering and human awareness and all kind stuff. Obviously AI has taken, taken over the news cycle and touching all of that stuff again. Put it in a Right, exactly. So how, I mean, it was clear to me. System
[00:08:55] security. Sit down with systems. Maybe work teams talk about they work, they're vulnerable, how you secure them, how they compromised, and how you recover kind of that whole Thing do that for all the different and I was fortunate to work for a company supported me in I'm wondering today with ai, and kind of back my question as well. We had access to tools, what I'm right. not everybody has access to the tools to get in and get down and dirty with what's going on, really learn to then learn for the new certification that
[00:09:38] Casey Marks: think
[00:09:39] Sean Martin: that you're putting
[00:09:39] Casey Marks: out. I think that's a fundamental now in opportunity the Opportunity, to experience, is a genuine I wish I had better answers how solve some of these problems. I think that opportunity is gate kept from a genuine concern standpoint. And then general economics as well in terms of who has access to what. and when. I think that there there are some
[00:10:01] Sean Martin: tokens cost money too.
[00:10:02] Casey Marks: there, are, some, there are some real, some real issues. We're at the precipice of that right now. I mean, but if I, but if I were to conjecture, I think eventually it will be understood that, given the risks that. that are presented the It has to, move toward a permissive environment, for people to be able to be attack. and I there's, there's not gonna be a substitute for it because those who don't probably won't be around to realize, don't frontier people. getting outta they there. Frontier people, they have to, have to be they have be
[00:10:41] Sean Martin: of it.
[00:10:42] Casey Marks: They be the
[00:10:44] Sean Martin: how does one create the AI certification is right, pilot now, I guess, announced
[00:10:55] Casey Marks: Is that we, announced that today. Go. That's after, after months of development in very rapid short form express We will we announced the content outline the beta test. We are expecting that in December of this year, that the beta test will be available to candidates globally. That will be the first test of what the work that's been done. And if I could characterize that it's this has been largest has undertaken certification. development. we've Dozens of countries representative. all not only describing practice, you know, what is impacting them today, what are they anticipating? What's important, what happens a lot? What's really important? you know, trying to discern because, you know, ex exams, infinite. know, must make decisions we've had over 10,000 people raise their hand and express interest in being a part of this. We've an any, at a think that, suggests that practitioners in general they're, they're hungry for understanding and moving forward. So as you indicated, we made this available. We are just starting out. Everything from the exam definition phase to the exam development phase. We are in the throes right now of. Of building. Content, to be able to match that. All volunteer driven. Everything at IC two in the certification programs is for members by members. We have augmented that learning with people outside of the membership in, an, in an AI first type environment where maybe they're not security professionals, but they perhaps, AI those build bridge, right. and to be
[00:13:03] Sean Martin: So, without getting into I wouldn't expect you to know all this stuff, but what are some of things that people can to see? exam.
[00:13:16] Casey Marks: That's, that's, really interesting. So if I can characterize some of what's been, what tell there are fundamental principles of security that will, that this is AI first. environment. So this is not slapping AI in front of CISSP, domains. You will see a number of things that are different. You A lot of those embedded challenges with regard lot you're seeing in practice right being, addressed in fundamental ways that are, that are not genuine. Reg current practice is what I'll say is that you're seeing a lot of the best way in speaking with practitioners right now what they're bringing to the table today is not even what they would've had. 12 ago, things change so rapidly usage and what have you. What I, what I can tell you is that there is a very, very concerted, discussion that happened amongst almost all the practitioners that were involved ISC2 members in Europe And in Asia, and North America. professional, I don't know that I've ever seen that any of our examination development efforts that really focus that much on ethical
[00:14:44] Sean Martin: because you oversee the ethics and
[00:14:46] Casey Marks: Of conduct
[00:14:46] Sean Martin: and all the other too.
[00:14:47] Casey Marks: I'm very that our standards and practice group building on the ethical canons that all ISC2 members are responsible. code professional conduct that goes above and beyond, and it's more exemplifies genuine dilemmas, in the workplace with regard to how practice is engaged. And it's one of these things that members here, and folks who are attending ISC2 Security Congress are debating, discussing. and learning. It, we have free courses online be read and utilize and deploy and it's part of the professionalization. So in a professionalization scheme as you this young industry as it's currently defined. It's not like you know, medicine banking or nursing or what have you. That we're still evolving and developing, right. And So to have to have a definition of competency. To have ethical responsibilities that are associated with it and then moving on moving forward in you licensed. one thing to say you have code of how to behave. what the individual who chooses not to what do you. do about them the, I, Our responsibility is solely to the, individual it's to all the It's to the employer, How that those letters. that they know what they're supposed to know and they know how to be able to do what they're supposed to be able to do and they're gonna do. it
[00:16:29] Sean Martin: third, third bullet.
[00:16:30] Casey Marks: Yeah.
[00:16:33] Sean Martin: So many things we can dig into. Let's, wrap this. lot of my audience are security leaders, CISOs They're managers. a lot of practitioners, but also business leaders who trying to wrangle with ai. maybe word of advice or some things that, can take away
[00:16:58] Casey Marks: really So if I were to maybe parse the audience slightly differently. I'd, I'd have different, different, advice but I'll, I'll, I'll take the in terms of business leaders, those who rely on security experts to be able to get what they need and to be able to do what they do. become more steeped in this space. Right? So cybersecurity while it can be worth diving in. It's worth understanding. I think that there's if I were to conjecture from being on the outside, there's there's kind of the older paradigm regards to technology and innovation. you worry worry if something breaks, that's when we'll worry about it. If something's hurtful, when I think there's been enough cognizant, the you the concerns frontier. models. You not to be mentioned specifically, but it talked about, you know, the you know, the end of. of humanity, basically business technology that would seem to suggest that maybe more people need to be involved, and understand security, and So I think that there again two perspective we do make it approachable there are entry, know, maybe cyber important to you. Whether it be you learning certificates, certifications. are genuine more your More comfortably. And I think that would be really, really for CISOs and security leaders. it would be hard pressed for me to give the advice that they probably have already been given that it is different this time. And it's not going back, Scott spoke about it at to security that the rate of change is be can expect anybody anticipate what the next steps good on because gonna be challenging.
[00:19:11] Sean Martin: They might be right today and wrong tomorrow, but
[00:19:15] Casey Marks: anyway. Absolutely. probably equal parts of
[00:19:19] Sean Martin: All Anything we didn't touch on you should
[00:19:26] Casey Marks: I think that folks should know, what shouldn't folks know at this point in time. wide you know, the way that I'd say it is I think that we are in a place self-serving with the velocity and sheer volume of information that is all sides now, but the signals coming from some time, you know, big data fears and all these things that have been. been. of third party attestation validation is so much more important having trusted sources of information as best as you can get, is so much more critical that has ever been be in the context of professionalization you know, there are those who believe in certification and you know I know what I, know and I can, when I can, tell my story. I can. That's all great. That's all fine. I'm, I'm a Professional as well. I have the same things. I also hold credentials in my space as well for the same exact reasons. It, if nothing else demonstrating and showing a commitment is as important as any specific problem staying
[00:20:47] Sean Martin: sure. Looking, looking for a doctor. go to What creds do they have? What's their experience? You want And it's, when it's something important, You want all three of
[00:21:00] Casey Marks: And you want to know that for every one of those new drugs that you see commercial that out every that You where they come from, what how they work. with Every use of technology biopharmaceutical, you rate of change is incredible in all we do best
[00:21:17] Sean Martin: hopefully they have a good bedside manner and can chat with too.
[00:21:20] Casey Marks: course.
[00:21:20] Sean Martin: can understand what they're saying.
[00:21:22] Casey Marks: Of course.
[00:21:24] Sean Martin: all comes together well, Casey? Pleasure meeting Pleasure chatting with Thanks for having me Congress.
[00:21:30] Casey Marks: Thank you so
[00:21:30] Sean Martin: much. Keep up the good work. I'm volunteering on the AI Perfect. So I think they just called on me for whatever the step
[00:21:37] Casey Marks: happy to have
[00:21:38] Sean Martin: you there. you. Thank you. I'll be contributing there. And everybody listening, tuned. live from Denver ISC2 Security Congress. Lots conversations heading your way.