AP® Cybersecurity · course guide
Is AP® Cybersecurity for me?
A yearlong AP® Career Kickstart course: college-level cybersecurity, career-connected skills and an end-of-course AP® Exam. Here is everything you need to decide, in one page.
Summarized from public College Board information, checked September 2026. Always confirm details, especially exam dates, on the official AP® Students page.
In 60 seconds
- What level?Like an introductory college cybersecurity course.
- Prerequisites?None recommended. No prior coding needed.
- What will I do?Analyze risk, choose mitigations, detect attacks, work with evidence and collaborate.
- How am I assessed?A fully digital exam in Bluebook: 60 multiple-choice questions and 1 free-response question.
- What can I earn?An AP® score, possible college credit or placement, and with a qualifying score the AP® Cybersecurity Credential.
- Where can it lead?College cybersecurity or IT study, certifications, internships and cyber careers.
What is AP® Career Kickstart?
Career Kickstart courses combine AP® college-level learning with career-connected technical and professional skills, authentic scenarios and, with a qualifying exam score, an employer-endorsed credential. College Board builds them with industry advisors, college faculty, high school teachers and career and technical education (CTE) leaders. AP® Cybersecurity is one of them; AP® Networking is a separate Career Kickstart course you do not need first.
What you study: five units
- Unit 1: Introduction to Security1.1 Understanding Social Engineering · 1.2 Suspicious Website Logins · 1.3 Best Practices for Public Networks · 1.4 AI-Based Cybersecurity Attacks · 1.5 Leveraging AI in Cyber Defense
- Unit 2: Securing Spaces2.1 Cyber Foundations · 2.2 Physical Vulnerabilities and Attacks · 2.3 Protecting Physical Spaces · 2.4 Detecting Physical Attacks
- Unit 3: Securing Networks3.1 Network Vulnerabilities and Attacks · 3.2 Protecting Networks: Managerial Controls and Wireless Security · 3.3 Protecting Networks: Segmentation · 3.4 Protecting Networks: Firewalls · 3.5 Detecting Network Attacks
- Unit 4: Securing Devices4.1 Device Vulnerabilities and Attacks · 4.2 Authentication · 4.3 Protecting Devices · 4.4 Detecting Attacks on Devices
- Unit 5: Securing Applications and Data5.1 Application and Data Vulnerabilities and Attacks · 5.2 Protecting Applications and Data: Managerial Controls and Access Controls · 5.3 Protecting Stored Data with Cryptography · 5.4 Asymmetric Cryptography · 5.5 Protecting Applications · 5.6 Detecting Attacks on Data and Applications
Topic titles match the official course and exam description (CED), the document that defines what the course and exam cover.
The four skills
| Skill | What it means | Share of multiple choice |
|---|---|---|
| Analyze risk | Identify vulnerabilities and threats, how adversaries could exploit them, and judge likelihood and impact. | About 25 to 40% |
| Mitigate risk | Identify security controls, choose layered defenses, evaluate protections, and implement and log mitigations. | About 25 to 40% |
| Detect attacks | Choose detection methods, monitor systems, and analyze digital evidence to detect and classify attacks. | About 25 to 40% |
| Collaborate | Set shared goals and team roles, use AI as a collaboration tool, and complete cybersecurity tasks together. | No separate exam weighting |
The exam at a glance
Fully digital in Bluebook, 2 hours 10 minutes. The 2027 exam is scheduled for Wednesday, May 5, 2027, session 1; check College Board for the current date.
| Section | Questions | Time | Weight |
|---|---|---|---|
| I: Multiple choice | 60, as single questions and sets of 2 to 4 sharing one scenario | 80 min | 70% |
| II: Free response | 1 Device Security Analysis question with several sources about one device | 50 min | 30% |
On the free response you analyze security policies, firewall configurations, file-system permissions and logs; identify security issues and evidence of attacks; explain how a change to a permission, policy or configuration affects the device; and cite evidence for your reasoning. Practice that format with the Case 03 boss level and the free-response questions on the Unit 1 and Unit 2 review pages.
Score, credit and credential: three different things
AP® score (1 to 5)
5 extremely well qualified, 4 very well qualified, 3 qualified, 2 possibly qualified, 1 no recommendation. Scores are set by standard-setting research, not by competing with classmates.
College credit
ACE and College Board recommend 3 lower-division credits in cybersecurity for a 3 or higher. Each college sets its own policy.
The credential
An employer-endorsed AP® Cybersecurity Credential for students who finish the yearlong course and earn a qualifying exam score. No public numerical cutoff yet.
Where it can lead
Examples, not guarantees: college cybersecurity, computer science or IT study; further certifications; internships and apprenticeships. Careers College Board lists include information security analyst, digital forensic analyst, junior information security engineer, network and computer systems administrator, computer user support specialist and compliance manager.
Questions students ask
Do I need to know how to code for AP® Cybersecurity?
No. College Board recommends no prerequisites and says no prior coding knowledge is required.
Is the AP® Cybersecurity Credential the same as CompTIA Security+ or Cisco CCST?
No. College Board says the credential is aligned with those certifications, but it is a separate credential. Alignment does not mean you earn the industry certification.
What score earns college credit?
For AP® Cybersecurity, ACE and College Board recommend 3 lower-division credits in cybersecurity for a score of 3 or higher. Each college decides its own credit and placement policy.
What score earns the credential?
College Board says a qualifying exam score after the yearlong course. Its public credential page does not list a numerical cutoff, so do not assume it is the same as the credit threshold.